# Tag Info

5

Yes, there are a few reasons to prefer ECDH over RSA: ECDH will perform much better; ECDH provides forward security (without a large performance overhead), i.e. you cannot brute force the session key after eavesdropping (it's calculated at both sides, not send encrypted); ECDH should be impervious to most oracle attacks, i.e. timing based padding oracle ...

2

This may be off-topic since it is really about OpenSSL... For your question 1, the values you get are the prefix 04 (which indicates that the point is represented in uncompressed form) followed by the $x$- and $y$-coordinates of the generator. Here you have 97 bytes, so eliminate the first byte and then you have both coordinates, which take 48 bytes each. ...

2

ECKEY object may contain: Group Private key Public key Both Group and Private key are needed to be able to calculate signature. It is most convenient to use generic ECKEY object (from API perspective), as it easy to e.g. convert between commonly used PKCS#8 PEM encoded EC private keys and ECKEY objects, and because just a BIGNUM would not be sufficient. ...

2

The protocol seems secure. Some comments below. Bob computes the DH shared secret X using his private key and Alice's static public key, and then K(X), the result of applying an appropriate key derivation function (KDF) to the combination of A, B, and X. The DH secret X already depends on both key-pairs. Including the public keys in key ...

1

You forgot to mention one additional advantage of elliptic curves: the generation of keys is much faster than with RSA. In europe, many government smart card solutions are now based on ECC: The european electronic pass ports The Austrian card The German ID card The new German health insurance card

1

The general case is that of field extension. Given a field $\mathbb{F}_q$ of $q$ elements (in your case, the field is $\mathbb{Z}_p$, the integers modulo a prime $p$), you want to define and do computations in a field $\mathbb{F}_{q^k}$ of $q^k$ elements for some integer $k > 1$. To do so, one first considers $\mathbb{F}_q[X]$ which is the ring of ...

1

The web site of https://ellipter.com says, they are using encryption.

1

Bernstein and Lange regard any curve in Weierstraß form as "not safe" because they assume, implementers of ECC with these curves will make stupid mistakes. You can see a more detailed discussion on this point here:Safety of ECC-point addition. So you should pick a subset of their criteria if you want the Weierstraß form(I don't see any reason not to). IMHO ...

1

There is an easier and more generally applicable method than the RSA specific method poncho explained: Fix a universal "key" for your format, e.g. "42". Encipher the complete header including the RSA Modulus, ID, Name and whatever else the previous setters of the standard deemed indispensable using e.g. aes or threefish. You might wish to fix a universal ...

1

Elements of finite fields don't really have a sign. But depending on context you can define a property that's different for $x$ and $-x$ (when $x$ is not $0$) and call that property sign. Some possible choices: A number is called a square (or Quadratic residue) if there is another number which produces it when squared. Since positive real numbers are ...

1

Saying that ECDH does not do authentication is not entirely accurate. If you use ECDH with static, known public keys and both sides prove knowledge of the shared secret, then you do get authentication. However, with ephemeral keys you need some way to authenticate the exchange of public keys. That could be ECDSA or it could be any other authentication. So ...

Only top voted, non community-wiki answers of a minimum length are eligible