Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also ...

learn more… | top users | synonyms (2)

1
vote
2answers
13 views

Why can an elliptic curve private key be 1?

I often see in papers (e.g. this one) that for an elliptic curve with generator point $G$ and order $n$ the private key $d$ can take on any integer value in the range $[1, n)$. When $d = 1$ the ...
1
vote
1answer
46 views

How to convert roots of Weber polynomial to Hilbert class polynomial over modulo prime?

Using any non square root discriminant $D$, we should be able to find the Weber class polynomial. How can I convert the roots of a Weber polynomial to a Hilbert class polynomial over modulo prime?
8
votes
1answer
263 views

Is the Representation Problem hard on elliptic curves?

The RP in ECC would be to find $a_1,\ldots,a_n$ (integers) given $P$ and $Q_1,\ldots,Q_n$ (points in the EC) such that $P = a_1 \cdot Q_1 + \ldots + a_n \cdot Q_n$. Is it hard when DH-like ...
3
votes
2answers
250 views

Which elliptic curves are quantum resistant? [on hold]

If I want to learn about quantum resistant crytography what are the best resources? Which type of elliptic curves should I be studying?
0
votes
1answer
31 views

Creating ECDH using OpenSSL

For academic reasons, I'm playing around with OpennSSL 1.0.2g. I tested RSA encryption/decryption. I created key exchange with DHKE. But I'm struggling to find a way, to create ECDH, using only ...
5
votes
2answers
199 views

Finding the subgroup in isogeny-based cryptography

Isogeny-based cryptography is one of the newest post-quantum cryptography. Hardness of this system is based on finding isogeny between two elliptic curves. Also this is theorem: Elliptic curves ...
1
vote
1answer
23 views

Single-scalar multiplication with sign bit

I want to know if there's an "easy" timing-free way to compute the sign of $y$-coordinate of $r G$, for a secret scalar $r$ and $G$ the generator of an elliptic curve. We have several choices for ...
0
votes
2answers
48 views

Need help choosing algorithm and topic [closed]

I am not pretty sure if this is the right place, but I have searched a lot and still cannot decide what to do. So here is why I am typing here - I am studying last year computer science and therefore ...
1
vote
1answer
70 views

Quantum vs. regular computing time to break ECC?

How long exactly would it take for a regular computer to crack an elliptic curve public/private key via bruteforce, vs. a quantum computer using Shor's algorithm with a couple thousand qubits? Can ...
0
votes
1answer
36 views

What is proper size of window Using RSA Window method?

I want to Use Window method for RSA modular Exponentiation. because of SCA. But I don`t know what is proper window size.
0
votes
1answer
20 views

Is a KDF needed when using X25519 for ECDH and XChaCha20-Poly1305 for AEAD?

Is a KDF needed when using X25519 for ECDH and XChaCha20-Poly1305 or XSalsa20-Poly1305 for authenticated encryption? My hypothesis is "no" because the key from X25519 is less than 256 bits long; ...
2
votes
1answer
55 views

Multiplying integers modulo $2^{255}-19$ using the Curve25519 polynomial reduction algorithm

I'm reading the Curve25519 paper and I see that in page 11, under the title "Multiplying integers modulo $2^{255}-19$", it says: The coefficients of $x^{10}$; $x^{11}$; ...; $x^{18}$ in $uv$ are ...
3
votes
2answers
575 views

Creating serial key generator using ECDSA, how to get signature short enough?

I've written some questions in this stackoverflow and got great responses but now I'm trying to wrap it all together. I have for the last couple of weeks been building a serial key generator project ...
0
votes
0answers
30 views

Has anybody implemented BGN cryptosystem to multiply two plain texts?

I have tried to use this code as follows, http://stackoverflow.com/questions/33581962/bgn-implementation-in-java but the issue is, when it generate the pairing, the output is in GTfiniteelement (for ...
-2
votes
1answer
21 views

How to find HEXA value of String [closed]

This may be very easy thing, but i am just unable to understand this. I have a string "Hi", and in HEXA its written like this ...
5
votes
1answer
157 views

How many qubits are required to break RSA 2048 or 4096 with a universal quantum computer?

