Elliptic curves are a mathematical structure. In cryptography, it is common to use the structure $y^2 = x^3 + ax^2 + b$ over a finite field. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider specific tags such as discrete-logarithm and ecdsa.
37
votes
3answers
18k views
Why is elliptic curve cryptography not widely used, compared to RSA?
I recently ran across elliptic curve crypto-systems:
An Introduction to the Theory of Elliptic Curves (Brown University)
Elliptic Curve Cryptography (Wikipedia)
Performance analysis of identity ...
0
votes
1answer
56 views
Smart Card Basics
I want to implement some of the basic encryption algorithms on smart card, could any body guide me, how to program a smart card, which tools (hardware and software) i should have ,and are these tools ...
1
vote
1answer
65 views
ECC Point Multiplication of Product
I can calculate $Q = a\,b\,G$ in several ways:
$Q = a \, (b \, G)$ or $Q = b \, (a \, G)$. These give the same result, as expected.
But if I do $c = (a \, b) \bmod n$ where $a \, b$ is much greater ...
6
votes
1answer
127 views
Can somebody explain the major contributions of the tenants of the Gödel Prize 2013?
As you may know, the Gödel Prize 2013 will be awarded this year to cryptographers (see this ACM press release). The people awarded are Antoine Joux, the team of Dan Boneh and Matthew K. Franklin.
Can ...
0
votes
0answers
48 views
Complex Numbers on Elliptic Curves & Usage in Tate Pairing
I'm working with understanding the internals of the Tate Pairing. I was going through an example of the curve $E: y^2 = x^3 + 3x$ over $\mathbb{F_{11}}$. The author is showing the computation of ...
0
votes
0answers
31 views
Hardware implementation of pairing
I would like to design a hardware-based accelerator for a pairing algorithm to make it faster. I know that I need to do arithmetic over a base and an extension field.
Could anyone would suggest which ...
1
vote
0answers
75 views
What is the fastest elliptic curve operation f(P) in affine coordinates such that f^n(P)=P only if n is large?
I'm working with the affine representations of points of a Koblitz curve.
I've read many papers that show that computing some functions, like $f(P)=3P$ can be computed faster than the standard way. ...
0
votes
0answers
33 views
calculating beta for elgamal elliptic curves [duplicate]
Suppose we use elgamal elliptic curves for secure communication. Bob selects a prime $p$, an elliptic curve $E$, a point $\alpha$ on $E \pmod p$, and a secret integer $f$. Suppose that Bob has ...
3
votes
1answer
102 views
Trying to better understand the failure of the Index Calculus for ECDLP
So I'm going to give you guys my understanding and then if you would be so kind as to tell me where I'm off the mark (hopefully I'm not completely wrong).
So basically the index calculus for the ...
2
votes
1answer
51 views
How to derive formulas for addition and multiplication in Jacobian coordinates
Is there a way to derive the formulas for point addition and multiplication on elliptic curves in Jacobian format by yourself? How could I have derived these formulas by myself?
1
vote
1answer
82 views
Elliptic Curve is DH function or PKI?
can we reuse same ECC key on TLS for long terms or it must be used just once? (i mean can we use ECC like RSA?)
is there patent free ECC implementation ?
0
votes
0answers
87 views
Adding and multiplication in jacobian coordinates
How can I derive formulas for adding and multiplication of 2 points in Jacobian coordinates $(x,y) = (\frac{X}{Z^2},\frac{Y}{Z^3})$ over an elliptic curve?
2
votes
3answers
189 views
The utility of elliptic curve cryptography
Suppose that the only public key cryptography schemes that we knew were Diffie Hellman, RSA and ElGamal. How much would this set civilization back? Are there important applications of elliptic curve ...
0
votes
1answer
56 views
EC equivalent for RSA-OAEP
I have some questions regarding aforementioned subject:
Is there a EC equivalent of RSA-OAEP key transport/encryption algorithm ?
Is ECIES-KEM sufficient ?
0
votes
0answers
57 views
How fast can a wrong decryption key be detected using ECC?
When can a decryption function detect that the ECC key I use for decryption is incorrect? Is it possible to do that during initialization, or does the complete message have to be decrypted to do that?
...
2
votes
2answers
89 views
How do I unpack the x and y values from the BITSTRING in a DER ECDSA public key?
In ASN.1, the X and Y values for a 256-bit elliptic curve key are stored as a single 66-byte ASN.1 BITSTRING. Are the values just the first and second half of this bitstring?
The private key is an ...
4
votes
1answer
168 views
Can SRP be used with Elliptic Curves?
