# Tag Info

3

I'll answer the related questions in order: No, because a ciphertext (generated from a key stream generated by a stream cipher) should be indistinguishable from random data, and a MAC should be as well. No, because #1 depends on the secret, and the secret was derived using a Diffie-Hellman key agreement algorithm, using the given curve. To know ...

3

It all comes down to your threat model, right? Just because an implementation is done in hardware does not mean that power and fault attacks must be considered. If I host the hardware in my secure facility with armed guards at the door, but the hardware is connected to a machine which is connected to the internet, I might feel that it is okay to not be ...

2

It refers to the bit length of the order of the elliptic curve group (number of points on the curve). The security of a curve is equal to the square root of its order. So we pick values that are twice as long as the security level we want (160-bit for 80-bit security, 256-bit for 128-bit security, etc) We don't use 100-bit curves because we prefer security ...

2

The twist attack is best explained in Fouque et al's paper. While the (quadratic) twist of the curve $E : y^2 = x^3 + ax + b \in \mathbb{F}_p$ is indeed of the form $E^t : y^2 = x^3 + d^2ax + d^3b \in \mathbb{F}_{p}$ for nonsquare $d$, you can also think of the twist as the set of points $(x, y)$ in $E^2 : y^2 = x^3 + ax + b \in \mathbb{F}_{p^2}$ where $x$ ...

2

I don't consider the following a complete answer, but it is a start, and best I can do with my very limited knowledge. I hope someone could fix it or improve it. These type of attacks are only possible against specific implementation of higher level protocols. I will start by describing an invalid-curve attack against a specific ECDH based protocol. ...

2

I need a small clarification that why openssl using SHA1 in ECC when I am using secp384r1 curve, but in rfc they are saying we should use SHA2. OpenSSL uses SHA-1 because RFC 4492 defines the use of ECC on SSL with SHA-1. It should also support SHA-384 as defined in RFC 5289. Which hash algorithm is used in TLS depends on the cipher suite. For example: ...

2

When you go from Affine to Jacobian, $X$ and $Y$ stay the same, and $Z$ is equal to $1$ Affine -> Jacobian: $(X',Y',Z') = (X,Y,1)$ Jacobian -> Affine: $(X',Y') = (\frac{X}{Z^2}, \frac{Y}{Z^3} )$

1

The sect curves are curves over a binary field. From SEC 2: Recommended Elliptic Curve Domain Parameters (chapter 3): The example elliptic curve domain parameters over $\mathbb{F}_{2^m}$ have been given nicknames to enable them to be easily identified. The nicknames were chosen as follows. Each name begins with sec to denote ‘Standards for Efficient ...

1

An elliptic curve to be used in cryptography is defined over a finite field $\mathbb{F}_p$ (but also can be a binary polynomial finite field $\mathbb{F}_{2^m}$). The bit length of this $p$, or the $m$ in the case of the binary polinomials, is what is used later to describe the elliptic curve in terms of size.

Only top voted, non community-wiki answers of a minimum length are eligible