Elliptic curves are a mathematical structure. In cryptography, it is common to use the structure $y^2 = x^3 + ax^2 + b$ over a finite field. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider specific tags such as discrete-logarithm and ecdsa.

learn more… | top users | synonyms (1)

3
votes
2answers
118 views

Asymmetric key derivation – Who derives the new pub key can't know the new private key

I'm looking for a peer reviewed protocol or algorithm that can do this, preferentially I need something based on elliptic-curves cryptography. Alice know the main public key of Bob (B-PUB-1). Alice ...
1
vote
1answer
95 views

Are RSA or ECC vulnerable to an attack where the same (unknown) plaintext is encrypted with multiple public keys?

I'm not sure what this attack model is called - it's not known-plaintext and also not quite cipher-text-only. It is similar to this question except the general case (not just two keys) and using keys ...
0
votes
1answer
27 views

ECDSA Public Key generation

Referring to both Wikipedia page and ECDSA-cert paper I can understand that, given $\mathcal{E} = \mathcal{E}(a,\,b,\,\mathbb{F}_{2^m})$ as our elliptic curve on $\mathbb{F}_{2^m}$ group $G \in ...
6
votes
0answers
573 views

Elliptic curve cryptography related key attacks

This question is an extension of Families of public/private keys in elliptic curve cryptography As described above, bitcoin "type 2" deterministic wallets use a root private/public key pair, where ...
3
votes
0answers
144 views

Reasons for SM2 Digital Signature Algorithm

In the IETF RFC draft named "SM2 Digital Signature Algorithm" a signature algorithm is specified. The RFC does however not mention why this signature algorithm has been defined. Nor does it specify ...
2
votes
0answers
95 views

Using the same private key for two ECC key pairs

Let $(d_1,Q_1)$ and $(d_2,Q_2)$ be ECC key pairs over two different elliptic curves (say NIST P-224 and NIST P-256). According to the Elliptic Curve Discrete Logarithm Problem (ECDLP), if the private ...
2
votes
0answers
52 views

Is it safe to reuse ECDH asymmetric keys for authentication?

Alice, Bob, and Carol each generate ECDH keypairs. Alice and Bob establish a communication channel and negotiate an AliceBob secret. The question is: Is it safe for Alice and/or Bob to reuse their ...
2
votes
0answers
203 views

How can someone predict the bits of a not-so-PRNG like Dual_EC_DRGB?

Given the recent revelations of the NSA engineering a backdoor into the Dual_EC_DRBG algorithm - I'm curious, exactly how, given the number of variables involved in generating the random bits could ...
2
votes
0answers
124 views

Is this ECC encryption key sharing method okay?

Is this encryption key sharing okay to use? Or is much better to use ECIES? $G$ = base point $a$ = Alice’s private key $b$ = Bob’s private key $A = aG$ = Alice’s public key $B = bG$ = Bob’s public ...
2
votes
0answers
138 views

inverse problem about scalar multiplication on elliptic curve

Let $E$ be an elliptic curve over a finite field $F_p$. Given $n$ be a positive integer and $Q$ be a point on $E$, assume that $Q=nP$, how can we find this $P$? We can assume that $n|p-1$. If $n$ is ...
1
vote
0answers
35 views

Reliability of a single-pass deniable authentication protocol?

I look for one-pass deniable authentication protocol with a short message payload for my project and find a solution: ...
1
vote
0answers
100 views

Which of following new (2013) ECC curves is the most secure or efficient?

I read about the following "safe" ECC curves and notably, secp256 and all the NIST curves are marked as "unsafe" when compared to more modern curves. I need a curve for signing or encryption, (or ...
1
vote
0answers
52 views

Sextic twist of BN pairing parameters vs security

I've previously asked questions on BN pairing parameters. Here's one more. In the BN construction, one is working in a subgroup of a curve over an extension field $\mathbf{F}_{p^{12}}$ for some ...
1
vote
0answers
82 views

Gallant-Lambert-Vanstone method

I am experimenting with the GLV method but cannot manage to get the right results according to the literature. I managed to find lambda, beta, split $K$ into $k_1$ and $k_2$ etc. for the curve I'm ...
1
vote
0answers
94 views

Where can I find examples of ECC implemented in VHDL?

