Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also ...

learn more… | top users | synonyms (2)

2
votes
2answers
697 views

How do I convert the definition of E-521 into a curve definition a la Bouncy Castle?

I am currently trying to create an ECCCurve for E-521. Unfortunately, it is not currently a named curve in the library I am using, so I will have to define it manually. I am using the definition of ...
2
votes
1answer
127 views

Where can I double check my elliptic curve results?

I am trying to do some elliptic curve calculations by hand, just to refresh myself on how the system works. I calculated some points and did some operations by hand. I am trying to double check my ...
2
votes
1answer
220 views

Is this ECC encryption key sharing method okay?

Is this encryption key sharing okay to use? Or is much better to use ECIES? $G$ = base point $a$ = Alice’s private key $b$ = Bob’s private key $A = aG$ = Alice’s public key $B = bG$ = Bob’s public ...
2
votes
1answer
510 views

inverse problem about scalar multiplication on elliptic curve

Let $E$ be an elliptic curve over a finite field $F_p$. Given $n$ be a positive integer and $Q$ be a point on $E$, assume that $Q=nP$, how can we find this $P$? We can assume that $n|p-1$. If $n$ is "...
2
votes
3answers
239 views

EC equivalent for RSA-OAEP

I have some questions regarding aforementioned subject: Is there a EC equivalent of RSA-OAEP key transport/encryption algorithm ? Is ECIES-KEM sufficient ?
2
votes
1answer
181 views

Discrete log analog of ECM factoring algorithm?

Anecdotally, most factoring algorithms have a corresponding variant algorithm that can be used to attack the discrete log problem using similar ideas. Is there an analog of the elliptic curve (ECM) ...
2
votes
1answer
220 views

Generating non-supersingular elliptic curves for symmetric pairings

I am looking into the application of pairings in CPABE in particular. I've notice that the scheme uses a supersingular curve as the basis of the pairing. Looking through Ben Lynn's thesis for the ...
2
votes
1answer
37 views

Given $g^a, Y$, is it hard to distinguish $e(g,g)^{ab}$ from a random value?

where $g$ is a group element in bilinear group $G$ $Y = M.e(g,g)^{ab}$ $M$ is a message Does anyone know the answer or suggest some material for reference? Many Thanks
2
votes
0answers
30 views

Boneh/Franklin Identity based encryption with Tate pairing

Boneh/Franklin developed an identity based encryption scheme based on the Weil Pairing. This algorithm has also been standardised in IEEE P1363.3 . I know that this algorithm can also be implemented ...
2
votes
0answers
34 views

Some confusions about Repeated Doubling Algorithm?

The following repeated point doubling algorithm is taken from the book Guide to Elliptic Curve Cryptography by D. Hankerson, A. Menezes, and S. Vanstone on page#93. Clearly, this algorithm is ...
2
votes
1answer
80 views

Construction of division polynomials

I'm trying to understand the construction of the division polynomials used in Schoof's algorithm. I firstly followed this report of Charlap and Robbins. I stuck with the definition of the leading ...
2
votes
0answers
46 views

Example of Projective Coordinates

Given the affine form of coordinates $(x,y)$ such as $(5,3)$, if I want to convert $(5,3)$ to projective coordinates $(x,y,z)$, should the form of point be $(5,3,1)$? It is triplet not a point, right? ...
2
votes
0answers
113 views

Convert projective to affine coordinates in ECC? [closed]

I am working with my project. I use projective coordinates but when I convert to affine coordinates, I can't get it. Can anyone help me? Projective Coordinates $(X,Y,Z)$ to Affine Coordinates $(X,Y)$:...
2
votes
0answers
81 views

Can we break ECDLP with this machine?

Let $P$ and $Q$ are two points of NIST elliptic curve $E$ (defined over $F_{2^m}$ with prime $m$) and $k$ is a private key such that $k.P=Q$. Also we have a machine that is able to leak some ...
2
votes
0answers
61 views

Convert messages to elliptic curve points [duplicate]

Let $E$ be an elliptic curve; $\alpha,\beta$ two points of $E$; and $a$ a private key such that $\beta=a\cdot\alpha$. We choose random integer $k$ and plain text $x\in E$. Encryption and decryption ...
2
votes
0answers
68 views

How to compute projective cordinate Z in elliptic curve cryptography?

