# Tag Info

14

Let's assume that everyone agreed on some elliptic curve and a public base point $g$ somewhere on the curve. When two parties Alice and Bob want to agree on a shared secret, they proceed as follows: Alice chooses some random number $a$ and applies the curve operation to $g$, the public base point, $a$ times. She obtains some result ...

8

Let's recall how discrete logarithms are solved in strong elliptic curve groups. The basic idea is to iteratively walk through many combinations of the form $x_i = a_iP + b_iQ$ until we find a distinguished one, i.e., one that shares some common property (like the lowest $k$ bits of $x_i$ set to 0). We accumulate enough distinguished points until we find a ...

8

If that were possible, that is, if you could take an x-coordinate, and find the private key $k$ such that $kG$ has that x-coordinate, well, you've just solved the discrete log problem. If you can do that, you've just shown that the curve is insecure. If you're thinking "I'm not specifying the y-coordinate; doesn't this make it easier than the discrete log ...

7

Actually, it is not possible to uniquely recover the public key from an ECDSA signature $(r,s)$. This remains true even if we also assume you know the curve, the hash function used, and you also have the message that was signed. However, with the signature and the message that was signed, and the knowledge of the curve, it is possible to generate two ...

7

The main difference is that secp256r1 is a prime field curve, while secp256k1 is a Koblitz curve. Koblitz curves are known to be a few bits weaker than prime field curves, but since we are talking about 256-bit curves, neither is broken in "5-10 years" unless there's a breakthrough. The other difference is how the parameters have been chosen. In secp256r1 ...

7

It happens that a line usually (not always) cuts three points in a elliptic curve by the Bezout theorem. This is the case for the points and the curve you are asking for. So the sum of two points are defined like the inverse of the third point intercepted by the line that cut $P$ and $Q$ (let's name it $R$). So we need to find $-R$ because $P+Q=-R$ by ...

7

The tangent line at point $P(x_1,y_1)$ is: $\frac{\partial f}{\partial x}(x-x_1)+\frac{\partial f}{\partial y}(y-y_1)$ Solving differentials, we obtain: $\frac{\partial f}{\partial x}=3x^2+2x$ $\frac{\partial f}{\partial y}=-2y-1$ For $x_1=0$ and $y_1=0$ we have: $\frac{\partial f}{\partial x}=3x^2+2x = 0$ $\frac{\partial f}{\partial y}=-2y-1 = -1$ ...

7

Your problem seems to be at least as hard as the 2-weak Bilinear Diffie-Hellman Inversion Problem (2-wBDHI problem): Given $g, g^x, g^{x^2}, g^y \in \mathbb G$, and $T \in \mathbb G_T$ to determine whether or not $T = e(g,g)^{x^3 y}$. Proof: We first need to define an equivalent version of your problem, where we take some generator $h$ so $g = h^b$. ...

7

These are "red flags". No one knows of a specific exploit, only some possible reasons to be concerned that one might exist. Since no one knows of a specific attack, we can't possibly know how much speedup such a hypothetical attack might allow. Basically, you're asking for speculation where there is not enough information to allow meaningful speculation, ...

7

ECC is indeed used by CloudFlare's website but only for the session key agreement. The authentication is performed using an RSA 2048 bit private key. The corresponding RSA public key is in the certificate. In other words, although ECC is being used, it is not used for authentication and therefore not part of the certificate. The ciphersuite is: ...

6

Your second equation seems a bit off. In the curve of equation: $$y^2 + cy = x^3 + ax + b$$ in a binary field $\mathbb{F}_{2^m}$, to add point $P_1 = (x_1,y_1)$ to point $P_2 = (x_2,y_2)$, resulting in point $P_3 = (x_3,y_3)$, then the two equations are: \begin{eqnarray*} x_3 &=& \lambda^2 + x_1 + x_2\\ y_3 &=& \lambda (x_1+x_3) + y_1 + c ...

6

It mainly depends on how the algorithm was selected. If it was selected by a public competition like for AES, then it is likely to be secure. If it was forced in by the NSA such as Dual-EC random number generator, then you may have some doubts. Other questions you may want to ask yourself are: Is this an "original" algorithm or was the problem that it ...

6

The real question isn't "Why doesn't Suite B use P-521?" It is, "Why doesn't Suite B use AES-192?" NSA were only interested in 192-bit security for Suite B, but they chose to use AES-256 because AES-192 wasn't widely supported. "In fact we had wanted to use AES -128 and AES-192, but a quick survey of AES implementations (hardware centric, I believe) ...

6

I don't know about computing things in parallel, so I will ignore that part of the question. First, please note that the encryption algorithm is rarely the the weak point of the security. It is far more likely that you will have problems with the implementation, some spyware installed on your computer, a weak password (If you use qwerty as your password, ...

