Elliptic curves are a mathematical structure. In cryptography, it is common to use the structure $y^2 = x^3 + ax^2 + b$ over a finite field. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider specific tags such as discrete-logarithm and ecdsa.
19
votes
4answers
5k views
Why is elliptic curve cryptography not widely used, compared to RSA?
I recently ran across elliptic curve crypto-systems:
An Introduction to the Theory of Elliptic Curves (Brown University)
Elliptic Curve Cryptography (Wikipedia)
Performance analysis of identity ...
16
votes
5answers
1k views
Current mathematics theory used in cryptography/coding theory
What are the mainstream techniques borrowed from algebraic geometry (or some other branch of mathematics) which are currently used in cryptography/coding theory? I've only heard about a small subset ...
12
votes
4answers
4k views
Basic explanation of Elliptic Curve Cryptography?
I have been studying Elliptic Curve Cryptography as part of a course based on the book Cryptography and Network Security. The text for provides an excellent theoretical definition of the algorithm but ...
9
votes
1answer
396 views
Mapping points between elliptic curves and the integers
My primary question is:
Is there an easy way to create a bijective mapping from points on an elliptic curve E (over a finite field) to the integers (desirably to $\mathbb{Z}^*_q$ where $q$ is the ...
8
votes
2answers
553 views
Are any of the major asymmetric ciphers distinguishable (EG, RSA, ECC) ?
Related to this question.
Given ciphertexts generated by any of the major asymmetric ciphers (RSA, ElGamal, ECC, etc..) can these ciphertexts be distinguished from random noise? Justify why, why ...
7
votes
2answers
406 views
How does the MOV attack work?
What exactly is the MOV attack, how does it actually work, and what is it used for?
It's explained briefly here and I'd like to know what it is more / what is it fully used for.
7
votes
1answer
281 views
Does the elliptic curve (EC) cryptosystem outperform RSA and DL cryptosystems?
Throughout the literature, it is stated that EC cryptosystems outperform RSA and Discrete logarithm cryptosystems, but I cannot understand how ECC would be more efficient than RSA and DL in terms of ...
7
votes
2answers
314 views
Using same keypair for Diffie-Hellman and signing
Are there any security risks using a single key-pair for both key-exchange and signing?
I'm mainly interested in using Curve25519 for key-exchange and Ed25519 for signing. But similar combinations, ...
6
votes
1answer
273 views
Compressing EC private keys
For reasonable security, EC private keys are typically 256-bits. Shorter EC private keys are not sufficiently secure. However, shorter symmetric keys (128-bits, for example) are comparably secure.
I ...
6
votes
2answers
489 views
Can one reduce the size of ECDSA-like signatures?
Using $n$-bit ECDSA, a signature has a size of $2·n$. It is possible to recover the public key from this signature, which shows that there is a publicly visible redundancy in the signature.
Is ...
6
votes
2answers
202 views
Why do public keys need to be validated?
For some curves it's necessary to validate the public-key of the other side before running an elliptic-curve Diffie-Hellman key-exchange. Apparently if you don't validate the public key, small ...
6
votes
3answers
512 views
Can ECDSA signatures be safely made “deterministic”?
Using the terminology of the ECDSA wikipedia page, ECDSA (and DSA) signatures require a random k value for each signature which ensures that the signature is different each time even if the message ...
6
votes
1answer
520 views
Secp256k1 test examples
Are there any available test cases for testing elliptic curves like secp256k1 (Korblitz curves from http://www.secg.org/collateral/sec2_final.pdf)? For curves like P192 there are for example those ...
6
votes
2answers
246 views
Pairing-friendly curves in small characteristic fields
There are several well-known techniques to generate pairing-friendly curves of degrees 1 to 36 on prime fields GF(p): Cocks-Pinch, MNT, Brezing-Weng, and several others.
In extension fields GF(p^n), ...
6
votes
1answer
135 views
When do ECC patents end?
As the topic says, since when can ECC cryptography be freely used?
Isn't it widely used because of patents? There is no alternative to it on embedded devices and smart cards.
Just to mention: i am ...
5
votes
2answers
203 views
Besides key and ciphertext sizes what are other advantages of elliptic curve versions of various protocols?
There are elliptic curve variants of Diffie-Hellman, ElGamal, DSA and possibly other protocols/algorithms. I know that these elliptic curve variants have smaller key and ciphertext sizes which will ...
5
votes
1answer
195 views
Is the Representation Problem hard on elliptic curves?
