Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also ...

learn more… | top users | synonyms (1)

0
votes
1answer
42 views

Point addition in NaCl/libsodium (Curve25519)

In NaCl and libsodium, the crypto_scalarmult function implements the operation $Q = kP$ (scalar/point multiplication). There doesn't seem to be a function for point ...
3
votes
0answers
30 views

Attacks on elliptic-curve based cryptosystems through solving the Decisional Diffie-Hellman Problem with the Weil Pairing

Are there any examples of practical attacks on cryptosystems set over elliptic curves which utilize the easiness of DDH for certain choices of curves $E(\textbf{F}_q)$, and as such their lack of ...
3
votes
1answer
121 views

How to generate own secure elliptic curves?

I know that the algorithm used to generate the Brainpool curves and the NIST curves is published. The algorithm should be this one (RFC5639 Appendix A). From what it looks like it's rather slow to ...
2
votes
1answer
41 views

Favor hash size or field size when systems are disparate?

I'm working on an implementation of Krawczyk's Hashed MQV (HMQV). I'm using Crypto++, which is a C++ library. C++ has some features where classes that represent the crypto objects can be combined ...
9
votes
2answers
655 views

Why Elliptic Curves?

What is the benefit of using elliptic curves over the standard finite field, when the cyclic subgroup we consider of the EC's solution group is just isomorphic to some integer residue class of prime ...
4
votes
1answer
85 views

Deterministic ECDSA signatures?

ECDSA signatures depend on parameter k that is chosen by the signer. As a result, there are many signatures for the same private key d and message m. What I want to achieve is a deterministic ...
2
votes
1answer
81 views

EC: Why does $h>200$ need to hold?

The class number of the principal order belonging to the endomorphism ring of E SHOULD be at least 200. From TR-03111 (pdf page 15). This value commonly is referred to as $h$. So my ...
5
votes
1answer
69 views

How to derive the curve Ed25519 from Curve25519?

According to the paper "Faster addition and doubling on elliptic curves" by Bernstein and Lange, the Montgomery curve (Curve25519) $$v^{2}=u^{3}+486662\cdot u^{2}+u$$ is birationally equivalent to the ...
4
votes
0answers
39 views

Elligator-2 against curves over Fq, q mod 4 = 3

It appears that the conditions for applicability of Elligator-2 against many of the SaveCurves curves, where $q \mod 4 = 3$ will inevitably poke a hole in the bit-string set over $(0, 1, .. (q-1)/2)$. ...
2
votes
1answer
54 views

Parameter choice Supersingular Isogeny DH

In “Towards quantum-resistant cryptosystems from supersingular elliptic curve isogenies” by DeFeo, Jao and Plut (PDF), the public parameters are defined as: Supersingular curve $E$, and bases $P, Q$ ...
0
votes
2answers
50 views

How to compute two EC point multiplication?

I would like to know how to compute multiplication of two valid EC points over a curve E with generator G. i.e. Given only P and Q points then how to compute R = P * Q where $P = p G$, $Q = q G$ and ...
1
vote
0answers
27 views

Differential addition on Montgomery curve

Point multiplication using Montgomery ladder technique over Montgomery curves only require x coordinate, which in many situation leads to faster implementation as compared to point multiplication over ...
3
votes
1answer
102 views

Does exponentiation by squaring work on Montgomery curves?

Consider the point multiplication $Q=[d]P$, where $P$ a point on elliptic curve multiplied with an integer $d$ to get another point $Q$ on the same curve. This operation can be computed by a ...
2
votes
1answer
178 views

Which is better ECDHE with TLS 1.0

I have a webserver which only supports TLS 1.0 and I am not sure about something: Which is the better cipher in this group when aiming for the best security? ...
13
votes
1answer
792 views

Mapping points between elliptic curves and the integers

My primary question is: Is there an easy way to create a bijective mapping from points on an elliptic curve E (over a finite field) to the integers (desirably to $\mathbb{Z}^*_q$ where $q$ is the ...
3
votes
1answer
50 views

Why recently Edward curve formulas being developed that deviates from unification?

Edward curves were considered initially because it provides a unified formula for both doubling and addition, thus having inherent side-channel resistance. But a lot of work has been done recently ...
5
votes
1answer
143 views

Difference between “ECDH with cofactor key” and “ECDH without cofactor key”?

