# Tag Info

0

You forgot to mention one additional advantage of elliptic curves: the generation of keys is much faster than with RSA. In europe, many government smart card solutions are now based on ECC: The european electronic pass ports The Austrian card The German ID card The new German health insurance card

0

Form a mathematical point of view, one can define ECDSA over arbitrary finite fields. Form a security point of view, the most important thing is the size of the group order. Arithmetic is easy in the case $GF(p)$. Arithmetic gets more involved for $GF(p^m), m>1$, because you have to perform polynomial divisions. Arithmetic in $GF(2^m)$ is ...

1

The general case is that of field extension. Given a field $\mathbb{F}_q$ of $q$ elements (in your case, the field is $\mathbb{Z}_p$, the integers modulo a prime $p$), you want to define and do computations in a field $\mathbb{F}_{q^k}$ of $q^k$ elements for some integer $k > 1$. To do so, one first considers $\mathbb{F}_q[X]$ which is the ring of ...

0

If you use a prime $p \equiv 3 \pmod 4$, then an element from $\mathbb{F}_{p^2}$ can be written as $a+ib$, where one has the following rules of calculus: $(a_1+ib_1)+(a_2+ib_2) = (a_1+a_2)+i(b_1+b_2)$ $(a_1+ib_1)\cdot(a_2+ib_2) = (a_1 a_2 - b_1 b_2)+ i (a_1 b_2+ a_2 b_1)$ $(a+ib)^{-1} = (a-i b) / (a^2+b^2)$ Sine $i^2 = -1$, those rules resemble ...

0

This may be off-topic since it is really about OpenSSL... For your question 1, the values you get are the prefix 04 (which indicates that the point is represented in uncompressed form) followed by the $x$- and $y$-coordinates of the generator. Here you have 97 bytes, so eliminate the first byte and then you have both coordinates, which take 48 bytes each. ...

1

The web site of https://ellipter.com says, they are using encryption.

0

For my software "Academic Signature", this necessary check for equality is explained with a code snippet here. Contrasting the statements by Bernstein and Lange, this check can easily be done in a very efficient way. You can view the full routines of my implementation if you look at the open source code and search for the routine "int ...

1

Bernstein and Lange regard any curve in Weierstraß form as "not safe" because they assume, implementers of ECC with these curves will make stupid mistakes. You can see a more detailed discussion on this point here:Safety of ECC-point addition. So you should pick a subset of their criteria if you want the Weierstraß form(I don't see any reason not to). IMHO ...

1

There is an easier and more generally applicable method than the RSA specific method poncho explained: Fix a universal "key" for your format, e.g. "42". Encipher the complete header including the RSA Modulus, ID, Name and whatever else the previous setters of the standard deemed indispensable using e.g. aes or threefish. You might wish to fix a universal ...

1

Elements of finite fields don't really have a sign. But depending on context you can define a property that's different for $x$ and $-x$ (when $x$ is not $0$) and call that property sign. Some possible choices: A number is called a square (or Quadratic residue) if there is another number which produces it when squared. Since positive real numbers are ...

0

In finite fields there are is no distinction between positive and negative numbers. This implies that you also do not have positive or negative points in an elliptic curve over a finite field. But you can nevertheless distinguish the two points by looking at the least significant bit. For instance, this will be used by the point compression method.

1

Saying that ECDH does not do authentication is not entirely accurate. If you use ECDH with static, known public keys and both sides prove knowledge of the shared secret, then you do get authentication. However, with ephemeral keys you need some way to authenticate the exchange of public keys. That could be ECDSA or it could be any other authentication. So ...

0

I am not clear about the categorisation of safe and non-safe curves on this site. But the "unsafe" curves of Nist, Brainpool and Certicom are used in electronic passports , the new german id card , etc. So, I would simply stick to that curves and forget the fancy "safe" curves.

2

ECKEY object may contain: Group Private key Public key Both Group and Private key are needed to be able to calculate signature. It is most convenient to use generic ECKEY object (from API perspective), as it easy to e.g. convert between commonly used PKCS#8 PEM encoded EC private keys and ECKEY objects, and because just a BIGNUM would not be sufficient. ...

2

The protocol seems secure. Some comments below. Bob computes the DH shared secret X using his private key and Alice's static public key, and then K(X), the result of applying an appropriate key derivation function (KDF) to the combination of A, B, and X. The DH secret X already depends on both key-pairs. Including the public keys in key ...

5

It is possible to find the desired values in an acceptable amount of time. TL;DR: Find the curve order, factor it, select a (random) point until you have one with the desired order and calculate the cofactor as quotient of curve and point order. First, you can use yyyyyyy's answer to find the order $n$ of the described curve using Schoof's algorithm. ...

3

Sounds like a description of ECIES to me. ECIES is a hybrid cryptosystem that builds upon ECDH. Basically: the static public key of the receiver is used together with an ephemeral key pair generated at the sender. The public key of the receiver and ephemeral private key of the sender are used to generate a "shared secret" using ECDH. This shared secret is ...

1

It follows from the definition of Jacobian coordinates. Assume $T_1=0$ and $T_2=0$ then you have $X_1=x_2\cdot Z_1^2$ and $Y_1=y_2\cdot Z_1^3$ which means that $P=(x_2\cdot Z_1^2 :y_2\cdot Z_1^3 : Z_1 )$ whose affine representation if $Z_1\neq 0$ is $P=(x_2:y_2)=Q$ (Explicit Formula Database). Hence $P+Q=2\cdot Q$

2

Pub alg - Reserved for Elliptic Curve(pub 18) unknown(pub 18) The output explains pgpdump knows this is an elliptic curve algorithm (which has ID 18), but does not understand the exact details (which curve was used, ...). Try gpg --list-packets instead which has full support for ECC (requires GnuPG 2.1, binary might also be called gpg2 on Debian and ...

1

The general idea to derive keys from (ephemeral) Diffie-Hellman key agreement is to use a KBKDF - a key based key derivation function. KBKDFs are mostly ill defined with regards to what security requirements they adhere to. Fortunately creating a KBKDF isn't thought to be too hard. Using a cryptographically secure hash generally gets you a long way. You ...

Top 50 recent answers are included