60
votes
Why Curve25519 for encryption but Ed25519 for signatures?
While it is true that Elliptic Curve Diffie Hellman (ECDH), Elliptic Curve Signature Generation (ECDSA), and Elliptic Curve Signature Verification rely on scalar multiplications, these are usually ...
44
votes
Accepted
ECDSA, EdDSA and ed25519 relationship / compatibility
Ed25519 is a specific instance of the EdDSA family of signature schemes. Ed25519 is specified in RFC 8032 and widely used. The only other instance of EdDSA that anyone cares about is Ed448, which is ...
43
votes
Accepted
Why is it not possible to increase the size of RSA keys indefinitely?
I've never heard that RSA becomes less secure when the modulus grows. Obviously the strength doesn't grow as fast as the number of bits, but that only means that it grows sub-exponentially.
If it ...
37
votes
Why Curve25519 for encryption but Ed25519 for signatures?
The old terminology was confusing, so they've rebranded a bit.
X25519 is Elliptic Curve Diffie-Hellman (ECDH) over Curve25519
Ed25519 is Edwards-curve Digital Signature Algorithm (EdDSA) over ...
34
votes
Accepted
What does "birational equivalence" mean in a cryptographic context?
I feel that as it was my comment, I am obliged to answer this :-).
First of all, birational equivalence is really a geometric notion. As far as I know, there is no analogue for groups, rings or ...
34
votes
Accepted
Curve25519 over Ed25519 for key exchange? Why?
There's a few different related parts here, and the nomenclature of the library you've cited is a little confusing.
Curve25519 is an elliptic curve over the finite field $\mathbb F_p$, where $p = 2^{...
30
votes
Accepted
What is an elliptic curve cofactor?
In cryptography, an elliptic curve is a group which has a given size $n$. We normally work in a subgroup of prime order $r$, where $r$ divides $n$. The "cofactor" is $h = n/r$.
For every ...
29
votes
Accepted
Is there any difference between NIST and SECP curves in-terms of their algorithms and implementation?
Please check https://tools.ietf.org/search/rfc4492 - espessially, the "Appendix A. Equivalent Curves (Informative)" part.
For example: NIST P-256 is refered to ...
29
votes
How effective is quantum computing against elliptic curve cryptography?
Elliptic curve cryptography is not presently vulnerable to quantum computing because there are no quantum computers big and reliable enough to matter.
But it would be vulnerable to quantum computers ...
26
votes
Why is it not possible to increase the size of RSA keys indefinitely?
I don't understand at all what this claim is on the website. The claim that RSA becomes very expensive for large $N$ is true, but to say that the gap between encryption/decryption cost and factoring ...
26
votes
Summarize the mathematical problem at the heart of breaking a Curve25519 public key
Six-word summary: the elliptic-curve discrete log problem.
$\newcommand{\F}{\mathbb{F}}\newcommand{\Z}{\mathbb{Z}}$Summary with math: Given $x(A)$ and $x(P)$ for two points $A$ and $P$ on the elliptic ...
26
votes
ECDSA Signature R|S to ASN1 DER Encoding question
The ASN.1 DER format is deterministic; i.e. there is only a single sequence of bytes that validly encodes given $r$ and $s$ values. Mind the details, though: the encodings of $r$ and $s$ are minimal-...
26
votes
Accepted
Difference between X25519 vs. Ed25519
Is X25519 and Ed25519 the same curve?
No. X25519 isn't a curve, it's an Elliptic-Curve Diffie-Hellman (ECDH) protocol using the x coordinate of the curve Curve25519. Ed25519 is an Edwards Digital ...
25
votes
Current mathematics theory used in cryptography/coding theory
Finite fields - which is a branch of algebra - is a must. It is, in some way, used in almost all types of cryptographic algorithms.
Also, you need some sort of basic programming ability since you ...
25
votes
Which elliptic curves are quantum resistant?
Post-quantum crypto is a very young field and is still changing quite rapidly. If you just want a reading list to introduce you to the topics, I would recommend the March 2015 report released by the ...
25
votes
Accepted
After ECDH with Curve25519, is it pointless to use anything stronger than AES-128?
The reasoning is wrong, because the scaling of attacks on AES is qualitatively different from the scaling of attacks on X25519.