I need to use “ECDH with a cofactor key” for generating symmetric key. I have a fair idea on how ECDH works, but I don’t understand the cofactor part. What is the difference between ”ECDH with a ...
2
votes
1answer
76 views

Key exchange using ECDH vs ECIES

I'm a beginner to ECC crypto programming. Does any one explain to me the difference with using ECDH for shared key exchange and use of ECIES by encrypting shared key with the public key of the ...
9
votes
1answer
2k views

What are the advantages of a static ECDH key?

What are the advantages of using "static-ephemeral ECDH" over "ephemeral-ephemeral ECDH"?
0
votes
1answer
60 views

Why we need ECDSA when we have ECDH?

ECDSA and ECDH give us the following methods: ...
2
votes
1answer
365 views

openSSL ECDH private key size

When you are using a named curve like P-256 in openSSL, is there any standard key size for ECDH private key keys? If you look at the ec_key.c file in the openSSL ...
1
vote
1answer
31 views

Can I use an ECDH Shared Secret from the same Private / Public Key Pair?

I'd like to know if using the ECDH shared secret of a static EC Private Key with it's own corresponding static EC Public Key causes a problem / weakness. (edit) not asking if it's ok to re-use the ...
1
vote
0answers
42 views

RSA_DH vs ECDH implementation

In ECDH protocol is possible, naturally, to use the same algorithm for calculate a secret key for both communication parties (Alice and Bob for example). It is possible to design also a same algorithm ...
2
votes
2answers
212 views

ECDH anonymous key exchange to avoid PKI

I want to use TLS to encrypt the communication between peers in a P2P network. Each peer has a well known 256bit peer identifier (the public key of a 256bit elliptic curve keypair). Both peers need ...
4
votes
1answer
330 views

EC ElGamal versus static+ephemeral ECDH

A client application needs to encrypt a UDP datagram for a server with known EC public key $P$. Performing a full ECDH key exchange would defeat the benefit of using UDP as a connectionless protocol. ...
1
vote
2answers
454 views

Reuse of a DH / ECDH public key

I was wondering whether it is safe to use the same DH or ECDH key pair in more than one key agreement, particularly if these public keys are in a public registry. These public keys could be used by ...
10
votes
1answer
4k views

ECDSA vs ECIES vs ECDH

Recently I started studying Elliptic Curve Cryptography and I just loved it. I want to transfer some big data (like 3KB), What is the best method, ECDSA, ECIES, or ECDH (and why)? I am confused, how ...
0
votes
0answers
31 views

Clarify EC point addition and multiplication

Please clarify the below doubt regarding EC point addition and multiplication: $P$-Generator Point; $a$ and $b$ are integers; $X$ and $Y$ are EC points, defined as follows: $X = (a*P) + (b*P)$ $Y = ...
7
votes
1answer
82 views

How many bits of entropy does an elliptic curve key of length n provide?

A FAQ for an open source project makes the claim: Indeed, an elliptic curve key of length n provides $n/2$ bits of security. I have two questions: What is the practical difference between ...
0
votes
0answers
79 views

Is this a secure method of encrypting with authentication?

My goal is to allow two clients to send files securely over an untrusted network without the need for more than one block of information to be sent. Both clients have ECDSA keys of size 256 bits. I'd ...
0
votes
1answer
38 views

Question on Miller's algorithm (change the input m)

From the book titled " An Introduction to Mathematical Cryptography" (Chapter 5,page 322), we know that the miller's algorithm returns a function $f_P$ whose divisor satisfies $$div(f_P) ...
4
votes
1answer
605 views

Understanding elliptic curve encryption

I'm having a hard time understanding the elliptic curve encryption. One thing thing I don't understand is listing all the points on the curve mod p. Suppose I have the following elliptic curve: $y^2 = ...
1
vote
1answer
67 views

Ring signatures in ECC

Are ring signatures possible with elliptic curves? If so how. The original paper by Rivest, Shamir, Tauman seems to require an invertible trapdoor function. But I've only seen algorithms for secret ...
4
votes
1answer
112 views

EdDSA Signature Algorithm - hash of secret key

Why does EdDSA use the (SHA512) hash of the secret key as the exponent for the public key rather than using the secret key value directly? This seems inefficient and I can't see how it adds any extra ...
2
votes
0answers
74 views

What happens if no final subtraction is done in Montgomery multiplication?

