# Tag Info

9

This is not correct, the private key $d_A$ must always be an integer. Your mistake is that you are doing modular division e.g. $\frac{a}{b} \text{ mod } n$ incorrectly. You cannot simply divide the integers and then reduce by the modulus. The correct way to do this is to compute the modular inverse of $b$ i.e. $b^{-1} \text{ mod } n$ and then compute $a*b^{-... 7 What's missing is the authentication of the entities. If you don't authenticate the entity then you don't know who you've established the master secret with. This means an attacker can pose as a man in the middle or the attacker can simply act as one of the entities. You can use static DH key pairs, but in that case the DH public keys must be trusted and ... 7 Actually, you can recover$n$from ECDSA signatures (assuming that you can obtain several signatures with the same$k$value, which means that the ECDSA signature implementation is broken); however it would require 3 such signatures (if you don't mind factoring a value circa$n^2$), or 4 such signatures (if you don't have that many resources conveniently at ... 3 As far as I know, the elliptic curve order$n$(which denotes the number of points on the curve) cannot be recovered from ECDSA signatures. It is a public data and if you know which elliptic curve has been used to sign the messages, then you should not have trouble to find it. There are several methods to determine$n$from the curve equation. If you want ... 3 What you actually want is called a key-based key derivation function (KBKDF). The most prominent KBKDF (and really the standard solution here) is HKDF. This is a function that takes a secret key (e.g. a KEK or a root key or something) and outputs (a set of) derived keys enjoying some nice properties. You can customize the keys to get different keys for ... 2 This does indeed appear to be a typo. Using that$e_mis bilinear and alternating, one calculates \begin{align*} F_W(a,P_b,Q_c) \;&=\; e_m([b]P,[c]Q)^a \\&=\; e_m(P,Q)^{abc} \\&=\; e_m(Q,P)^{-abc} \\&=\; e_m([b]Q,[c]P)^{-a} \\&=\; F_W(a,Q_b,P_c)^{-1} \text. \end{align*} (However, note that these are only different if the order of...

1

First of all, you would probably want to put the shared secret into a KDF even if you have enough bits to use it in a symmetric encryption algorithm. Check these two related posts: Key Derivation Function (KDF): Can a key derived from KDF be considered as a secure key? and How to derive a symmetric key from ECDH shared secret? So, the question: Is there ...

1

Proposition One-wayness of ElGamal encryption holds under the Computational Diffie-Hellman (CDH), and conversely. CDH Problem (informally) Given $(P, [r]P, [s]P)$ find $[rs]P$. Let the public key be $Q = [s]P$ where $s$ is the corresponding secret key. Let also a ciphertext $C = (C_1, C_2)$ with $C_1 = [r]P$ and $C_2 = M + [r]Q$ for a message $M$ (...

1

First a preliminary: a base point $G$ on an elliptic curve generates a group of points on the curve such that every point in that group can be written as $dG$ ($d$ times $G$) where $d$ is an integer. This group is also cyclic in that for a certain value $q > 1$ we have that $qG = \mathcal{O}$, where $\mathcal{O}$ is the identity element, known as the ...

Only top voted, non community-wiki answers of a minimum length are eligible