Elliptic curves are a mathematical structure. In cryptography, it is common to use the structure $y^2 = x^3 + ax^2 + b$ over a finite field. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider specific tags such as discrete-logarithm and ecdsa.

learn more… | top users | synonyms (1)

1
vote
1answer
26 views

What can be learned from the ciphertext of LibSodium's crypto_box_detached()?

LibSodium, (https://github.com/jedisct1/libsodium), has a function crypto_box_detached() which does authenticated encryption using the public key of the recipient ...
-1
votes
0answers
32 views

How to compute 3P from elliptic curve where P is (28, 8) [on hold]

Consider the elliptic curve E31(1,1): Calculate 3P, where P = (28,8).
-2
votes
0answers
32 views

How to find secret key and public key for ECC cryptosystem?

Develop an ECC cryptosystem based on E31(1;1), point G = (0,1) which has order 32. nA value of 6. What is the secret key? What is the public key?
1
vote
1answer
74 views

Protection of Elliptic Curve Implementations against side-channel attacks [on hold]

Recent fast elliptic curve implementations, for example a presentation at Eurocrypt 2014 (earlier presentation slides, the paper) talks about protection against only timing attacks. Why only timing ...
0
votes
0answers
52 views

initiate the elliptic curve

when we consider a curve in a prime field for example Weierstrass form and want to initiate it in Miracl,we should give these inputs for initiate curve: ebrick_init(&binst,x,y,a,b,n,window,nb) ...
0
votes
3answers
109 views

Elliptic curve parameters

What's the meaning of 160 bit Curve in Elliptic curve ? or 192 or 224 or 256 and etc. And What is the standard for selecting this number of bit ? why they don't say 100 bit curve?
1
vote
1answer
55 views

How can convert affine to Jacobian coordinates?

I have a point in affine coordinates: $(x,y)$. What should I do when I want to convert to $(X,Y,Z)$ in Jacobian coordinates? I need it for calculating ECC in a prime field.
0
votes
0answers
48 views

advantages of hashing over elliptic curve signatures for a proof of work protocol

I'm trying to create a proof-of-work protocol for a proof-of-concept software, and it's basically something like this: ...
1
vote
0answers
59 views

Which mathematical operations does secp256k1 point multiplication use?

To convert a bitcoin private key to a public key, the secp256k1 point multiplication math is used. Could I – theoretically – convert a private key to a public key just using the four arithmetic ...
2
votes
1answer
72 views

What is the difference between “secp…” and “sect…”?

The National Institute of Standards and Technology (NIST) recommended elliptic curve domain parameters to have names such as “secp…” and “sect…”. For example: “secp224k1” and “sect571k1”. What is ...
3
votes
3answers
133 views

Why are we not using multiple ciphers per message?

I am aware of at least rsa, elgamal-encryption, and variations of elliptic-curves relying on different problems and that those problems are considered hard. However, if someone figures out a way to ...
1
vote
0answers
65 views

What is the (uncompressed) x,y-representation of a curve point on the P-256 NIST elliptic curve?

I am trying to understand the FIDO U2F Raw Message Format, especially the format in which a user public key should be provided. The documentation says the following: A user public key [65 bytes]. ...
0
votes
1answer
53 views

Is elliptic curve point multiplication semantically secure?

Is elliptic curve point multiplication semantically secure? I'd like to know if there are some sets of elliptic curve parameters (e.g. NIST curves) that are proved to be semantically secure or that ...
-1
votes
1answer
51 views

Bouncy Castle elliptic curve from explicit parameters (E-521)

I'd like to use a curve that's not included in the Bouncy Castle EC named curves spec, specifically E-521. According to the BC javadocs, you need a few values in order to do this: q, a, and b for the ...
0
votes
1answer
49 views

How can i calculate prime of Elliptic Curve?

In many articles i have found directly the calculation of prime elliptic curve. How can i calculate this prime $p$ ? For example if I consider NIST P-256, $ p = 2^{256}-2^{224}+2^{192}+2^{96}-1$. Why ...
2
votes
1answer
142 views

Why is 224 bit ecdsa faster than 192 bit ecdsa?