I'm sure it can, because SRP (secure remote protocol) can be implemented everywhere where Diffie-Hellman works, but I need a proof to put this aspect into Wikipedia.
Edit: ok, can it be at least ...
1
vote
1answer
114 views
How to calculate y value from ((y*y) mod prime) efficiently
i am working ECC-224 bit. can any one tell me, how to calculate y value from ((y*y) mod prime) efficiently for large bit numbers.
0
votes
3answers
145 views
File encryption with one keypair?
I'm working on a program that uses an ECC keypair in a (password protected) PKCS12 file (.pfx) to encrypt files. I like this method because I think it will be higher security (using ECDH to negotiate ...
0
votes
1answer
74 views
What are unified addition and differential addition in elliptic curve point arithmetic?
A lot of papers use these terms but I do not find a proper explanation of them. Can somebody tell the meaning / difference / intuition / application and if possible with an example.
0
votes
1answer
63 views
Efficient algorithm for remainder calculation over prime field for ECC implementation?
I am working on 224-bit elliptic curve cryptography. In this 224-bit * 224-bit multiplication results 448-bit output. I am reducing 448-bit into prime field range( prime number $2^{224}-2^{96}+1$) ...
3
votes
2answers
171 views
What crypto system allows for 3 parties: Party 1 who makes an assertion, Party 2 mutates the assertion, Party 3 validates it
I'm looking for the cryptographic equivalent of a Drivers license where the issuer can be verified, the issuer doesn't need to know who you showed the drivers license to, but also allows ...
3
votes
2answers
155 views
Modulus for elliptic curve point multiplication
I want to implement a point multiplication ($k \cdot P$) operation on FPGA. I have a BN curve $y^2=x^3+2$, and a scalar value $k$. The $x$ and $y$ coordinates of point $P$ are of 256 bits. In the ...
0
votes
0answers
70 views
Use curve25519 for ElGamal crypto
DJB described curve25519 in his paper which can be found here: http://cr.yp.to/ecdh/curve25519-20060209.pdf. It seems that the main purpose was for Diffie-Hellman key exchange. I think this means that ...
2
votes
1answer
69 views
How are Elliptic Curve Cryptography and Pairing Based Cryptography related?
I have been doing a project that uses the PBC library developed by Ben Lynn. But I am still not clear on how PBC is related to ECC.
I know that this is a site for complex crypto QA, but I did not know ...
1
vote
2answers
92 views
While generating a random Elliptic curve what are the conditions i have to considerd?
I want to generate a random elliptic curve over a prime field. What are the conditions I should satisfy?
For the NIST recommended standard ECC-224 bit curve with prime $p=2^{224}-2^{96}+1$, a ...
6
votes
1answer
136 views
When do ECC patents end?
As the topic says, since when can ECC cryptography be freely used?
Isn't it widely used because of patents? There is no alternative to it on embedded devices and smart cards.
Just to mention: i am ...
0
votes
1answer
121 views
ECDSA - point order criterion
i am creating some primitive demostration for ECDSA over small curve ( p < 229). But my implementation have some weird issues. Verify process return false even if the signature is correct. Because ...
1
vote
0answers
67 views
How to represent point-at-infinity in affine coordinate
In projective coordinates point-at-infinity can be identified with z=0. How to identify the point-at-infinity in affine coordinate.
Whether x=0 and y=0 can be considered as point-at-infinity in ...
6
votes
2answers
509 views
Can one reduce the size of ECDSA-like signatures?
Using $n$-bit ECDSA, a signature has a size of $2·n$. It is possible to recover the public key from this signature, which shows that there is a publicly visible redundancy in the signature.
Is ...
4
votes
1answer
195 views
Why do the elliptic curves recommended by NIST use 521 bits rather than 512?
Wikipedia says in reference to the elliptic curves officially recommended by NIST in FIPS 186-3:
Five prime fields for certain primes p of sizes 192, 224, 256, 384, and 521 bits. For each of the ...
2
votes
1answer
77 views
Discrete log analog of ECM factoring algorithm?
Anecdotally, most factoring algorithms have a corresponding variant algorithm that can be used to attack the discrete log problem using similar ideas.
Is there an analog of the elliptic curve (ECM) ...
1
vote
0answers
44 views
Generating non-supersingular elliptic curves for symmetric pairings
I am looking into the application of pairings in CPABE in particular. I've notice that the scheme uses a supersingular curve as the basis of the pairing. Looking through Ben Lynn's thesis for the ...
