Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also ...

learn more… | top users | synonyms (1)

12
votes
2answers
1k views

Using same keypair for Diffie-Hellman and signing

Are there any security risks using a single key-pair for both key-exchange and signing? I'm mainly interested in using Curve25519 for key-exchange and Ed25519 for signing. But similar combinations, ...
13
votes
1answer
3k views

ElGamal with elliptic curves

I've searched some information on ECC, but so far I have only found Diffie-Hellman key-exchange implementations using ECC, but I don't want to exchange keys, I want to encrypt & decrypt data like ...
36
votes
6answers
14k views

Who uses Dual_EC_DRBG?

Recent news articles have suggested that the NSA may be involved in trying to influence the cryptography in public standards or commercially deployed software, to enable the NSA to decrypt the ...
71
votes
3answers
46k views

Why is elliptic curve cryptography not widely used, compared to RSA?

I recently ran across elliptic curve crypto-systems: An Introduction to the Theory of Elliptic Curves (Brown University) Elliptic Curve Cryptography (Wikipedia) Performance analysis of identity ...
84
votes
3answers
26k views

Should we trust the NIST-recommended ECC parameters?

Recent articles in the media, based upon Snowden documents, have suggested that the NSA has actively tried to enable surveillance by embedding weaknesses in commercially-deployed technology -- ...
13
votes
1answer
771 views

Mapping points between elliptic curves and the integers

My primary question is: Is there an easy way to create a bijective mapping from points on an elliptic curve E (over a finite field) to the integers (desirably to $\mathbb{Z}^*_q$ where $q$ is the ...
6
votes
2answers
513 views

Besides key and ciphertext sizes what are other advantages of elliptic curve versions of various protocols?

There are elliptic curve variants of Diffie-Hellman, ElGamal, DSA and possibly other protocols/algorithms. I know that these elliptic curve variants have smaller key and ciphertext sizes which will ...
7
votes
2answers
1k views

Is there a feasible method by which NIST ECC curves over prime fields could be intentionally rigged?

The NIST elliptic curves P-192, P-224, P-256, P-384, and P-521, prescribed in FIPS 186-4 appendix D.1.2, are generated according to a well defined process, but using an arbitrary random-looking seed ...
3
votes
1answer
1k views

ECDSA vs RSA: Performance on Android platform and surprising results

For our privacy-preserving protocol, an encrypted channel is established. In order to protect our system from man-in-the-middle attacks, signature-based approach is used. After we've implemented it ...
9
votes
3answers
765 views

Elliptic Curves of different forms

Looking at http://safecurves.cr.yp.to/ to find a safe curve, I find that most curves described here are of a different form from that generally used. In Bouncy Castle, for example, ...
7
votes
1answer
577 views

Why are elliptic curve variants of RSA “chiefly of academic interest”?

Yesterday I was thinking about elliptic curve variants of popular protocols/algorithms (ECDH, ECES[1], etc) and the thought occured that I had never seen an elliptic curve variant of RSA. My ...
4
votes
2answers
569 views

Can we use elliptic curve cryptography in wireless sensors?

Can we use elliptic curve cryptography in wireless sensors? If so, how do you map points to message characters?
21
votes
4answers
15k views

Basic explanation of Elliptic Curve Cryptography?

I have been studying Elliptic Curve Cryptography as part of a course based on the book Cryptography and Network Security. The text for provides an excellent theoretical definition of the algorithm but ...
12
votes
2answers
1k views

Why would anyone use an elliptic curve with a cofactor > 1?

In cryptography, an elliptic curve is a group based on a finite field $GF(p^k)$; this group has $n$ elements on it, and we work on a prime-sized subgroup of size $q$. We denote the value $h = n/q$ as ...
7
votes
2answers
3k views

With OpenSSL and ECDHE, how to show the actual curve being used?

Using openssl s_client -host myserver.net -port 443 I can see the cipher negotiated is indeed using ECDHE for session key ...
5
votes
4answers
5k views

How does one calculate the scalar multiplication on elliptic curves?