So in the news this week, IBM have created a universal quantum computer with 5 fully functional qubits. Logic and Moore's law dictates they will be able to scale this up to a lot more qubits within a ...
0
votes
1answer
63 views

Comparison Affine Coordinates and Projective Coordinates Addition in Excel

Kurve : EC : $y^2=x^3 + x + 1$ Generator:$(1,7)$ $p=23$ Result in Affine use Excel: $P=(1,7)$, $Q=(7,11) \implies P+Q=(18,20)$ Result in Projective use Excel: $P=(1:7:1), Q=(7:11:1) \implies ...
3
votes
1answer
69 views

ECFP harder than ECDLP ?

Given two points $P$ and $Q = \sum_{i=1}^{n} x_i.P$ over $E_p(a, b)$ for $x_1,x_2,...,x_n \in \mathbb F_p$. The Elliptic Curve Factorization Problem (ECFP) is to find the points ...
0
votes
0answers
39 views

Weil Pairing - Miller's Algorithm

I'm trying to implement Weil Pairing using Miller's algorithm. I have got couple of questions. How to select $m$? As stated in this link page 13, I interated from $1$ to order of point $P$ such that ...
6
votes
1answer
89 views

Is every point on an elliptic curve of a prime order group a generator?

If the order of elliptic group is prime then every point is a generator of that group. I tested the above statement on some elliptic curves and found it true. Does that really work on all curves? Is ...
0
votes
2answers
53 views
4
votes
2answers
107 views

If we should not reuse primes in DH, shouldn't we not reuse ECDH elliptic curve properties?

An article How is NSA breaking so much crypto? describes NSA's methods for breaking encryption. If a client and server are speaking Diffie-Hellman, they first need to agree on a large prime number ...
3
votes
0answers
104 views

What happens if no final subtraction is done in Montgomery multiplication?

I'm doing Montgomery arithmetic modulo $N = 2^{255}-19$ for the Curve25519, picking $R = 2^{256}$ for Montgomery. After multiplying two numbers $0 \leq A,B < N$ in the Montgomery representation ...
4
votes
1answer
99 views

Backdoor in NIST elliptic curves

Let $E$ be an elliptic curve defined over a finite field $F_q$ with prime order $n$ and $P,Q \in E$ and $k$ be private key such that $kP=Q$. Since $n$ is prime, $E$ is isomorphic to $Z_n$. Suppose ...
1
vote
0answers
49 views

What is th purpose of m and q in elliptic curve cryptography protocols?

In crypto protocols that contains calculus on elliptic curves I can often see $\dfrac{m}{q}$$Q$ where $m$ stands for order of EC points group and $q$ is the order of corresponding subgroup of $m$. $Q ...
2
votes
1answer
238 views

Simple digital signature example that one could compute without a computer?

I am working on a document to explain Bitcoin to students. But I am having a hard time translating the principle described in §2 of the Bitcoin whitepaper in layman's terms. There is a great question ...
1
vote
0answers
28 views

Some confusions about Repeated Doubling Algorithm?

The following repeated point doubling algorithm is taken from the book Guide to Elliptic Curve Cryptography by D. Hankerson, A. Menezes, and S. Vanstone on page#93. Clearly, this algorithm is ...
-1
votes
1answer
49 views

Could someone explain the given algorithm?

The following snapshot of the algorithm is taken from the book Guide to Elliptic Curve Cryptography published by Springer 2004. I don't understand that why at the statement 9.1 if both $T_1$ and ...
5
votes
2answers
898 views

Understanding elliptic curve encryption [closed]

I'm having a hard time understanding the elliptic curve encryption. One thing thing I don't understand is listing all the points on the curve mod p. Suppose I have the following elliptic curve: $y^2 = ...
0
votes
0answers
56 views

Smart Card choice for PKI implementation

I'm seeking to implement a national digital signature standard on a smart card. I feel like this is a good place to ask if anybody is acquainted with a hardware supplier offering smart cards that ...
3
votes
0answers
37 views

EC Schnorr signature: multiple standard?

I 'm working on some EC-Schnorr signature code. Reading various papers on that, it's seems EC-Schnorr is not standardized as well as ECDSA. For example, I found two main differences in two main ...
1
vote
1answer
39 views

Attacks on schemes based on elliptic curves when the transmitted points are not on the curve

Some elliptic curve schemes require to send a curve point during the normal execution of the protocol. For example, ElGamal encryption and ElGamal signature require this. On the other hand, ECDSA does ...
6
votes
2answers
94 views

Is there a theorem to determine the elliptic curve parameters based on the group order?

By Hasse's theorem we know that range of the group order of the elliptic curve. And similarly, there exist a theorem on the admissible order of elliptic curves. Suppose by the theorem on the ...
0
votes
1answer
28 views

Is it possible for the Rho method against an Elliptic Curve to take more than the sqrt of the total state space?

