# Tag Info

2

I'm not sure if I get your question correctly. Do you like to use a 256 bit curve to generate a (secret) key of this size and later drop 192 bits? If this is the case your 64 bits will be useless because you secret key will not have any relation with the public. Furthermore, in a magic case that this works, your field operations will continue living in a 256 ...

1

No nothing. Elliptic curve cryptography can be done on any discrete field. Hence, if you choose a 64-bit key, the DL-problem in the group induced by elliptic curves might be not that hard, but still it is valid to do.

1

If you want to reduce integers modulo that specific prime (and I assume you have checked whether $p = 2^{256}-2^{32}-2^9-2^8-2^7-2^6-2^4-1$ is prime or not), I would suggest you don't use the Solinas algorithms, but instead a different one geared towards modulii of the form $2^n - c$ for small $c$. The identity underlying this operation is actually fairly ...

2

You need to recall how the extension is built. $\mathbb{F}_{p^{12}}$ is built on top of $\mathbb{F}_{p^2}$ using the reduction polynomial $f(x) = x^6 - \xi$, where $\xi \in \mathbb{F}_{p^2}$ is a non-square and non-cube (using the notation from the paper). In other words, this is the set of polynomials with coefficients in $\mathbb{F}_{p^2}$, modulo $f(x)$. ...

2

Of course you can use Elliptic Curve cryptography to do public key encryption, that is, a method with a public key and a private key; anyone with the public key can encrypt, but only someone with the private key can decrypt. One way would be to use the Integrated Encryption System. It's does most everything for you (allowing the encryption of arbitrary ...

0

ECDSA is a signiture algorithm derived from ECC (eliptic curve cryptography). So in a way encryption even "came first". Asymmetric encryption is very inperformant though. You could in principle use common shemes like cypher-block-chaining (CBC) to encrypt large files asymmetrically, but the gains do not justify the means. What is typically done (eg in ...

5

The implications are that someone screwed up some calculation. By Lagrange's theorem, the co-factor must be an integer.

0

As @tylo says, projecting the point to the $x$ coordinate does not give you a homomorphism. So this version is not useful if you want to have additively homomorphic ElGamal. However, you could use the "exponential" version of standard ElGamal on elliptic curves, i.e., instead of encrypting a message $m$ somehow mapped to a point $M$ on the curve (using an ...

2

Concerning your notation problem, yes that is kind of an issue. First, elliptic curves in cryptography are usually noted in additive notation. That's why the function call is called "multiply" and is not just a "simple multiplication" but in practice it uses the same principle as exponentiation for "normal numbers" (implemented mostly as "square and ...

2

Both ECC and RSA have execution times proportional to the cube of the bitlength (n^3) of the RSA-Modulus or the Domain bitlength, respectively. So there is no difference in the asymptotic behaviour if you increase bit length. ECC needs roughly 10 multiplications per point operation. Point doubling and point addition in ECC, corresponding to squaring and ...

3

The routine you link to is already performing that check (lines 15-17): it returns $(0,0,0)$ when $S$ and $T$ are equal, and the caller is expected to handle this by calling the doubling routine. The equality verification is performed by checking whether $$X_1Z_2^2 - X_2Z_1^2 = 0$$ $$Y_1Z_2^3 - Y_2Z_1^3 = 0$$ It is easy to see that, since $x = X/Z^2$ ...

1

My comment already gave you the answer; I'm submitting an official answer to give you something to upvote :-) An elliptic curve is defined within a field; in the case of curve25519, it is defined within the field $GF(2^{255}-19)$; this is a prime field, because $2^{255}-19$ is prime. So, when we get to the conversion formulas such as \$\frac{3 - ...

Top 50 recent answers are included