I found this example online: In the elliptic curve group defined by $$y^2 = x^3 + 9x + 17 \quad \text{over } \mathbb{F}_{23},$$ what is the discrete logarithm $k$ of $Q = (4,5)$ to the base ...
3
votes
0answers
812 views

Elliptic curve cryptography related key attacks

This question is an extension of Families of public/private keys in elliptic curve cryptography As described above, bitcoin "type 2" deterministic wallets use a root private/public key pair, where ...
2
votes
2answers
609 views

What curve and key length to use in ECDSA with BouncyCastle

I'm developing a client/server system in Java which is not interacting with third party software, so I don't have to worry about compatibility. At a certain point, I need the client and server to ...
2
votes
1answer
100 views

Roots in modulo field

I have a point $(X,Y)$ on an elliptical curve $E(a,b)$ where $a=-3$ and $B$ is a large number that is in hexadecimal from -51BD. To compress this point oficially in a program, we know that every $X$ ...
2
votes
2answers
436 views

How do I convert the definition of E-521 into a curve definition a la Bouncy Castle?

I am currently trying to create an ECCCurve for E-521. Unfortunately, it is not currently a named curve in the library I am using, so I will have to define it manually. I am using the definition of ...
2
votes
1answer
193 views

Discrete logs on elliptic curve with embedding degree 3 with the 'MOV' attack

The curve $E(\mathbb{F}_{47}):y^2=x^3+x+38$ has order $61$ and $61|47^3-1$ so the embedding degree of $E$ is $3$ and therefore the MOV attack, presumably using some sort of distortion map and a ...
1
vote
0answers
54 views

Smart card Strong authentication / Verification ( fingerprints)

I'm trying to make a strong authentication software and embedded software in a java card. I have found many papers and publications about the subject… too much information to process and I'm working ...
0
votes
1answer
78 views

How to calculate kinv from the given k value

I am implementing an ECDSA NIST test vectors verification application. The test vectors are taken from http://csrc.nist.gov/groups/STM/cavp/#09. One of the test vectors is given below: ...
20
votes
3answers
26k views

How can I use SSL/TLS with Perfect Forward Secrecy?

I'm new to the field of cryptography, but I want to make the web a better web by setting up the sites that I host with Perfect Forward Secrecy. I have a list of questions regarding the setup of ...
33
votes
1answer
26k views

Explaining weakness of Dual EC DRBG to wider audience?

I have an audience of senior (non-technical) executives and senior technical people who are taking the backdoor in Dual_EC_DRBG and considering it as a weakness of Elliptic curves in general. I can ...
16
votes
3answers
2k views

Can ECDSA signatures be safely made “deterministic”?

Using the terminology of the ECDSA wikipedia page, ECDSA (and DSA) signatures require a random k value for each signature which ensures that the signature is different each time even if the message ...
6
votes
1answer
327 views

Is pairing based cryptography ready for productive use?

I'm currently testing one among those many interesting cryptographic protocols based on bilinear maps. It's quite hard to understand the underlying fundamentals, especially since there are several ...
8
votes
2answers
689 views

When using Curve25519, why does the private key always have a fixed bit at 2^254?

When using Curve25519, the private key always seems to have a fixed bit set at position 2^254. Why is that? Is there any good reason to use a fixed positioned most-significant-bit in the private key? ...
4
votes
2answers
797 views

Can curve25519 keys be used with ed25519 keys?

Can curve25519 keys be used with ed25519? I'd prefer to use ed25519, but there isn't a fast java version. For my application, I'd like to use curve25519 until I can get a faster ed25519 for java. ...
13
votes
2answers
1k views

Does the elliptic curve (EC) cryptosystem outperform RSA and DL cryptosystems?

Throughout the literature, it is stated that EC cryptosystems outperform RSA and Discrete logarithm cryptosystems, but I cannot understand how ECC would be more efficient than RSA and DL in terms of ...
11
votes
1answer
605 views

Compressing EC private keys

For reasonable security, EC private keys are typically 256-bits. Shorter EC private keys are not sufficiently secure. However, shorter symmetric keys (128-bits, for example) are comparably secure. I ...
5
votes
1answer
235 views

Understanding Twist Security with respect to short Weierstrass curves

I'm trying to understand the "Invalid-curve attacks against ladders" section of SafeCurves Twist Security page and I have difficulties to apply it to short Weierstrass curves. That section claims ...
3
votes
1answer
532 views

Elliptic Curve Encryption Ciphertext Size

I'd like to know how much bigger is the ciphertext when encrypting a message using ECC encrytpion? ECIES (or ElGamal)
2
votes
1answer
420 views

Hide a weakness in ECC by choosing the prime or one of the curve coefficients

Suppose you are given a value $c$. Can you find a prime $p$ and an integer $b$ such that the elliptic curve $$E: y^2 \equiv x^3 -3x + b \pmod p$$ is cryptographically weak? You need to choose ...
11
votes
2answers
1k views

How does the MOV attack work?