I'm doing Montgomery arithmetic modulo $N = 2^{255}-19$ for the Curve25519, picking $R = 2^{256}$ for Montgomery. After multiplying two numbers $0 <= A,B < N$ in the Montgomery representation ...
2
votes
1answer
76 views

Doubling a point on an elliptic curve

I'm working with the elliptic curve $\mathcal{E} : y^2 = x^3 + 11x^2 + 17x + 25$ over $(\mathbb{Z}_{31},+,\cdot)$ and am trying to double $P=[2,7]$. Following the instructions here, I'm doing the ...
2
votes
1answer
188 views

ECC - ElGamal with Montgomery or Edwards type curves (curve25519, ed25519) - possible?

I know the usual way of using getting shared secrets for encryption with ECC is DH, however, this only works with two keypairs of exactly the same kind, for example two curve25519- or two ...
1
vote
1answer
254 views

Use curve25519 for ElGamal crypto [duplicate]

DJB described curve25519 in his paper which can be found here (PDF). It seems that the main purpose was for Diffie-Hellman key exchange. I think this means that Discrete Log is supposed to be hard on ...
2
votes
1answer
313 views

inverse problem about scalar multiplication on elliptic curve

Let $E$ be an elliptic curve over a finite field $F_p$. Given $n$ be a positive integer and $Q$ be a point on $E$, assume that $Q=nP$, how can we find this $P$? We can assume that $n|p-1$. If $n$ is ...
2
votes
1answer
202 views

Is this ECC encryption key sharing method okay?

Is this encryption key sharing okay to use? Or is much better to use ECIES? $G$ = base point $a$ = Alice’s private key $b$ = Bob’s private key $A = aG$ = Alice’s public key $B = bG$ = Bob’s public ...
9
votes
3answers
797 views

Elliptic Curves of different forms

Looking at http://safecurves.cr.yp.to/ to find a safe curve, I find that most curves described here are of a different form from that generally used. In Bouncy Castle, for example, ...
1
vote
3answers
211 views

Point decompression on an elliptic curve

I'm programming an elliptic curve cryptosystem and I'm having difficulty with decompressing points. The following information is from my project specification as to my understanding: Given a point ...
2
votes
1answer
191 views

ECC vs RSA: how to compare key sizes?

I know and I have understood the details of RSA, elliptic curve cryptography, (EC)DH and (EC)DSA. I keep reading everywhere that (if we don't consider non-deterministic computers) "ECC can achieve ...
0
votes
1answer
51 views

What is more efficient, pairing based cryptography or non pairing based cryptography? [closed]

As far as I know non pairing pairing based cryptography is less time consuming than pairing based because, pairing based uses complex operations. Are there any advantages of pairing based cryptography ...
2
votes
1answer
102 views

Double-and-add/Montgomery VS blinding

I'm having a hard time understanding why people use constant-time techniques to counter time-attacks, when blinding seems as good and cheaper to implement. Why do people avoid blinding in ECC?
2
votes
1answer
65 views

Inversion Free Direct Conversion between Twisted Edwards (X,Y,Z) and Montgomery (X,Z)

The Wikipedia page for Montgomery curves shows how to convert points on a twisted Edwards curve to and from points on an equivalent Montgomery curve. However, their description and the original ...
4
votes
1answer
421 views

Blockwise Montgomery multiplication

I have to implement a 256*256 bit Montgomery multiplier for pairing computations. The straightforward approach is to use a bit-serial version, but I would like to utilize the built-in 64*64 bits ...
1
vote
1answer
130 views

Simplified Example of ECC to use in the classroom

I have come up with the following rudimentary example of how ECC relates to asymmetric keys. Is this a valid explanation of ECC and its relationship to asymmetry? To only be deciphered by the person ...
2
votes
2answers
233 views

Why are there only positive value points on an elliptic curve?

I read about elliptic curve cryptography $E$ over $Z_p$ where $p$ is prime number and $G$ is a base point on the curve. I noticed the points resulting from multiplication e.g. $2G$,$3G$,.....,$(N-1)G$ ...
0
votes
0answers
43 views

How to show the inner workings of ECC?

I will be giving a short (10-15 min) presentation on the fundamentals of elliptic curve cryptography, and I would like some suggestions on how to show the basic workings of asymmetric key exchange on ...