Is it possible for the Rho method against an Elliptic Curve to take more than the sqrt of the total state space? It the reason why this is not generally done because of a meet-in-the-middle attack?
0
votes
2answers
54 views

Stripping off message authentication or signature

If attackers can strip off RSA / EC / -DSA digital signature and conduct CCA on AES-CTR or CBC payload, why can't they do the same for AES-GCM?
0
votes
2answers
75 views

What is necessary for generating an elliptic curve?

Let's say I want to generate my own elliptic curve with an order whose bit length is $n$ (specifically 2048, 4096, and/or 8192)? How would I do this? What needs to be done? What software can do this? ...
1
vote
1answer
53 views

Does OpenSSL apply ASN1 encoding to the hash before signing using ECDSA?

I read on stack overflow that OpenSSL performs ASN1 encoding to the hash before signing it for, for ECDSA. In other words, OpenSSL performs the following steps when for an Elliptic curve key ...
5
votes
0answers
56 views

Software timing attack using Kocher method

What's the minimum number of random sample points needed in Kocher's timing attack, so that we can determine enough valid measurements of $A_{i,r}$ and $D_{i,r}$? I'm working from this paper: Volker ...
0
votes
0answers
36 views

How common are non-RSA digital certificates?

Is there a statistic available that shows just how common are DSA or ECC certificates amongst webservers? I know that RSA-based certificates are the most common, however I'd like to know, if there is ...
3
votes
0answers
33 views

Is an instruction similar to PCLMULQDQ valuable in post quantum key exchange?

This paper describes a Quantum Key Exchange based on the Ring Learning With Errors problem. When used with ECC, there is only a slight performance impact. Assuming this is the popularized approach ...
0
votes
2answers
76 views

Is the Discrete logarithm problem suitable for this pairing scheme?

Let $Ans$ be the product of two pairings : $e(g,h)^{k} \times e(g,h)^{r}=Ans$ If everybody knows only $[g,h,e(g,h)^{k}]$ but $[r,Ans]$ is not known. In the discrete logarithm problem, the user knows ...
3
votes
1answer
27 views

Reuse of TLS client key/certificate in challenge-response protocol

The situation: We have a custom PKI with clients communicating with the server over standard SSL/TLS encrypted channel. PKI uses ECC, server certificate supports ECDHE_ECDSA key exchange mechanism and ...
39
votes
5answers
15k views

Who uses Dual_EC_DRBG?

Recent news articles have suggested that the NSA may be involved in trying to influence the cryptography in public standards or commercially deployed software, to enable the NSA to decrypt the ...
18
votes
1answer
6k views

ECDSA vs ECIES vs ECDH

Recently I started studying Elliptic Curve Cryptography and I just loved it. I want to transfer some big data (like 3KB), What is the best method, ECDSA, ECIES, or ECDH (and why)? I am confused, how ...
-1
votes
2answers
54 views

elliptic curve point doubling in Jacobian coordinates

I am writing an application that uses Elliptic curve Diffie–Hellman for authentication. I found two formulas for point doubling in Jacobian coordinates. 1st) \begin{equation} X_1 = (3x^2 + aZ^4)^2 ...
0
votes
1answer
50 views

Proper forward secrecy [closed]

Currently I have a protocol using a simple RSA to AES handshake. I have been reading more and more and would like to implement proper forward secrecy, but at the same time I'd like to improve the ...
2
votes
0answers
106 views

RSA_DH vs ECDH implementation

In ECDH protocol is possible, naturally, to use the same algorithm for calculate a secret key for both communication parties (Alice and Bob for example). It is possible to design also a same algorithm ...
5
votes
1answer
119 views

Which attacks are possible against raw/textbook elliptic curve?

A quick question, we know that raw RSA is a no go. To solve this we have different PKCS standards forcing structure on the input messages. For EC the story is something else. For signatures we have ...
2
votes
1answer
89 views

Is there an asymmetric algorithm that can perform double encryption?

I'm looking for any asymmetric algorithm can perform the serial encryption, by serial I mean double or more encryption with different key(same key size). RSA can not do it since the cipher of the ...
4
votes
2answers
315 views

Using Lattice-based cryptography for TLS\SSL

Given the general benefits of Lattice-based cryptography, such as: Post quantum Security Security from worst case scenario Efficiency What could the outlook of shifting from RSA \ ECC-based ...