What exactly is the MOV attack, how does it actually work, and what is it used for? It's explained briefly here and I'd like to know what it is more / what is it fully used for.
8
votes
2answers
1k views

Can one reduce the size of ECDSA-like signatures?

Using $n$-bit ECDSA, a signature has a size of $2·n$. It is possible to recover the public key from this signature, which shows that there is a publicly visible redundancy in the signature. Is ...
6
votes
2answers
251 views

Fast hashing into elliptic curve

Is there a fast algorithm for mapping $n$-bit numbers $s$ (for fixed $n$) into a cyclic subgroup of an elliptic curve (over a finite field) in which the Discrete Logarithm Problem is hard? By fast, I ...
5
votes
2answers
195 views

Is it safe to reuse ECDH asymmetric keys for authentication?

Alice, Bob, and Carol each generate ECDH keypairs. Alice and Bob establish a communication channel and negotiate an AliceBob secret. The question is: Is it safe for Alice and/or Bob to reuse their ...
4
votes
1answer
536 views

Trying to better understand the failure of the Index Calculus for ECDLP

So I'm going to give you guys my understanding and then if you would be so kind as to tell me where I'm off the mark (hopefully I'm not completely wrong). So basically the index calculus for the ...
4
votes
1answer
551 views

Families of public/private keys in elliptic curve cryptography

I'm looking for a related key scheme for elliptic curve cryptography. The basic idea would be that there would be a master public key and a master private key. From the master public key, you could ...
3
votes
3answers
278 views

understanding pairing $e:G \times G \to G_T$ and ( Decision)BDH assumption

From DrLecter's comment, I know that DDH problem can be efficiently solved with this $$e(g^a,g^b)\stackrel{?}{=} e(g,g^z).$$ I have some trouble to understand this map $e:G \times G \to G_T$. Am I ...
2
votes
1answer
178 views

ECC - ElGamal with Montgomery or Edwards type curves (curve25519, ed25519) - possible?

I know the usual way of using getting shared secrets for encryption with ECC is DH, however, this only works with two keypairs of exactly the same kind, for example two curve25519- or two ...
0
votes
2answers
431 views

Reuse of a DH / ECDH public key

I was wondering whether it is safe to use the same DH or ECDH key pair in more than one key agreement, particularly if these public keys are in a public registry. These public keys could be used by ...
6
votes
1answer
143 views

Are there groups where the computational Diffie Hellman problem is easy but the discrete log problem is hard?

I know that there are elliptic curve groups, used in pairing-based cryptography, where the decisional Diffie Hellman problem (ie. given $g$, $g^a$, $g^b$ and $c$, determine if $c = g^{ab}$ is easy but ...
5
votes
1answer
123 views

How can I find the order of the group that an elliptic curve is defined over?

I have a Weierstrass elliptic curve ($y^2=x^3+a \times x+b \mod p $) How can I find the order of the group itself? I have seen Mathematica has a GroupOrder[] ...
4
votes
3answers
368 views

Why are elliptic curves better than cyclic groups?

The set of points of an elliptic curve over a finite field is isomorphic to the direct product of two cyclic groups (i.e. $E(F_{p^n}) \cong Z_{s} \times Z_{t})$. What is the advantage of representing ...
3
votes
1answer
100 views

Is it ever unsafe to compress an EC point?

I am working with a library that outputs EC points in uncompressed form. To save space, I'm considering modifying said library to use compressed EC points. Assuming that I keep track of the sign bit ...
3
votes
1answer
285 views

What differences between Menezes–Vanstone ECC and ElGamal ECC?

After researching ECC encryption, I found that we can use ElGamal cryptosystem with elliptic curve and can we use Menezes-Vanstone cryptosystem with elliptic curve. What is the essential difference ...
3
votes
0answers
187 views

Is there a flaw in this ECC blind signature scheme?

Recently I've found the following work on the internet: An ECC-Based Blind Signature Scheme The paper claims to be an ECDSA blind signature however it seems that their scheme has a flaw in it. The ...
3
votes
1answer
696 views

Subtracting a point in elliptic curve cryptography?

I've had lots of practice adding points for my crypto class. However I've run into a situation where I need to subtract two points for decryption: ...