# Tag Info

4

What's difference between n & #E(FP)? The difference is that $n$ is the smallest positive integer where $nG = O$; while you correctly state that $\#E \cdot G = O$, that doesn't mean that $\#E$ is the smallest integer that makes this happen. There may be a smaller integer $n$; $n$ will always be a factor of $\#E$, however it can be smaller. As for ...

3

In a group of size $n$ (e.g. an elliptic curve), the order of a subgroup generated by a group element necessarily divides $n$. We usually choose curves so that their order $n$ is prime; in that case, the order of a point must be either $1$ (the point is the "point at infinity") or $n$ (all other points). Thus, if $n$ is prime, then every non-zero point is ...

3

I'll answer the related questions in order: No, because a ciphertext (generated from a key stream generated by a stream cipher) should be indistinguishable from random data, and a MAC should be as well. No, because #1 depends on the secret, and the secret was derived using a Diffie-Hellman key agreement algorithm, using the given curve. To know ...

2

The twist attack is best explained in Fouque et al's paper. While the (quadratic) twist of the curve $E : y^2 = x^3 + ax + b \in \mathbb{F}_p$ is indeed of the form $E^t : y^2 = x^3 + d^2ax + d^3b \in \mathbb{F}_{p}$ for nonsquare $d$, you can also think of the twist as the set of points $(x, y)$ in $E^2 : y^2 = x^3 + ax + b \in \mathbb{F}_{p^2}$ where $x$ ...

2

I don't consider the following a complete answer, but it is a start, and best I can do with my very limited knowledge. I hope someone could fix it or improve it. These type of attacks are only possible against specific implementation of higher level protocols. I will start by describing an invalid-curve attack against a specific ECDH based protocol. ...

2

I need a small clarification that why openssl using SHA1 in ECC when I am using secp384r1 curve, but in rfc they are saying we should use SHA2. OpenSSL uses SHA-1 because RFC 4492 defines the use of ECC on SSL with SHA-1. It should also support SHA-384 as defined in RFC 5289. Which hash algorithm is used in TLS depends on the cipher suite. For example: ...

2

Take a point $G$ on the elliptic curve $E$. Someone calculates point $P = h*G$ where $h$ is some secret number (this can be done with point addition and duplications fast). Your task: Given public points $P$ and $G$ and curve $E$, find the secret $h$. Solving this problem is hard. That is the problem that makes elliptic curves secure. Does a larger n ...

1

It means that $n$ is the order of the elliptic curve group, that is, the number of points in that group. The private key in ECC is a scalar value $k$ where $1 \leq k \lt n$. A larger $n$ implies a higher security level. The size of $n$ should be twice your expected security level in bits e.g. a 256-bit $n$ for 128-bit security.

Only top voted, non community-wiki answers of a minimum length are eligible