# Tag Info

14

Let's assume that everyone agreed on some elliptic curve and a public base point $g$ somewhere on the curve. When two parties Alice and Bob want to agree on a shared secret, they proceed as follows: Alice chooses some random number $a$ and applies the curve operation to $g$, the public base point, $a$ times. She obtains some result ...

14

The answer is about the difficulty of discrete logarithm. The notion of isomorphism does not capture all that matters in cryptography; we also need to consider computing costs. Suppose that we have an abelian group $\mathbb{G}$ with additive notation. Let $G$ be a conventional element of $\mathbb{G}$ of order $n$. The subgroup generated by $G$ is: $$\langle ... 8 The main difference is that secp256r1 is a prime field curve, while secp256k1 is a Koblitz curve. Koblitz curves are known to be a few bits weaker than prime field curves, but since we are talking about 256-bit curves, neither is broken in "5-10 years" unless there's a breakthrough. The other difference is how the parameters have been chosen. In secp256r1 ... 8 Let's recall how discrete logarithms are solved in strong elliptic curve groups. The basic idea is to iteratively walk through many combinations of the form x_i = a_iP + b_iQ until we find a distinguished one, i.e., one that shares some common property (like the lowest k bits of x_i set to 0). We accumulate enough distinguished points until we find a ... 8 If that were possible, that is, if you could take an x-coordinate, and find the private key k such that kG has that x-coordinate, well, you've just solved the discrete log problem. If you can do that, you've just shown that the curve is insecure. If you're thinking "I'm not specifying the y-coordinate; doesn't this make it easier than the discrete log ... 7 Your problem seems to be at least as hard as the 2-weak Bilinear Diffie-Hellman Inversion Problem (2-wBDHI problem): Given g, g^x, g^{x^2}, g^y \in \mathbb G, and T \in \mathbb G_T to determine whether or not T = e(g,g)^{x^3 y}. Proof: We first need to define an equivalent version of your problem, where we take some generator h so g = h^b. ... 7 These are "red flags". No one knows of a specific exploit, only some possible reasons to be concerned that one might exist. Since no one knows of a specific attack, we can't possibly know how much speedup such a hypothetical attack might allow. Basically, you're asking for speculation where there is not enough information to allow meaningful speculation, ... 7 ECC is indeed used by CloudFlare's website but only for the session key agreement. The authentication is performed using an RSA 2048 bit private key. The corresponding RSA public key is in the certificate. In other words, although ECC is being used, it is not used for authentication and therefore not part of the certificate. The ciphersuite is: ... 6 I don't know about computing things in parallel, so I will ignore that part of the question. First, please note that the encryption algorithm is rarely the the weak point of the security. It is far more likely that you will have problems with the implementation, some spyware installed on your computer, a weak password (If you use qwerty as your password, ... 6 The real question isn't "Why doesn't Suite B use P-521?" It is, "Why doesn't Suite B use AES-192?" NSA were only interested in 192-bit security for Suite B, but they chose to use AES-256 because AES-192 wasn't widely supported. "In fact we had wanted to use AES -128 and AES-192, but a quick survey of AES implementations (hardware centric, I believe) ... 6 It mainly depends on how the algorithm was selected. If it was selected by a public competition like for AES, then it is likely to be secure. If it was forced in by the NSA such as Dual-EC random number generator, then you may have some doubts. Other questions you may want to ask yourself are: Is this an "original" algorithm or was the problem that it ... 6 Your second equation seems a bit off. In the curve of equation:$$ y^2 + cy = x^3 + ax + b $$in a binary field \mathbb{F}_{2^m}, to add point P_1 = (x_1,y_1) to point P_2 = (x_2,y_2), resulting in point P_3 = (x_3,y_3), then the two equations are: \begin{eqnarray*} x_3 &=& \lambda^2 + x_1 + x_2\\ y_3 &=& \lambda (x_1+x_3) + y_1 + c ... 6 In the basic fixed window method of performing point multiplication, we compute the value nP (where n is the integer we're multiplying by, and P is the basis point) by finding the base b representation n = d_k b^k + d_{k-1} b^{k-1} + ... + d_1 b^1 + d_0 b^0 (where 0 \le d_i < b), and then computing first 1P, 2P, ..., (b-1)P and then nP = ... 6 First off, your equation is correct and there seems to be no calculation mistake. To understand on how to get from$$(2+d)x^{2}+dy^{2}=d+(d-2)x^{2}y^{2}$$to$$x^{2}+y^{2}=1+e\cdot x^{2}y^{2}$$one first needs to observe that e=(d-2)/(d+2)=121665/121666 holds. The next step is to consider: "What operations are actually allowed with birational ... 5 Trevor Perrin wrote a library doing exactly that. Explanation can be found on in the curves mailing list archives. To convert a Curve25519 public key x_C into an Ed25519 public key y_E, with a Ed25519 sign bit of 0:$$y_E = \frac{x_C - 1}{x_C + 1} \mod 2^{255}-19$$The Ed25519 private key may need to be adjusted to match the sign bit of 0: if ... 5 Now to calculate Q this will take a lot of time since it means I will need to perform point addition an insane number of times unless I'm not understanding something about it. You're missing a point; elliptic curve point addition is associative; that is, for any three points A, B, C, we have:$$(A + B) + C = A + (B+C) Now, why is this a big deal? ...

