Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also ...

learn more… | top users | synonyms (2)

3
votes
1answer
272 views

Simple digital signature example that one could compute without a computer?

I am working on a document to explain Bitcoin to students. But I am having a hard time translating the principle described in §2 of the Bitcoin whitepaper in layman's terms. There is a great question ...
0
votes
1answer
51 views

What is proper size of window Using RSA Window method?

I want to Use Window method for RSA modular Exponentiation. because of SCA. But I don`t know what is proper window size.
1
vote
0answers
26 views

Feasible attacks on ECRSA cryptosystem

In ECRSA cryptosystem, I want to know the feasible attacks. For illustrations we have two prime $p$ and $q$ such that $p \equiv 2 \pmod 3$, $q \equiv 2 \pmod 3$ and generate key pair as follows: $$n = ...
0
votes
0answers
17 views

elliptic curve and embedding degree

I am new in ECC. I am confused what the embedding degree in elliptic curve represents and what is the impact of its values on the curve and security ( small values or large values? What does the ...
0
votes
0answers
38 views

Found weil pairing. Index Calculus method on the results of weil pairing

Consider Elliptic curve with p = 59, A = 1, B= 0, P = (25,30) and Q=(35,31). So I tried to solve this using MOV attack. The torsion point for them E[5] is R(-25,30i) where is sqroot -1 Chosen two ...
0
votes
0answers
52 views

Why is RSA still being used? [duplicate]

In hybrid encrytion, I still see that some site's use RSA in their https connection, so now I wonder, why do they not use ECC instead of RSA, ECC requires less computational power and encrypt's and ...
3
votes
1answer
78 views

tripartite diffie hellman with Weil pairing

I try to understand how the tripartite Diffie-Hellman key exchange works. I read Joux's paper for this: https://www.semanticscholar.org/paper/A-One-Round-Protocol-for-Tripartite-Diffie-Hellman-Joux/...
2
votes
1answer
121 views

How does DH work when combined with ECC or RSA?

I know that Diffie-Hellman is used to create keys in a secure way over an insecure channel. But there is one thing which I cannot understand: I see that a lot of sites use ECC or RSA alongside DH. ...
2
votes
1answer
119 views

Quantum vs. regular computing time to break ECC?

How long exactly would it take for a regular computer to crack an elliptic curve public/private key via bruteforce, vs. a quantum computer using Shor's algorithm with a couple thousand qubits? Can ...
3
votes
1answer
48 views

Is a hash function used to expand the key after ECC shared secret is complete?

I am trying not to solicit opinions, but I have not been able to find a reference to the question at hand. I have designed an ECC engine in silicon that handles any curve in the form of $y^2 = [ax^3 +...
-1
votes
0answers
48 views

Computational Cost : Scalar Multiplication vs exponentiation in elliptic curve

$Pub=\gamma P$ and $Pub=P^{\gamma}$ where $P \in G_{1}$ and $\gamma \in Z_{p}$ Which one has less computational cost?
3
votes
2answers
612 views

Creating serial key generator using ECDSA, how to get signature short enough?

I've written some questions in this stackoverflow and got great responses but now I'm trying to wrap it all together. I have for the last couple of weeks been building a serial key generator project ...
1
vote
0answers
33 views

How to set attributes to private key on PKCS#12 (key usage)

I make a certificate X509 with library Bouncy Castle on Java. I need set a Key Attribute to private key. ...
4
votes
2answers
90 views

Recover elliptic curve order from ECDSA signatures

I need the elliptic curve order to recover the private key from two signed messages with ECDSA. What I have: two signatures signed by the private-key I want to get the messages that have been ...
0
votes
1answer
69 views

Comparison Affine Coordinates and Projective Coordinates Addition in Excel

Kurve : EC : $y^2=x^3 + x + 1$ Generator:$(1,7)$ $p=23$ Result in Affine use Excel: $P=(1,7)$, $Q=(7,11) \implies P+Q=(18,20)$ Result in Projective use Excel: $P=(1:7:1), Q=(7:11:1) \implies P+Q=(15:...
9
votes
1answer
145 views

Attacks on elliptic-curve based cryptosystems through solving the Decisional Diffie-Hellman Problem with the Weil Pairing

Are there any examples of practical attacks on cryptosystems set over elliptic curves which utilize the easiness of DDH for certain choices of curves $E(\textbf{F}_q)$, and as such their lack of ...
2
votes
0answers
29 views

Boneh/Franklin Identity based encryption with Tate pairing

Boneh/Franklin developed an identity based encryption scheme based on the Weil Pairing. This algorithm has also been standardised in IEEE P1363.3 . I know that this algorithm can also be implemented ...
4
votes
1answer
41 views