I am looking into implementing ECDSA signature and ECDH key agreement in a Xilinx FPGA. All the examples I have found of VHDL implementations skip over how to construct the low level ECC primitives ...
1
vote
0answers
89 views

$\phi$ function in Dual_EC_DRBG

I am trying to understand the operation of the Dual_EC_DRBG. I'm reading the formal specification (SP 800-90) and can't seem to find a definition of the $\phi$ function used throughout the definition ...
1
vote
0answers
126 views

About Elliptic Curve ElGamal, 3 simple problems I have trouble with

In Elliptic Curve ElGamal, why are a=b=1 always legal for primes whose lengths are no shorter than 11(2) bits long? Is there any reason why the Point at Infinity can always be encoded as (0,0)? ...
1
vote
0answers
103 views

Can keys from Bitcoin's Hierarchical Deterministic Wallets be correlated (reducing privacy)?

I'm trying to understand if the feature "Hierarchical Deterministic Wallets" in Bitcoin allows for complete privacy of all derived keys, and if any of those keys can be associated with each other ...
1
vote
0answers
192 views

Does BouncyCastle (for ECC) resist timing attacks?

I need to extend the TLS protocol to be able to use other key exchange scheme based on elliptic curves. I am planning to use BouncyCastle's implementation in Java and in .NET. I am worring about ...
1
vote
0answers
216 views

Understanding elliptic curve encryption

I'm having a hard time understanding the elliptic curve encryption. One thing thing I don't understand is listing all the points on the curve (mod p). Suppose I have the following elliptic curve: y^2 ...
1
vote
0answers
106 views

Complex Numbers on Elliptic Curves & Usage in Tate Pairing

I'm working with understanding the internals of the Tate Pairing. I was going through an example of the curve $E: y^2 = x^3 + 3x$ over $\mathbb{F_{11}}$. The author is showing the computation of ...
1
vote
0answers
61 views

Hardware implementation of pairing

I would like to design a hardware-based accelerator for a pairing algorithm to make it faster. I know that I need to do arithmetic over a base and an extension field. Could anyone would suggest which ...
1
vote
0answers
103 views

How fast can a wrong decryption key be detected using ECC?

When can a decryption function detect that the ECC key I use for decryption is incorrect? Is it possible to do that during initialization, or does the complete message have to be decrypted to do that? ...
1
vote
0answers
149 views

Use curve25519 for ElGamal crypto

DJB described curve25519 in his paper which can be found here: http://cr.yp.to/ecdh/curve25519-20060209.pdf. It seems that the main purpose was for Diffie-Hellman key exchange. I think this means that ...
1
vote
0answers
158 views

How to represent point-at-infinity in affine coordinate

In projective coordinates point-at-infinity can be identified with z=0. How to identify the point-at-infinity in affine coordinate. Whether x=0 and y=0 can be considered as point-at-infinity in ...
0
votes
0answers
76 views

Defending hybrid encryption schemes against padding oracle attacks

I intend to use a generic integrated/hybrid encryption scheme for transmitting information between a client and a server. Key encapsulation: a 128-bit symmetric key is generated and asymmetrically ...
0
votes
0answers
53 views

Weil pairing implementation - low level programming language

I'm just started to studying elliptic curve cryptosystems. My one month-goal is to write a simple signature system based on the Weil-pairing. Some parts of it can be written without deeper ...
0
votes
0answers
49 views

Known vulnerabilities in (EC-)KCDSA

Does anybody know if there's known vulnerabilities in KCDSA/EC-KCDSA? I have been researching for the past few hours and I haven't found anything. Wikipedia has very limited amount of information and ...
0
votes
0answers
57 views

What is the best way to verify a curve25519 identity?

A client identifies itself as a curve25519 public key. The server wants to verify the client owns the associated private key. What is the safest −and computationally efficient− way of doing so ? The ...
0
votes
0answers
94 views

inverse of scalar multiplier in ECC

I am learning to use ECC. i got into situation where i have $Q=abG$, where $G$ is the generator of the finite field formed on EC using a prime $p$ modulus and $a$ , $b$ are random numbers. now suppose ...