I was working on affine coordinates and struggling with the computation time taken for operations and then I was advised to use projective coordinates so that mul-inverse operation can be avoided Can ...
2
votes
0answers
66 views

EdDSA Verification vs. Cofactorless Verification

In the EdDSA for more curve paper the authors defines: Keys An EdDSA secret key is a $b$-bit string $k$. The hash $H(k) = (h_0, h_1, ... , h_{2b−1})$ determines an integer $s = 2^n+\sum_{c≤i<n}...
2
votes
0answers
56 views

Using a product of a series of curve25519 scalars as a private key

There are a few systems like the GNU Name System and the Sphinx mixnet packet format that employ a series of curve25519 scalars all multiplied together as a private key. Are there any caveats to ...
2
votes
0answers
50 views

Construct points with the same discrete logarithm

Assume we have an elliptic curve $E$ with a Tate (or Ate,...) pairing $G_1 \times G_2 \mapsto G_T$ Now the task is to find $g_1, g_1' \in G_1$ and $g_2, g_2' \in G_2$ such that the discrete logarithm $...
2
votes
0answers
45 views

Testing PRNG quality from ECC public keys?

Having a large set of ECC public keys $P_i = n_iB$ on a fixed curve $E$ over a prime field, is there a way to determine if coefficients $n_i$ were generated using a bad PRNG? In other words, can a ...
2
votes
0answers
72 views

Differential addition on Montgomery curve

Point multiplication using Montgomery ladder technique over Montgomery curves only require x coordinate, which in many situation leads to faster implementation as compared to point multiplication over ...
2
votes
1answer
149 views

Ring signatures in ECC

Are ring signatures possible with elliptic curves? If so how. The original paper by Rivest, Shamir, Tauman seems to require an invertible trapdoor function. But I've only seen algorithms for secret ...
2
votes
2answers
419 views

Elliptic Curve Cryptography Encryption and text representation implementation

I'm writing a coursework and right now I've implemented the ECDSA algorithm, but I also need to encrypt and decrypt small text files (.txt) using elliptic curve cryptography. The problem is that I do ...
2
votes
0answers
111 views

RSA_DH vs ECDH implementation

In ECDH protocol is possible, naturally, to use the same algorithm for calculate a secret key for both communication parties (Alice and Bob for example). It is possible to design also a same algorithm ...
2
votes
0answers
54 views

Generating interactive, secure multiple ECC key pairs deterministically

In Elliptic Curve Cryptography (ECC) assuming user A has a private public key pair of $S$, $P$ accordingly with generator point $G$ which as we know is: $$P=S*G$$ Assuming that user A wants to ...
2
votes
1answer
204 views

Polynomial division hardware implementation

I am beginning the implementation of the polynomial binary division algorithm now as I understood i will be checking the MSB bit if 1 to XOR and shift the sum if 0 i will only shift. What I am not ...
2
votes
0answers
193 views

Choosing an optimal generator for an irreducible polynomial over a binary field?

I am reading the Certicom tutorial “An Example of an Elliptic Curve Group over F2m ” and I have following questions: How do they assume that generator $g = (0010)$ is correct for this polynomial? ...
2
votes
0answers
158 views

As a cryptographer, what are the things I should care about in my implementation of pairing functions?

As a beginner in cryptography, I do not know anything about different pairing types more than their names. So far, I know these names: Ate pairing, tate pairing, eta pairing, and r-ate pairing. I am ...
2
votes
0answers
63 views

ECIES: Purpose of optional shared information?

According to Wikipedia the ECIES algorithm has two optional shared information $S_1$ and $S_2$. They are used as follows: Generate a random shared secret $Z$ according to ECIES, which will never be ...
2
votes
0answers
155 views

Hardware Implementation of Pairing over BN curves

I am in the middle of FPGA based Hardware architecture design for the computation of Pairing (particularly R-ate Pairing) over BN curves. Where, the point addition, and point doubling should be ...
2
votes
0answers
369 views

Elliptic Curve based blind signature implementation

I want to use Elliptic Curve based blind signature scheme for my research. There is no proper implementation of ECC-based blind signatures. Can someone describe to me which things I need to follow ...
2
votes
0answers
95 views

Reliability of a single-pass deniable authentication protocol?