Key derivation with Curve25519 for data encryption

I'm new when it comes to cryptography so this question might be a little bit stupid: Can I derive a key with Curve25519 from a (let's say) root key and encrypt the file with a secret key algorithm? ...
0
votes
1answer
30 views

meaning of Reduce f modulo the order of the base point G

I am trying to perform some math operations related to Elliptic curve cryptography, and came across this sentence: Reduce f modulo the order of the base point G. What does it mean?
5
votes
1answer
225 views

ECDSA key recovery - floating point values

I'm currently attempting to recover an ECDSA key. I have $m$, $m'$ and signatures $(r, s)$, $(r', s')$, and I know that $k$ is constant, the curve is NIST P-192 and the hash function of the. As such,...
0
votes
2answers
62 views
7
votes
1answer
103 views

Default algorithm for scalar multiplication of elliptic curve points by the MIRACL Library

What is the default algorithm used by the MIRACL-Library [1] for elliptic curve cryptography systems to perform scalar-point multiplication with curves of Weierstrass form satisfying the equation : $y^...
1
vote
0answers
33 views

hash function for elliptic curve co-ordinates

Is there any hash function which takes the co-ordinates of an elliptic curve $E_p(a,b)$ as input and gives an integer value i.e. $h(.) : \{(x,y) \in E_p(a,b)\} \rightarrow \mathbb{Z}$
0
votes
1answer
44 views

If I encrypt data with two different ECC Private keys, how secure is the result?

I'm wondering whether encrypting data with two different 256-bit ECC keys will result in a more secure encryption (minimum 384 bit equivalent) or will result in data that's effectively encrypted with ...
0
votes
1answer
17 views

How many field operations are needed when you compute kG in elliptic curves with a multiple additions or the double-ans-add-algorithm?

For an assignment, we have to calculate how many field computations are needed to calculate kG in an elliptic curve. They want us to show this for two different ways of calculating kG. The first way: ...
12
votes
4answers
1k views

Are any of the major asymmetric ciphers distinguishable (EG, RSA, ECC)?

Related to "Is it possible to derive the encryption method from encrypted text?". Given ciphertexts generated by any of the major asymmetric ciphers (RSA, ElGamal, ECC, etc..) can these ciphertexts ...
7
votes
1answer
223 views

Are there security issues with discrete logarithm keys not being uniformly distributed?

Generally, algorithms based on discrete logarithm specify that private keys are chosen as scalars between 1 and the order of the group (denoted $q$ here). For instance IEEE P1363 and FIPS 186-3 both ...
1
vote
1answer
67 views

Scalar Multiplication for Elliptic Curve

Let $\mathbb{E}$ be the elliptic curve $y^2 = x^3 + 6x \text{ mod } 11$ and consider the point $P = (2, 3)$ on it. How do I compute $3P$? I have been able to figure out what $2P$ is, $2P = (5,10)$. ...
11
votes
1answer
1k views

Why can an elliptic curve private key be 1?

I often see in papers (e.g. this one) that for an elliptic curve with generator point $G$ and order $n$ the private key $d$ can take on any integer value in the range $[1, n)$. When $d = 1$ the ...
2
votes
1answer
49 views

How to convert roots of Weber polynomial to Hilbert class polynomial over modulo prime?

Using any non square root discriminant $D$, we should be able to find the Weber class polynomial. How can I convert the roots of a Weber polynomial to a Hilbert class polynomial over modulo prime?
9
votes
1answer
265 views

Is the Representation Problem hard on elliptic curves?

The RP in ECC would be to find $a_1,\ldots,a_n$ (integers) given $P$ and $Q_1,\ldots,Q_n$ (points in the EC) such that $P = a_1 \cdot Q_1 + \ldots + a_n \cdot Q_n$. Is it hard when DH-like ...
3
votes
2answers
277 views

Which elliptic curves are quantum resistant? [closed]

If I want to learn about quantum resistant crytography what are the best resources? Which type of elliptic curves should I be studying?
1
vote
1answer
66 views

Creating ECDH using OpenSSL

For academic reasons, I'm playing around with OpennSSL 1.0.2g. I tested RSA encryption/decryption. I created key exchange with DHKE. But I'm struggling to find a way, to create ECDH, using only ...
6
votes
2answers
206 views

Finding the subgroup in isogeny-based cryptography

Isogeny-based cryptography is one of the newest post-quantum cryptography. Hardness of this system is based on finding isogeny between two elliptic curves. Also this is theorem: Elliptic curves ...
1
vote
1answer
25 views

Single-scalar multiplication with sign bit

I want to know if there's an "easy" timing-free way to compute the sign of $y$-coordinate of $r G$, for a secret scalar $r$ and $G$ the generator of an elliptic curve. We have several choices for ...
0
votes
1answer
29 views

Is a KDF needed when using X25519 for ECDH and XChaCha20-Poly1305 for AEAD?

