Tag Info

13

Some claim that Curve25519 has 112 bit security, others that it has 128 bit security; which is it? Well, actually, neither - it's actually somewhere in the middle. For a curve without known weaknesses (and Curve25519 doesn't have known weaknesses), then if the curve order has a large prime factor around $2^{2k}$, then the best known attacks against it ...

6

If I understand your question correctly, you are essentially asking if points in Edwards and Montgomery curves can be represented in Weierstrass coordinates. This is true; in fact, any elliptic curve over a prime field can be represented in Weierstrass form $\mathcal{E}_{w}^{a, b} : y^2 = x^3 + ax + b$, and by extension its points can too. The question, ...

5

Any key generation algorithm for any cryptosystem is going to be weak if the attacker can predict what seed was used to generate the key. They can just generate the same key. However, assuming the the random number generator is not that bad, different algorithms start to look different. If you are just using the output of the random number generator as a ...

4

No, Curve25519 signature is not vulnerable to bad RNG during signature generation; that's because Curve25519 signature needs no random number during signature generation. By contrast, in ECDSA, a fresh random number is needed for each signature, and if it gets known, that allows to recover the private key from the signature and public key; same if the same ...

Only top voted, non community-wiki answers of a minimum length are eligible