2
votes
1answer
56 views
Discrete logs on elliptic curve with embedding degree 3 with the 'MOV' attack
The curve $E(\mathbb{F}_{47}):y^2=x^3+x+38$ has order $61$ and $61|47^3-1$ so the embedding degree of $E$ is $3$ and therefore the MOV attack, presumably using some sort of distortion map and a ...
7
votes
2answers
333 views
Using same keypair for Diffie-Hellman and signing
Are there any security risks using a single key-pair for both key-exchange and signing?
I'm mainly interested in using Curve25519 for key-exchange and Ed25519 for signing. But similar combinations, ...
7
votes
1answer
358 views
Does the elliptic curve (EC) cryptosystem outperform RSA and DL cryptosystems?
Throughout the literature, it is stated that EC cryptosystems outperform RSA and Discrete logarithm cryptosystems, but I cannot understand how ECC would be more efficient than RSA and DL in terms of ...
2
votes
1answer
114 views
Choosing good parameter for Lenstra's elliptic curve factorization
In Wikipedia, there is an article explaining Lenstra's factorization algorithm. As far as I got it, we choose some $e \in \mathbb{N}$ and a point $P$ on the curve and then calculate $eP$. While ...
3
votes
1answer
154 views
Is there a field guide to ECC for the IT Security layman?
I'm trying to understand ECC from an IT layman's perspective and am trying to separate the theory from the standards, and understand why certain features are implemented or not implemented in the ...
0
votes
1answer
70 views
tower of extension field
while working on tate pairing, i have to implement towering technique. like i have point p on F(q) and point Q(F(q^k)) (here embedding degree k=12 for BN curve).
instead of taking a point Q on ...
3
votes
1answer
95 views
Why doesn't this replay attack work on ECDSA?
I've just started working with elliptic curves and ECSDA in particular, so my understanding of the underlying math isn't great. The thing I'm currently stuck on is trying to understand why replay ...
1
vote
2answers
127 views
ECM Implementation is really slow
I followed the algorithms 14.4 (computes 1st and 3rd coordinates in (X,Y,Z)#k modulo n) and 14.5 (factorization using ECM) in David Bressoud's book 'Factorization and Primality Testing'. I think the ...
3
votes
1answer
130 views
Impact of algorithms for factoring using elliptic curves over $\mathbb{Q}$
Recently a few papers have appeared that describe a new approach to factoring, using elliptic curves over $\mathbb{Q}$. See, e.g.,
Factoring integers and computing elliptic curve rational points, ...
2
votes
1answer
224 views
Why are elliptic curve variants of RSA “chiefly of academic interest”?
Yesterday I was thinking about elliptic curve variants of popular protocols/algorithms (ECDH, ECES[1], etc) and the thought occured that I had never seen an elliptic curve variant of RSA. My ...
5
votes
2answers
211 views
Besides key and ciphertext sizes what are other advantages of elliptic curve versions of various protocols?
There are elliptic curve variants of Diffie-Hellman, ElGamal, DSA and possibly other protocols/algorithms. I know that these elliptic curve variants have smaller key and ciphertext sizes which will ...
0
votes
3answers
460 views
How does one calculate the scalar multiplication on elliptic curves?
I found this example online:
In the elliptic curve group defined by
$$y^2 = x^3 + 9x + 17 \quad \text{over } \mathbb{F}_{23},$$
what is the discrete logarithm $k$ of $Q = (4,5)$ to the base ...
6
votes
2answers
204 views
Why do public keys need to be validated?
For some curves it's necessary to validate the public-key of the other side before running an elliptic-curve Diffie-Hellman key-exchange. Apparently if you don't validate the public key, small ...
0
votes
1answer
403 views
BouncyCastle Elliptic Curve implementation
I'm implementing ECDH key exchange in C# using the BouncyCastle library and I'm having a hard time understanding the elliptic curve side (FpCurve).
...
1
vote
1answer
148 views
Is there a method to break an EC curve for all key-pairs (Q,d) such that (Q=d*G) faster than breaking every single key-pair?
Related to this question: Is there any memory trade-off that helps such attack?
Obviously if the field size is very small (say 40 bits) it´s possible, but what if the field size is 160 bits long? or ...
1
vote
1answer
184 views
Storage of Private Keys
I'm building a bitcoin web application that will require all users to be assigned a wallet for adding funds to their account. I plan on exposing the public key to the user (the bitcoin address). Users ...
0
votes
0answers
259 views
Diffie hellman key exchange on elliptic curve over an extension field [closed]
I am attempting to do a final semester project where I implement Diffie-Hellman key exchange on an elliptic curve over an extension field (2^256). Can anybody help me to generate the extension field ...