The RP in ECC would be to find $a_1,\ldots,a_n$ (integers) given $P$ and $Q_1,\ldots,Q_n$ (points in the EC) such that $P = a_1 \cdot Q_1 + \ldots + a_n \cdot Q_n$.
Is it hard when DH-like ...
5
votes
1answer
119 views
Are there security issues with discrete logarithm keys not being uniformly distributed?
Generally, algorithms based on discrete logarithm specify that private keys are chosen as scalars between 1 and the order of the group (denoted q here). For instance IEEE P1363 and FIPS 186-3 both ...
5
votes
1answer
132 views
How can I use Weierstrass curve operations with a=-3 for implementing operations for a=0?
I am working with golang's elliptic library.
It implements functions on Weierstrass elliptic curves with $a=-3$. I need to make my own library that allows me to handle curves with $a=0$. I understand ...
4
votes
1answer
1k views
How strong is the ECDSA algorithm?
Some cryptographic algorithms are as strong as the size of their key is, while other have some weaknesses that limit their strength (such as SHA-1). How strong is the ECDSA algorithm, and does that ...
4
votes
1answer
164 views
Can SRP be used with Elliptic Curves?
I'm sure it can, because SRP (secure remote protocol) can be implemented everywhere where Diffie-Hellman works, but I need a proof to put this aspect into Wikipedia.
Edit: ok, can it be at least ...
4
votes
1answer
438 views
advantages of a static ECDH key
What are the advantages of using static-ephemeral ECDH over ephemeral-ephemeral ECDH?
4
votes
1answer
179 views
Why do the elliptic curves recommended by NIST use 521 bits rather than 512?
Wikipedia says in reference to the elliptic curves officially recommended by NIST in FIPS 186-3:
Five prime fields for certain primes p of sizes 192, 224, 256, 384, and 521 bits. For each of the ...
4
votes
1answer
260 views
Standardized parameters for elliptic curve cryptography
When an elliptic curve-based cryptosystem is deployed, a single set of public parameters (consisting of a particular elliptic curve over a finite field as well as a generator of a prime order subgroup ...
4
votes
2answers
230 views
An Elliptic curve cryptography implementation which can be terminated
I'd like to have an implementation of elliptic curve cryptography along the lines of secp256k1 which is secure until some information is published after which it is broken.
One idea would be to use ...
3
votes
1answer
449 views
X9.62 Multiplying an elliptic curve point by a number
I'm currently trying to implement ecdsa and the first problem i met -- multiply an elliptic curve point by a number.
As far as i understand X9.62 gives some recommendation for doing it but i ...
3
votes
1answer
89 views
Why doesn't this replay attack work on ECDSA?
I've just started working with elliptic curves and ECSDA in particular, so my understanding of the underlying math isn't great. The thing I'm currently stuck on is trying to understand why replay ...
3
votes
1answer
128 views
Impact of algorithms for factoring using elliptic curves over $\mathbb{Q}$
Recently a few papers have appeared that describe a new approach to factoring, using elliptic curves over $\mathbb{Q}$. See, e.g.,
Factoring integers and computing elliptic curve rational points, ...
3
votes
2answers
242 views
Why would anyone use an elliptic curve with a cofactor > 1?
In cryptography, an elliptic curve is a group based on a finite field $GF(p^k)$; this group has $n$ elements on it, and we work on a prime-sized subgroup of size $q$. We denote the value $h = n/q$ as ...
3
votes
2answers
141 views
Modulus for elliptic curve point multiplication
I want to implement a point multiplication ($k \cdot P$) operation on FPGA. I have a BN curve $y^2=x^3+2$, and a scalar value $k$. The $x$ and $y$ coordinates of point $P$ are of 256 bits. In the ...
3
votes
1answer
95 views
Trying to better understand the failure of the Index Calculus for ECDLP
So I'm going to give you guys my understanding and then if you would be so kind as to tell me where I'm off the mark (hopefully I'm not completely wrong).
So basically the index calculus for the ...
3
votes
2answers
160 views
What crypto system allows for 3 parties: Party 1 who makes an assertion, Party 2 mutates the assertion, Party 3 validates it
I'm looking for the cryptographic equivalent of a Drivers license where the issuer can be verified, the issuer doesn't need to know who you showed the drivers license to, but also allows ...
3
votes
1answer
290 views
Elliptic curves for ECDSA
i'm trying to implement parameters generation for ECDSA according to SEC1 v2.0:
Input: The approximate security level in bits = t is {80, 112, 128, 192, 256}
...