A successful multi-target attack on a system using AES-128—that is, an ...
24
votes
Accepted
Why is there the option to use NIST P-256 in GPG?
Because P-256 is the most used elliptic curve and there are no certain reasons to believe it's insecure.
It's the first standardized curve at the 128 bit security level (which is very popular).
The ...
24
votes
Accepted
Is there a situation where RSA cannot be replaced with ECC + symmetric algorithms? If no, why do we still use it?
Summary: ECC+symmetric algorithms can do almost anything RSA+symmetric algorithms commonly do (plus forward secrecy where RSA struggles). But RSA is often preferred, sometime rightly so, in particular ...
23
votes
Accepted
How many qubits are required to break RSA 2048 or 4096 with a universal quantum computer?
How many qubits are required for breaking RSA 2048 and RSA 4096 in real-time with a quantum computer?
Like the answer you linked to shows, about $\log_2(N^2) = 2 \log_2(N)$ or just $2n$ where $n$ ...
23
votes
Accepted
What is the curve type of SECP256K1?
There are curve types, and equation types.
As algebraic objects, all curves can be expressed with a "Weierstraß equation". Through some changes of variables, that equation can be simplified into a "...
22
votes
Ed25519 is a signature or just elliptic curve
Your short answer is this: ed25519 is both a signature scheme and a use case for Edwards-form Curve25519. EDDSA generalises this signature scheme to any curve in edwards form (for example Ed448-...
22
votes
Accepted
What is the relationship between p (prime), n (order) and h (cofactor) of an elliptic curve?
The prime $p$ is chosen to make arithmetic in a choice of field $k$ efficient. Typically $k = \mathbb F_p$ or $k = \mathbb F_{p^2}$. Popular choices of $p$ are near powers of two, e.g. the Mersenne ...
21
votes
Accepted
Why can an elliptic curve private key be 1?
By the same argument, they would have to forbid $d = 1234$; after all, an attacker can trivially compute the value of $1234 G$; and if they see it, then they can immediately infer $d$ without having ...
20
votes
Accepted
RFC6979: error in reference implementation?
The RFC specifies things in terms of bits. Each call to HMAC outputs hlen bits. tlen is the count of bits obtained so far; when ...
19
votes
Accepted
What is the projective space?
Let us consider this beautiful elliptic curve:
She is defined in a plane ($\mathbb{R}^2$).
1. From a plane to a projective space
For an affine plane $\mathbb{A}^2 = \{(x,y): x,y \in \mathbb{K}\}$, we ...
19
votes
Accepted
Why is Curve25519 in the GPG “expert” options?
The risk mainly resides in compatibility.
See, not all GPG users/systems are updated to the latest version. If you look at the GPG changelogs, you'll notice ECC was first introduced to GPG with ...
19
votes
Accepted
When adding two points on an elliptic curve, why flip over the x-axis?
If we did not make the final reflection, point multiplication would not be associative, we would not have a group, and we thus could not define a scalar multiplication the way we do, with the property ...
19
votes
Accepted
How can there be insecure elliptic curves if the discrete logarithm problem is hard?
Discrete Logarithm on elliptic curves is hard in the following sense: on an $n$-bit curve, solving DL has cost $2^{n/2}$. Thus, this is infeasible only as long as $n$ is large enough to make that cost ...
18
votes
Can I still use insecure curves/ciphers for time relevant encryption?
Let's assume I need to encrypt data only for one minute, after that time the data is useless. Couldn't I still use ECC2K-130 as it would require 525600 times more PlayStations to crack it in a single ...
Only top scored, non community-wiki answers of a minimum length are eligible
Related Tags
elliptic-curves × 2184public-key × 270
diffie-hellman × 224
dsa × 217
signature × 149
discrete-logarithm × 133
pairings × 123
finite-field × 119
encryption × 118
elliptic-curve-generation × 113
rsa × 106
ed25519 × 96
group-theory × 82
key-exchange × 63
modular-arithmetic × 59
implementation × 58
secp256k1 × 56
cryptocurrency × 54
post-quantum-cryptography × 49
hash × 47
elgamal-encryption × 46
cryptanalysis × 45
keys × 39
zero-knowledge-proofs × 38
algorithm-design × 35