I look for one-pass deniable authentication protocol with a short message payload for my project and find a solution: ...
2
votes
0answers
229 views

Defending hybrid encryption schemes against padding oracle attacks

I intend to use a generic integrated/hybrid encryption scheme for transmitting information between a client and a server. Key encapsulation: a 128-bit symmetric key is generated and asymmetrically ...
2
votes
0answers
279 views

Weil pairing implementation - low level programming language

I'm just started to studying elliptic curve cryptosystems. My one month-goal is to write a simple signature system based on the Weil-pairing. Some parts of it can be written without deeper ...
2
votes
0answers
136 views

Gallant-Lambert-Vanstone method

I am experimenting with the GLV method but cannot manage to get the right results according to the literature. I managed to find lambda, beta, split $K$ into $k_1$ and $k_2$ etc. for the curve I'm ...
2
votes
0answers
210 views

Known vulnerabilities in (EC-)KCDSA

Does anybody know if there's known vulnerabilities in KCDSA/EC-KCDSA? I have been researching for the past few hours and I haven't found anything. Wikipedia has very limited amount of information and ...
2
votes
0answers
169 views

Complex Numbers on Elliptic Curves & Usage in Tate Pairing

I'm working with understanding the internals of the Tate Pairing. I was going through an example of the curve $E: y^2 = x^3 + 3x$ over $\mathbb{F_{11}}$. The author is showing the computation of $e(P,...
2
votes
0answers
379 views

Diffie hellman key exchange on elliptic curve over an extension field [closed]

I am attempting to do a final semester project where I implement Diffie-Hellman key exchange on an elliptic curve over an extension field (2^256). Can anybody help me to generate the extension field ...
2
votes
1answer
115 views

Can j-invariants be used to decide which elliptic curves are suiteable for cryptography?

The j-invariants classify the elliptic curves up to isomorphisms (if we suppose to work in the algebraic closure). Is this classification used in some way to decide whether or not an elliptic curve ...
1
vote
2answers
89 views

Is the Discrete logarithm problem suitable for this pairing scheme?

Let $Ans$ be the product of two pairings : $e(g,h)^{k} \times e(g,h)^{r}=Ans$ If everybody knows only $[g,h,e(g,h)^{k}]$ but $[r,Ans]$ is not known. In the discrete logarithm problem, the user knows ...
1
vote
1answer
715 views

Trying to understand the use of ECC in TLS certificates

I was looking the certificate of this website: https://www.cloudflare.com that has an ECC based certification. I'm just curious to know if is possible to understand which elliptic curve is used and ...
1
vote
2answers
135 views

Severity of Cooking NIST P Curve Constants

Bruce Schneier and Gregory Maxwell have both stated that they believe the constants chosen for NIST's P curves (i.e. P-256r) are cooked. DJB has put together a detailed list of red flags but, outside ...
1
vote
1answer
100 views

Does a cofactor of an elliptic curve have to be an integer?

What are the implications of a curve having a non-integer co-factor for its generator point? Is that even possible?
1
vote
3answers
246 views

Which area of Maths should I pursue?

I would like to know which area of Mathematics would be most beneficial to cryptography. Surely Algebraic Number Theory and maybe to a lesser extend, Elliptic Curves, are closely linked to ...
1
vote
1answer
69 views

Is brainpoolP512r1 safe?

I'm using brainpoolP512r1 elliptic curve for DSA and DH in my application. Recently I've found out on this website that brainpoolP256t1 and brainpoolP384t1 aren't secure. Unfortunately my curve wasn't ...
1
vote
2answers
163 views

PQ Key Exchange based on Elliptic Curve Isogenies

I was reading the Wikipedia article on Post Quantum Cryptography and was interested in opinions as to whether the Supersingular Elliptic Curve Isogeny Diffie-Hellman listed there would be a good Post ...
1
vote
1answer
210 views

Simplified Example of ECC to use in the classroom

I have come up with the following rudimentary example of how ECC relates to asymmetric keys. Is this a valid explanation of ECC and its relationship to asymmetry? To only be deciphered by the person ...
1
vote
1answer
493 views

Elliptical curve cryptography key generation time

I am currently trying to learn more about Elliptical curve crypthography and have finally started to get things working and undestanding the different pieces. I've written a small project in C# and ...
1
vote
2answers
213 views

Is there a problem with this non-ECDSA message signing?

Is there a problem with signing a message like this? ...
1
vote
1answer
58 views

What happens if you multiply a point with its order on complete Edwards curves?

I was recently working with some ECC crypto and stumbled across the following phrase on the SafeCurves page: The rational points of a complete Edwards curve are the pairs (x,y) of elements of ...