5

In short: the question does not explain well the notion of asymmetry in ECC; and the exposition is not how Elliptic Curve Cryptography works. A reasoning sidestepping the notion of Discrete Logarithm Problem over a finite group can not really explain asymmetry as meant in ECC. Asymmetry is in the knowledge Alice and Bob have about the key, not asymmetry of ...

5

Non-Adjacent Form (NAF), also called Balanced Binary Representation (BBR), is a representation of integers reminiscent of binary, but with an extra $-1$ value for digits, and such that at least one of two adjacent digits is $0$. Because the resulting representation has at least half of its digits at zero (typically about $2/3$), it can be used to speed-up ...

5

To generate your pair of keys with elliptic curves first you have to chose your domain parameters (I think this name may comes from the P1363 naming convention, or perhaps it's previous). Those domain parameters will be public. For example for curves over finite fields those parameters are: ${p,a,b,G,n,h}$. The lower level operations will be made in ...

5

We, for the most part, don't bother with elliptic curve-based pseudorandom generators. DUAL_EC_DRBG was shoehorned into a NIST standard that also included a block cipher generator, CTR_DRBG, and two hash-based ones—Hash_DRBG and HMAC_DRBG—that are actually used in the field. Number-theoretic generators, which include Blum-Blum-Shub, DUAL_EC_DRBG, and ...

4

First secp256r1 is a random and secp256k1 is a Koblitz curve. So according to this article: Koblitz curves should be avoided, [...] as they does not have enough warranty on crypto analytic activity and effectively they are: Not part of NSA Suite-B cryptography selection Not part of ECC Brainpool selection Not part of ANSI X9.62 selection ...

4

Both curves have similar form and primes close to powers of two ($2^{192}-2^{64}-1$ and $2^{224} - 2^{96} + 1$), so you wouldn't expect large differences in performance – all things equal, P-224 might be anywhere from 30% to 60% slower due to the computational scaling of curve operations. However, in practice different implementations will have different ...

4

What's difference between n & #E(FP)? The difference is that $n$ is the smallest positive integer where $nG = O$; while you correctly state that $\#E \cdot G = O$, that doesn't mean that $\#E$ is the smallest integer that makes this happen. There may be a smaller integer $n$; $n$ will always be a factor of $\#E$, however it can be smaller. As for ...

4

In the usual definition of security of Elliptic Curves, curve25519 security is in fact 126 bits. If look at safecurves's rho page you can see the rho complexity for curve25519 is $2^{125.8}$ in accordance to what you say. Curve25519 author basically doesn't accept that definition of security. In the Curve25519 paper he states in section 1: Every known ...

4

After a multiplication you have a number with $2 \cdot 255$ bits. Since $2^{255} = 19 \pmod q$, you can take the upper half, multiply it by 19 and add it to the lower half. This gives you an equivalent number smaller than $20 \cdot 2^{255}$. Repeat this to get a number that's smaller than $2 \cdot q$. Now check if the value is greater or equal to $q$ and ...

4

Such an operation is possible. The ways of calculating that appear to be different for each curve.

4

The formulae on the linked page deal with curves in short Weierstraß form, that is $y^2=x^3+ax+b$. Your curve is not given in this format. You can find the correct formulae for long Weierstraß curves (like yours, where the coefficients $a_1$ and $a_3$ are zero) on this page.

4

All of these are answered by the SafeCurves project: $x^2 + y^2 \equiv 1 + dx^2y^2 \pmod p$ Edwards curves can be converted to Montgomery form.Montgomery curves can be converted to Weierstrass form.Some, but not all, Weierstrass curves can be converted to Montgomery form. The Montgomery ladder (applicable only to Edwards and Montgomery curves) is faster ...

4

Bits of entropy The assumption for all cryptographic operations is that a random key of n bits has n bits of entropy. If it doesn't (due to PRNG defect or implementation error) then the key will be weaker than expected but the underlying assumption of all cryptographic primitives is that an n bit key has n bits of entropy. This is the same for all types ...

4

Yes, exponentiation by squaring can be applied to any associative binary operation with identity (that is, to any monoid, which includes groups like elliptic curves as a special case), independent of the particular representation. However, the main advantage of Montgomery curves is that there is an improved algorithm (appropriately named Montgomery ladder) ...

Only top voted, non community-wiki answers of a minimum length are eligible