# Tag Info

8

If that were possible, that is, if you could take an x-coordinate, and find the private key $k$ such that $kG$ has that x-coordinate, well, you've just solved the discrete log problem. If you can do that, you've just shown that the curve is insecure. If you're thinking "I'm not specifying the y-coordinate; doesn't this make it easier than the discrete log ...

7

ECC is indeed used by CloudFlare's website but only for the session key agreement. The authentication is performed using an RSA 2048 bit private key. The corresponding RSA public key is in the certificate. In other words, although ECC is being used, it is not used for authentication and therefore not part of the certificate. The ciphersuite is: ...

5

We, for the most part, don't bother with elliptic curve-based pseudorandom generators. DUAL_EC_DRBG was shoehorned into a NIST standard that also included a block cipher generator, CTR_DRBG, and two hash-based ones—Hash_DRBG and HMAC_DRBG—that are actually used in the field. Number-theoretic generators, which include Blum-Blum-Shub, DUAL_EC_DRBG, and ...

4

The formulae on the linked page deal with curves in short Weierstraß form, that is $y^2=x^3+ax+b$. Your curve is not given in this format. You can find the correct formulae for long Weierstraß curves (like yours, where the coefficients $a_1$ and $a_3$ are zero) on this page.

4

All of these are answered by the SafeCurves project: $x^2 + y^2 \equiv 1 + dx^2y^2 \pmod p$ Edwards curves can be converted to Montgomery form.Montgomery curves can be converted to Weierstrass form.Some, but not all, Weierstrass curves can be converted to Montgomery form. The Montgomery ladder (applicable only to Edwards and Montgomery curves) is faster ...

3

Ed25519 needs two secret values: The private scalar (~256 bits) A hash prefix used derive a secret nonce from the message (256 bits) Using the same value for these is bad style, as is deriving one of them from the other. You could also use their concatenation as private key, but that'd double its size to 512 bits. So Ed25519 chose the clean solution of ...

3

The Supersingular Elliptic Curve Isogeny Key Exchange that you refer to was first published in 2011 by DeFeo, Jao, and Plut. It builds on but is quite distinct from earlier work by Rostovetsev and Stolbunov in 2006. As a Post Quantum/Quantum Safe replacement for Elliptic Curve Diffie-Hellman (ECDH) it has several good properties: The number of bits that ...

2

The simplest construction that I know of is given in Section 6.9 of the book by Hoffstein, Pipher and Silverman (5.9 in the first edition). I also talk about it in Section 3.3 of this (but I do not claim that it matches the book's quality of exposition). First, you need a prime $p$ with two properties: You want $p\equiv 2\pmod 3$, this allows you to ...

2

Poncho's answer explains why finding a specific $Q$ in $Q = k x G$ is not feasible. If you could do this so could anyone else for any keypair and ECC would have no security. The short answer is ECC is secure specifically because there is no known method short of brute force to find $k$ for a given $Q$. Of course an exhaustive search (brute force) is always ...

2

Good blinding requires good randomness. Randomness is a hard requirement, especially for embedded systems. In a similar vein, the DSA and ECDSA signature algorithms require a strongly random integer (called k) for each signature, and several implementations have failed to use random enough values, with hilarious consequences; the most well-known case is Sony ...

1

As Samuel Neves described in the comments it is trivially possible to obtain $P$ from $Q=nP$, given $Q$ and $P$. Simply compute $k=n^{-1} \bmod l$, with $l=|E(\mathbb F_p)|$ being the order (=the number of points) of the curve. $l$ is usually known. Then, to obtain the desired point $P$, calculate $P=kQ=knP$ and you're done.

1

Curve25519 was supposed to be mainly used for Diffie-Hellman key-exchange and it provides ~128bit security and should fulfill all standard security assumptions on elliptic curves (and even some more). Now to answer the question is: yes. ElGamal can be used securely with Curve25519, as ElGamal is simply a Diffie-Hellman key-exchange ($\delta= m*g^{\alpha ... 1 No, it's not a problem. What you've found is known as the square computational diffie-hellman problem(SCDH) and it can be shown that this is equivalent to the computational diffie-hellman problem(CDH). For completeness: SCDH: Given$g$(your$G$) and$g^x$(your$Q$), find$g^{x^2}$(your$d_A^2G$). It is shown here that this problem is as hard as the ... 1 Of course there are others. Of interest might be the paper 'Efficient ephemeral elliptic curve cryptographic keys' by Mieli and Lenstra, which claims to generate fresh Elliptic Curves sufficiently quickly that they can be created on the fly for a single ECDH exchange, and then discarded. 1 The inventors of the Supersingular Isogeny Key Exchange, Defeo, Jao and Plut have posted some code on GITHUB at: https://github.com/defeo/ss-isogeny-software/ There is also a paper on implementation of this key exchange by some people from the University of Waterloo. Their paper is "Efficient Implementations of A Quantum-Resistant Key-Exchange Protocol on ... 1 poncho has it right, I was calculating the inverse incorrectly. The inverse of a point$(x,y)$is$(x, -y)$. It just so happens that$(x,y) + (x, y^{-1}) = 0\$, but this was a red herring. Thanks!

1

lm = nm; low = nw; hm = lm; high = low; You're setting hm = nm since lm = nm. Correct is: hm = lm; lm = nm; high = low; low = nw;

1

Two approaches to Post Quantum Key Exchange that have acceptable bandwidth requirements are the NTRU/Ring-LWE lattice designs and the ECC Isogeny Key exchange you mention. Since the UK spy agency published an attack on a lattice based scheme they had designed, there has been an active discussion between Dan Bernstein and the Lattice Cryptographers over the ...

Only top voted, non community-wiki answers of a minimum length are eligible