Is a KDF needed when using X25519 for ECDH and XChaCha20-Poly1305 or XSalsa20-Poly1305 for authenticated encryption? My hypothesis is "no" because the key from X25519 is less than 256 bits long; ...
2
votes
1answer
63 views

Multiplying integers modulo $2^{255}-19$ using the Curve25519 polynomial reduction algorithm

I'm reading the Curve25519 paper and I see that in page 11, under the title "Multiplying integers modulo $2^{255}-19$", it says: The coefficients of $x^{10}$; $x^{11}$; ...; $x^{18}$ in $uv$ are ...
0
votes
0answers
35 views

Has anybody implemented BGN cryptosystem to multiply two plain texts?

I have tried to use this code as follows, http://stackoverflow.com/questions/33581962/bgn-implementation-in-java but the issue is, when it generate the pairing, the output is in GTfiniteelement (for ...
-2
votes
1answer
24 views

How to find HEXA value of String [closed]

This may be very easy thing, but i am just unable to understand this. I have a string "Hi", and in HEXA its written like this ...
7
votes
1answer
189 views

How many qubits are required to break RSA 2048 or 4096 with a universal quantum computer?

So in the news this week, IBM have created a universal quantum computer with 5 fully functional qubits. Logic and Moore's law dictates they will be able to scale this up to a lot more qubits within a ...
3
votes
1answer
73 views

ECFP harder than ECDLP ?

Given two points $P$ and $Q = \sum_{i=1}^{n} x_i.P$ over $E_p(a, b)$ for $x_1,x_2,...,x_n \in \mathbb F_p$. The Elliptic Curve Factorization Problem (ECFP) is to find the points $x_1.P,x_2.P,...,x_n.P$...
0
votes
0answers
47 views

Weil Pairing - Miller's Algorithm

I'm trying to implement Weil Pairing using Miller's algorithm. I have got couple of questions. How to select $m$? As stated in this link page 13, I interated from $1$ to order of point $P$ such that ...
6
votes
1answer
100 views

Is every point on an elliptic curve of a prime order group a generator?

If the order of elliptic group is prime then every point is a generator of that group. I tested the above statement on some elliptic curves and found it true. Does that really work on all curves? Is ...
4
votes
2answers
107 views

If we should not reuse primes in DH, shouldn't we not reuse ECDH elliptic curve properties?

An article How is NSA breaking so much crypto? describes NSA's methods for breaking encryption. If a client and server are speaking Diffie-Hellman, they first need to agree on a large prime number ...
3
votes
0answers
107 views

What happens if no final subtraction is done in Montgomery multiplication?

I'm doing Montgomery arithmetic modulo $N = 2^{255}-19$ for the Curve25519, picking $R = 2^{256}$ for Montgomery. After multiplying two numbers $0 \leq A,B < N$ in the Montgomery representation ...
5
votes
1answer
107 views

Backdoor in NIST elliptic curves

Let $E$ be an elliptic curve defined over a finite field $F_q$ with prime order $n$ and $P,Q \in E$ and $k$ be private key such that $kP=Q$. Since $n$ is prime, $E$ is isomorphic to $Z_n$. Suppose $\...
1
vote
0answers
51 views

What is th purpose of m and q in elliptic curve cryptography protocols?

In crypto protocols that contains calculus on elliptic curves I can often see $\dfrac{m}{q}$$Q$ where $m$ stands for order of EC points group and $q$ is the order of corresponding subgroup of $m$. $Q \...
2
votes
0answers
31 views

Some confusions about Repeated Doubling Algorithm?

The following repeated point doubling algorithm is taken from the book Guide to Elliptic Curve Cryptography by D. Hankerson, A. Menezes, and S. Vanstone on page#93. Clearly, this algorithm is ...
-1
votes
1answer
49 views

Could someone explain the given algorithm?

The following snapshot of the algorithm is taken from the book Guide to Elliptic Curve Cryptography published by Springer 2004. I don't understand that why at the statement 9.1 if both $T_1$ and $...
5
votes
2answers
924 views

Understanding elliptic curve encryption [closed]

I'm having a hard time understanding the elliptic curve encryption. One thing thing I don't understand is listing all the points on the curve mod p. Suppose I have the following elliptic curve: $y^2 = ...