3
votes
1answer
148 views
Is there a field guide to ECC for the IT Security layman?
I'm trying to understand ECC from an IT layman's perspective and am trying to separate the theory from the standards, and understand why certain features are implemented or not implemented in the ...
3
votes
0answers
339 views
Elliptic curve cryptography related key attacks
This question is an extension of Families of public/private keys in elliptic curve cryptography
As described above, bitcoin "type 2" deterministic wallets use a root private/public key pair, where ...
2
votes
1answer
217 views
Why are elliptic curve variants of RSA “chiefly of academic interest”?
Yesterday I was thinking about elliptic curve variants of popular protocols/algorithms (ECDH, ECES[1], etc) and the thought occured that I had never seen an elliptic curve variant of RSA. My ...
2
votes
2answers
85 views
How do I unpack the x and y values from the BITSTRING in a DER ECDSA public key?
In ASN.1, the X and Y values for a 256-bit elliptic curve key are stored as a single 66-byte ASN.1 BITSTRING. Are the values just the first and second half of this bitstring?
The private key is an ...
2
votes
3answers
170 views
The utility of elliptic curve cryptography
Suppose that the only public key cryptography schemes that we knew were Diffie Hellman, RSA and ElGamal. How much would this set civilization back? Are there important applications of elliptic curve ...
2
votes
1answer
93 views
How does DJB's nistp224 manage to fit compressed points into 224 bits?
DJB's nistp224 program purports to be an implementation of elliptic curve Diffie-Hellman relative to the standard NIST P-224 elliptic curve.
To the best of my ...
2
votes
1answer
366 views
What does SSL use? RSA? El-Gamal? Elliptic curves?
I'm not sure what SSL uses to share the symmetric key to both end users, i.e. at the beginning of the communication. Is it RSA? Or El-Gamal? Or something else?
Thanks!
2
votes
1answer
45 views
How to derive formulas for addition and multiplication in Jacobian coordinates
Is there a way to derive the formulas for point addition and multiplication on elliptic curves in Jacobian format by yourself? How could I have derived these formulas by myself?
2
votes
1answer
55 views
How are Elliptic Curve Cryptography and Pairing Based Cryptography related?
I have been doing a project that uses the PBC library developed by Ben Lynn. But I am still not clear on how PBC is related to ECC.
I know that this is a site for complex crypto QA, but I did not know ...
2
votes
2answers
333 views
ECC algorithm pollard's $\rho$ complexity
One of the methods to break a ECDLP is Pollard's rho algorithm. When ECDLP is defined over a finite field $F_p$, and given a relation $S=w.T$, where S and T are a member of $F_p$. Then ECDLP is to ...
2
votes
1answer
242 views
Families of public/private keys in elliptic curve cryptography
I'm looking for a related key scheme for elliptic curve cryptography. The basic idea would be that there would be a master public key and a master private key. From the master public key, you could ...
2
votes
1answer
52 views
Discrete logs on elliptic curve with embedding degree 3 with the 'MOV' attack
The curve $E(\mathbb{F}_{47}):y^2=x^3+x+38$ has order $61$ and $61|47^3-1$ so the embedding degree of $E$ is $3$ and therefore the MOV attack, presumably using some sort of distortion map and a ...
2
votes
1answer
105 views
Choosing good parameter for Lenstra's elliptic curve factorization
In Wikipedia, there is an article explaining Lenstra's factorization algorithm. As far as I got it, we choose some $e \in \mathbb{N}$ and a point $P$ on the curve and then calculate $eP$. While ...
2
votes
1answer
69 views
Discrete log analog of ECM factoring algorithm?
Anecdotally, most factoring algorithms have a corresponding variant algorithm that can be used to attack the discrete log problem using similar ideas.
Is there an analog of the elliptic curve (ECM) ...
1
vote
2answers
334 views
Can we use elliptic curve cryptography in wireless sensors?
Can we use elliptic curve cryptography in wireless sensors?
If so, how do you map points to message characters?
1
vote
1answer
181 views
ECIES protocol - what does the || operation mean?
I am studying elliptic curves problems, which also includes study of related protocols such as ECIES. A there is a problem I don't understand operation $||$. What this operation mean?
Some stuff is ...
1
vote
2answers
123 views
ECM Implementation is really slow
I followed the algorithms 14.4 (computes 1st and 3rd coordinates in (X,Y,Z)#k modulo n) and 14.5 (factorization using ECM) in David Bressoud's book 'Factorization and Primality Testing'. I think the ...