I ran several benchmarks using openssl on 2 different computers and I got a surprising result. for the Nist 192 bit curve the benchmark result is ...
0
votes
0answers
48 views

Scalar multiplication of elliptic curve point by a fraction

I'm implementing an algorithm that works on a generic finite cyclic group written in the classic multiplicative notation: (G,*) = < g > , n = |g| At a ...
0
votes
1answer
62 views

How to calculate kinv from the given k value

I am implementing an ECDSA NIST test vectors verification application. The test vectors are taken from http://csrc.nist.gov/groups/STM/cavp/#09. One of the test vectors is given below: ...
0
votes
0answers
41 views

Selecting a Bouncy Castle named curve for ECC [duplicate]

I have been tasked with implementing ECDSA and ECDH in Java using the Bouncy Castle library. However, I am unsure of what curve to use. I am aware of the named curves listed in BC, and I've done a ...
1
vote
0answers
26 views

ECIES: Purpose of optional shared information?

According to Wikipedia the ECIES algorithm has two optional shared information $S_1$ and $S_2$. They are used as follows: Generate a random shared secret $Z$ according to ECIES, which will never be ...
1
vote
1answer
45 views

ECIES: Purpose of MAC?

Assumptions: $A$ wants to communicate with $B$ $A$ knows a public key $P_B$ which is trusted by a third party and belongs to $B$ $A$ knows the address of someone who pretends to be $B$ $A$ wants ...
3
votes
2answers
593 views

Is secp256r1 more secure than secp256k1?

Curves secp256r1 and secp256k1 are both examples of two eliptic curves used in various asymmetric cryptography. Googling for these shows most of the top results are Bitcoin related. I've heard the ...
0
votes
0answers
28 views

Size of Messages Exchanged by PRV and VER for Schnorr Protocol

In this file Elliptic Curve Based Zero Knowledge Proofs and Their Applicability on Resource Constrained Devices I don't understand the Table 6 (Table 6: Size of Messages Exchanged by the Prover(PRV) ...
-2
votes
1answer
71 views

How Proof all Subgroup point of prime order elliptic curve have prime order [#G=#E]? [closed]

anyone knows any reference that proof it ? Please Help .
2
votes
1answer
64 views

Prevent MITM attack while encrypting data by using ElGamal ECC?

I am using ElGamal ECC to encrypt my plain text data. I want to ensure that my data is safe from a Man-In-The-Middle attack. What methodology I can adopt to achieve this goal? How can we prevent a ...
1
vote
0answers
55 views

Type G Bilinear Pairings

I was reading PBC and its implementations for finding pairing parameters. I am particularly interested in implementing a BLS signature scheme with 20-byte (160-bit) signatures ("short signatures"). ...
3
votes
1answer
121 views

Proving Non-Existence of ECC Backdoors

In light of the NIST Dual EC DRBG scandal, I was intrigued by a NIST slide (slide 9) that said the two points P and Q can be chosen so that the chooser can prove they don't have a backdoor. This ...
0
votes
0answers
84 views

RSA and ECDSA Certificate Sizes

Is there a table (or a whitepaper from official sources) that compares the size of X509 certificates generated with RSA (starting from 1024 bits) and ECDSA (starting from 160 bits) ? Thanks for the ...
1
vote
0answers
75 views

ECC cryptography with shorter signature when not needing high security?

I am new here and fairly new to cryptography, so if I say something wrong, let me know. I am trying to set up a system where a user can receive a temporary license key over the phone, put it into ...
3
votes
2answers
220 views

Rely on NSA Suite B Cryptography?

NSA's Suite B Cryptography suggests some cryptographic algorithms for encryption, digital signatures, message digests and key agreements. The selected algorithms and their key size are suggested by ...
1
vote
0answers
85 views

Hardware Implementation of Pairing over BN curves

I am in the middle of FPGA based Hardware architecture design for the computation of Pairing (particularly R-ate Pairing) over BN curves. Where, the point addition, and point doubling should be ...
6
votes
1answer
104 views

Point addition equation in projective co ordinates

How can I get point addition equation for elliptic curves in projective co ordinate system? Can I get it by changing $$ x = X/Z $$ and $$ y =Y/Z $$ in the equation for affine co ordinates' group law? ...
4
votes
1answer
134 views

Using Lattice-based cryptography for TLS\SSL

Given the general benefits of Lattice-based cryptography, such as: Post quantum Security Security from worst case scenario Efficiency What could the outlook of shifting from RSA \ ECC-based ...
2
votes
2answers
99 views

