# Tag Info

0

Are there performance, size, or power efficiencies from one curve to another? The larger the curve, the larger the keys and signatures, and likely the slower the computations. There are exceptions to the last one – curve parameters do affect how efficiently they can be implemented, so some curves with good parameters can be faster than slightly smaller ...

0

There is no way to generate a secure key-pair from the password "puppies". If you are using a 256-bit elliptic curve and want the full 128-bit security it can offer, any password from which you directly derive a key needs to have over 100 bits of entropy. If you use a key derivation function, like PBKDF2 or scrypt, with parameters that require a few seconds ...

4

Given a EC public key, can a different, but plausible and functional private key be derived to match the public key? No, a public key will correspond to only one private key (with one minor exception, which I will explain below). With Elliptic Curve systems, the private key is an integer $d$ between 1 and $q$ (the order the generator point $G$), and ...

0

Could Eve capture Bob's public key, then derive some different private key to correspond to it, and then impersonate Bob by saying "I am Bob, and here's my public key." Even though Eve doesn't have Bob's private key, she's able to produce some other private key that's compatible with Bob's public key? No, not unless the public key system is broken. In ...

0

I obviously don't understand the mathematics behind ECC, but I am quite certain that the mentioned Multiply is not as simple as regular multiplication, nor as simple as wrapping around a finite field many times over. Because: When Alice and Bob exchange ECDH public keys, and then they each do DeriveKeyMaterial() or CalculateAgreement(), the result is ...

0

Please see https://cbcrypt.org specifically https://cbcrypt.org/doku.php#documentation_and_api. There is a method CBCrypt.GenerateKeyPair(string CBCryptHostId, string username, string password) created specifically for this purpose. This does not relate specifically to BitCoin, but if you start with something like a password, salt it with details of where ...

1

Such keys are called static keys. Keys that are newly generated each time are called ephemeral keys. Note that you need to trust the public keys of the key pairs to use them for authentication. Please note that there is an issue if you use static keys only for plain Diffie-Hellman: the generated secret will be static as well, as the whole scheme has now ...

2

Yes, the same keypairs can be used to derive shared secrets between multiple pairs of parties. If knowing the shared secret between Alice and Bob would help Eve find out the shared secret between Alice and Carol, Eve could just create her own random private key and calculate a "shared" secret between that key and Alice's public key to get the same ...

3

As @poncho says, both keys $Q_1=r^{-1}(sR-zG)$ and $Q_2=r^{-1}(sR'-zG)$ will validate the given signature, i.e., $(s^{-1}zG+s^{-1}rQ_i)_x=r\mod{n}$. For some curves, with small but non-zero probability, we have $n\leq(kG)_x<p$, and neither $Q_1$ nor $Q_2$ will validate other signatures made with the original private key $d$. However, by Hasse's theorem, ...

0

If you can use something more lightweight than pairings then you should skip pairings. There is a technical property of pairings than is not the case with other crypto primitives. And this is the evaluation of multiplications on the exponent that cannot be achieved in other cases. If you need some sort of summation then you encode in the exponent and then ...

1

Pairings in cryptography is a very important tool, the introduction of which has developed a new field, that is pairing-based cryptography. After the independent pioneering work by Joux and by Sakai et al.("Cryptosystems based on pairing"), many pairing-based crypto-systems emerged. In cryptography, pairings are often treated as "black-box", and then we ...

5

Actually, it is not possible to uniquely recover the public key from an ECDSA signature $(r,s)$. This remains true even if we also assume you know the curve, the hash function used, and you also have the message that was signed. However, with the signature and the message that was signed, and the knowledge of the curve, it is possible to generate two ...

2

You'll get back the same point; however it may be a different representation of the same point. Remember, an elliptic curve point is a solution to a cubic equation in two variables (or the point at infinity); one commonly used equation is $y^2 = x^3 + ax + b$ modulo a large prime $p$. What projective coordinates do is encode the $x$ and $y$ coordinates of ...

2

SafeCurves lists some ways to compare the security of elliptic curves. Their security criteria are split to "ECDLP security" and "ECC security". Failing the former basically means "there is no way to use this curve securely in general" while the latter "it is difficult to implement this curve securely". None of the (few) BouncyCastle-supported curves that ...

2

You may probably use any curve you like, depending on your special requirements (environment, computational aspects, ...) and the curves implemented by your library (see otus answer refering to some concrete security findings related to specific elliptic curves, and how sensible they are to certain attacks). The reason why the curves are pre-computed, is ...

2

You can do it with two machines. https://www.iacr.org/archive/crypto2001/21390136.pdf (this paper is for DSA; it's easy to adapt for ECDSA). Here's an open-source JavaScript implementation of two-party ECDSA signing, using Bitcoin parameters: http://www.jpaulgossip.com/demo/split-key.html Unfortunately the protocol requires at least three rounds of ...

1

If the question is how to take a point in projective coordinates (a triplet $(A,B,C)$, where the corresponding affine coordinate is $(AC^{-1}, BC^{-1})$), and you want to convert it into the same point in Jacobian coordinates $(D, E, F)$ (where the affine coordinate is $(DF^{-2}, EF^{-3})$), I believe this works: $$D = AC$$ $$E = BC^2$$ $$F = C$$ We can ...

3

From a mathematical point of view this is not possible. I would say almost by definition because the point at infinity does not lie in the affine part. To be more precise: Let $\mathbb P^2$ is the two dimensional projective space with coordinates $(x:y:z)$ and $\mathbb A^2 \subset \mathbb P^2$ the affine part where $z \neq 0$ then one can see $X = x/z$ and ...

3

Just adding the comments of poncho and blackadder here which I think should have just been posted as an answer (answer is community wiki in order not to cowardly get credit for this). The difference comes if you do ECC in an extension field; where the field size is $p^k$ for k>1. In that case, $Z_{p^k}$ would imply that you're doing your math modulo $p^k$, ...

Top 50 recent answers are included