# Tag Info

7

It happens that a line usually (not always) cuts three points in a elliptic curve by the Bezout theorem. This is the case for the points and the curve you are asking for. So the sum of two points are defined like the inverse of the third point intercepted by the line that cut $P$ and $Q$ (let's name it $R$). So we need to find $-R$ because $P+Q=-R$ by ...

6

Actually, it is not possible to uniquely recover the public key from an ECDSA signature $(r,s)$. This remains true even if we also assume you know the curve, the hash function used, and you also have the message that was signed. However, with the signature and the message that was signed, and the knowledge of the curve, it is possible to generate two ...

6

The tangent line at point $P(x_1,y_1)$ is: $\frac{\partial f}{\partial x}(x-x_1)+\frac{\partial f}{\partial y}(y-y_1)$ Solving differentials, we obtain: $\frac{\partial f}{\partial x}=3x^2+2x$ $\frac{\partial f}{\partial y}=-2y-1$ For $x_1=0$ and $y_1=0$ we have: $\frac{\partial f}{\partial x}=3x^2+2x = 0$ $\frac{\partial f}{\partial y}=-2y-1 = -1$ ...

4

Given a EC public key, can a different, but plausible and functional private key be derived to match the public key? No, a public key will correspond to only one private key (with one minor exception, which I will explain below). With Elliptic Curve systems, the private key is an integer $d$ between 1 and $q$ (the order the generator point $G$), and ...

3

If you want $N$ serial numbers, your serial numbers will have to use $n$ bits for uniqueness, where $n = \log_2 N$. So if you have 100 bits to use for the serial, you could use 20 to get about a million serials and have 80 bits to use for a cryptographic MAC or signature. Now there are two approaches, the symmetric and the asymmetric. In the symmetric ...

3

As @poncho says, both keys $Q_1=r^{-1}(sR-zG)$ and $Q_2=r^{-1}(sR'-zG)$ will validate the given signature, i.e., $(s^{-1}zG+s^{-1}rQ_i)_x=r\mod{n}$. For some curves, with small but non-zero probability, we have $n\leq(kG)_x<p$, and neither $Q_1$ nor $Q_2$ will validate other signatures made with the original private key $d$. However, by Hasse's theorem, ...

2

Yes, the same keypairs can be used to derive shared secrets between multiple pairs of parties. If knowing the shared secret between Alice and Bob would help Eve find out the shared secret between Alice and Carol, Eve could just create her own random private key and calculate a "shared" secret between that key and Alice's public key to get the same ...

2

Pairings in cryptography is a very important tool, the introduction of which has developed a new field, that is pairing-based cryptography. After the independent pioneering work by Joux and by Sakai et al.("Cryptosystems based on pairing"), many pairing-based crypto-systems emerged. In cryptography, pairings are often treated as "black-box", and then we ...

2

The cyclic group over the ECDLP problem is posed is a subset of the set of point of the elliptic curve. That is to say, not all the points in the referred curve will be in the cyclic group. What you've called as $G$ confuses with another notation of the generator of a cyclic group $<G>=\{G,[2]G,\cdots,[n]G=\mathcal{O}\}$. This is the meaning of what ...

2

You'll get back the same point; however it may be a different representation of the same point. Remember, an elliptic curve point is a solution to a cubic equation in two variables (or the point at infinity); one commonly used equation is $y^2 = x^3 + ax + b$ modulo a large prime $p$. What projective coordinates do is encode the $x$ and $y$ coordinates of ...

2

SafeCurves lists some ways to compare the security of elliptic curves. Their security criteria are split to "ECDLP security" and "ECC security". Failing the former basically means "there is no way to use this curve securely in general" while the latter "it is difficult to implement this curve securely". None of the (few) BouncyCastle-supported curves that ...

2

You may probably use any curve you like, depending on your special requirements (environment, computational aspects, ...) and the curves implemented by your library (see otus answer refering to some concrete security findings related to specific elliptic curves, and how sensible they are to certain attacks). The reason why the curves are pre-computed, is ...

2

You can do it with two machines. https://www.iacr.org/archive/crypto2001/21390136.pdf (this paper is for DSA; it's easy to adapt for ECDSA). Here's an open-source JavaScript implementation of two-party ECDSA signing, using Bitcoin parameters: http://www.jpaulgossip.com/demo/split-key.html Unfortunately the protocol requires at least three rounds of ...

1

A classical resut is that over a finite field $\mathbb{F}_p$ the group $E(\mathbb{F}_p)$ is either cyclic or isomorphic to the product of two cyclic groups. For the order of the group see this question. For cryptographic purposes, i.e., when you require that the ECDLP is hard, you will firstly have to rule out some weak curves (supersingular or anomalous ...

1

Such keys are called static keys. Keys that are newly generated each time are called ephemeral keys. Note that you need to trust the public keys of the key pairs to use them for authentication. Please note that there is an issue if you use static keys only for plain Diffie-Hellman: the generated secret will be static as well, as the whole scheme has now ...

Only top voted, non community-wiki answers of a minimum length are eligible