# Tag Info

4

Such an operation is possible. The ways of calculating that appear to be different for each curve.

2

You will need a quadratic non-residue in order to decompress the points, and there is no known deterministic algorithm that will provably find one efficiently. Also, if you allow both sign bits for $\: y=0 \:$ or the point-at-infinity, then you will lose non-malleability and strong unforgeability.

1

A while back I suggested a crowdfunded review of ECC patents that would be authoritative, complete, published, and freely available with the goal of clearing the air so the community can make informed decisions about what's patented and what's free to use. Had some interest, but no commitments. Drop me a line if interested in making this happen. ...

Only top voted, non community-wiki answers of a minimum length are eligible