6

In the basic fixed window method of performing point multiplication, we compute the value $nP$ (where $n$ is the integer we're multiplying by, and $P$ is the basis point) by finding the base $b$ representation $n = d_k b^k + d_{k-1} b^{k-1} + ... + d_1 b^1 + d_0 b^0$ (where $0 \le d_i < b$), and then computing first $1P, 2P, ..., (b-1)P$ and then $nP = ... 5 SafeCurves lists some ways to compare the security of elliptic curves. Their security criteria are split to "ECDLP security" and "ECC security". Failing the former basically means "there is no way to use this curve securely in general" while the latter "it is difficult to implement this curve securely". None of the (few) BouncyCastle-supported curves that ... 5 Trevor Perrin wrote a library doing exactly that. Explanation can be found on in the curves mailing list archives. To convert a Curve25519 public key$x_C$into an Ed25519 public key$y_E$, with a Ed25519 sign bit of$0$: $$y_E = \frac{x_C - 1}{x_C + 1} \mod 2^{255}-19$$ The Ed25519 private key may need to be adjusted to match the sign bit of$0$: if ... 5 Now to calculate Q this will take a lot of time since it means I will need to perform point addition an insane number of times unless I'm not understanding something about it. You're missing a point; elliptic curve point addition is associative; that is, for any three points$A, B, C$, we have: $$(A + B) + C = A + (B+C)$$ Now, why is this a big deal? ... 5 In short: the question does not explain well the notion of asymmetry in ECC; and the exposition is not how Elliptic Curve Cryptography works. A reasoning sidestepping the notion of Discrete Logarithm Problem over a finite group can not really explain asymmetry as meant in ECC. Asymmetry is in the knowledge Alice and Bob have about the key, not asymmetry of ... 5 Non-Adjacent Form (NAF), also called Balanced Binary Representation (BBR), is a representation of integers reminiscent of binary, but with an extra$-1$value for digits, and such that at least one of two adjacent digits is$0$. Because the resulting representation has at least half of its digits at zero (typically about$2/3$), it can be used to speed-up ... 5 To generate your pair of keys with elliptic curves first you have to chose your domain parameters (I think this name may comes from the P1363 naming convention, or perhaps it's previous). Those domain parameters will be public. For example for curves over finite fields those parameters are:${p,a,b,G,n,h}$. The lower level operations will be made in ... 5 We, for the most part, don't bother with elliptic curve-based pseudorandom generators. DUAL_EC_DRBG was shoehorned into a NIST standard that also included a block cipher generator, CTR_DRBG, and two hash-based ones—Hash_DRBG and HMAC_DRBG—that are actually used in the field. Number-theoretic generators, which include Blum-Blum-Shub, DUAL_EC_DRBG, and ... 4 Given a EC public key, can a different, but plausible and functional private key be derived to match the public key? No, a public key will correspond to only one private key (with one minor exception, which I will explain below). With Elliptic Curve systems, the private key is an integer$d$between 1 and$q$(the order the generator point$G$), and ... 4 Both curves have similar form and primes close to powers of two ($2^{192}-2^{64}-1$and$2^{224} - 2^{96} + 1$), so you wouldn't expect large differences in performance – all things equal, P-224 might be anywhere from 30% to 60% slower due to the computational scaling of curve operations. However, in practice different implementations will have different ... 4 What's difference between n & #E(FP)? The difference is that$n$is the smallest positive integer where$nG = O$; while you correctly state that$\#E \cdot G = O$, that doesn't mean that$\#E$is the smallest integer that makes this happen. There may be a smaller integer$n$;$n$will always be a factor of$\#E$, however it can be smaller. As for ... 4 In the usual definition of security of Elliptic Curves, curve25519 security is in fact 126 bits. If look at safecurves's rho page you can see the rho complexity for curve25519 is$2^{125.8}$in accordance to what you say. Curve25519 author basically doesn't accept that definition of security. In the Curve25519 paper he states in section 1: Every known ... 4 After a multiplication you have a number with$2 \cdot 255$bits. Since$2^{255} = 19 \pmod q$, you can take the upper half, multiply it by 19 and add it to the lower half. This gives you an equivalent number smaller than$20 \cdot 2^{255}$. Repeat this to get a number that's smaller than$2 \cdot q$. Now check if the value is greater or equal to$q$and ... 4 Such an operation is possible. The ways of calculating that appear to be different for each curve. 4 The formulae on the linked page deal with curves in short Weierstraß form, that is$y^2=x^3+ax+b$. Your curve is not given in this format. You can find the correct formulae for long Weierstraß curves (like yours, where the coefficients$a_1$and$a_3$are zero) on this page. 4 All of these are answered by the SafeCurves project:$x^2 + y^2 \equiv 1 + dx^2y^2 \pmod p\$ Edwards curves can be converted to Montgomery form.Montgomery curves can be converted to Weierstrass form.Some, but not all, Weierstrass curves can be converted to Montgomery form. The Montgomery ladder (applicable only to Edwards and Montgomery curves) is faster ...

Only top voted, non community-wiki answers of a minimum length are eligible