ECDH anonymous key exchange to avoid PKI

I want to use TLS to encrypt the communication between peers in a P2P network. Each peer has a well known 256bit peer identifier (the public key of a 256bit elliptic curve keypair). Both peers need ...
4
votes
1answer
135 views

Implementing CD serial key system

I am trying to create a system where to unlock the application one needs to enter a serial code. I have read many articles on the theme but there are two problems bugging me. One is, If I have a ...
2
votes
1answer
213 views

Adding points on Elliptic Curves

How do we add the integer points $P=(-1, 4)$ and $Q=(2, 5)$ on the elliptic curve of the form $y^2=x^3+17$ ?
5
votes
1answer
207 views

Elliptic Curve Cryptography

I have been trying this for a while. But I couldn't get it. How can I determine the point of intersection of the tangent line at (0, 0) on the curve $y^2 + y = x^3 + x^2$ ?
0
votes
2answers
91 views

Elliptic curve group over a prime finite field $F_p$

If $p$ is a big prime, and the elliptic curve $E$ is defined over $F_p$ by the equation $y^2=x^3+ax+b$ where $a,b\in F_p$. The point on $E/F_p$ together with the infinite point $\mathcal{O}$ form a ...
2
votes
3answers
103 views

Can a EC private key be derived from a public key?

I understand that the public key does not expose the private key. That is not the question. The question is: Given a EC public key, can a different, but plausible and functional private key be ...
2
votes
0answers
75 views

Difference between “ECDH with cofactor key” and “ECDH without cofactor key”?

I need to use “ECDH with a cofactor key” for generating symmetric key. I have a fair idea on how ECDH works, but I don’t understand the cofactor part. What is the difference between ”ECDH with a ...
1
vote
0answers
82 views

A question about elliptic curves and finite fields in bilinear pairings

Based on what mentioned in the paper "Pairings For Cryptographers" http://www.sciencedirect.com/science/article/pii/S0166218X08000449 the two inputs of a pairing map are two members of two additive ...
-3
votes
2answers
137 views

pairing-based schemes

some authors claimed that computational performance of a pairing-fee scheme (based on scalar multiplication over an elliptic curve group) is about 1000% more efficient than a pairing based one I would ...
4
votes
2answers
180 views

How does recovering the public key from an ECDSA signature work?

It is possible to recover the public key from an ECDSA signature (R,S). Please explain me how this works.
2
votes
1answer
52 views

Is jacobian to projective conversion unique?

I am doing a small project in ECC. I have used the following equation for converting Projective to Jacobian coordinates: $$D = AC\\ E = BC^{2}\\ F = C$$ and also the following equation to convert ...
2
votes
2answers
212 views

What curve and key length to use in ECDSA with BouncyCastle

I'm developing a client/server system in Java which is not interacting with third party software, so I don't have to worry about compatibility. At a certain point, I need the client and server to ...
1
vote
1answer
104 views

How to convert projective to jacobian co-ordinate in ECC?

I am doing a small project using elliptic curve in cryptography. My doubt is, can I directly convert a projective to a Jacobian coordinate system without using the affine conversion in elliptic curve ...
4
votes
1answer
165 views

Elliptic Curve Crypto, is a distributed signing method possible using Shamir's Secret Sharing?

Note: A distributed signature scheme exists for RSA: Practical Threshold Signatures, Victor Shoup. Is it possible to adapt such scheme for ECC? A centralized signing machine is vulnerable to ...
1
vote
1answer
105 views

Is either brainpoolP320r1 or brainpoolP320t1 a SafeCurve?

Not all elliptic curves are safe to use for cryptography, especially from an ECC safety perspective. The site http://safecurves.cr.yp.to/index.html shows that two tested Brainpool curves, ...
4
votes
1answer
88 views

Parallelized Pollard's Rho algorithm for ECDLP + Jacobian coordinates

My implementation of the parallelized Pollard's Rho algorithm is using Jacobian coordinates to avoid the costly inversion operation when performing point addition. I am wondering if there are any ...
6
votes
2answers
139 views

Fast hashing into elliptic curve

Is there a fast algorithm for mapping $n$-bit numbers $s$ (for fixed $n$) into a cyclic subgroup of an elliptic curve (over a finite field) in which the Discrete Logarithm Problem is hard? By fast, I ...