Tag Info

Actually you have a bug in your step of key generation, it should be $Q_A=d_A \times G$ and you want to have a point $G$ of large prime order $n$ such that the ECDLP is hard on the group. The last check ensures that the public key $Q_A$ is a point of order $n$. If this is the case, then $Q_A\times n = (d_A \times G)\times n = d_A\times(n\times G)=d_A\times ... 2 As already mentioned in a previous comment, ECIES (a hybrid encryption scheme) is typically the way to go when implementing asymmetric encryption on elliptic curves, as it is standardized. It provides chosen ciphertext security (IND-CCA). But as you are looking for "pure" public key encryption schemes, here we go: ElGamal can not only be implemented in ... 0 The ElGamal encryption scheme works in any finite cyclic group$G$, so in particular in the group generated by a$\mathbb{F}_q$-point$P$on an elliptic curve. Key sizes tend to be a lot smaller over elliptic curves. 2 Let's suppose that you work in field$\mathbb{F}_p$for a prime$p$; i.e. the$x$,$y$,$a$and$b$values are integers modulo$p$. The curve order$n$is the number of points on the curve. By Hasse's theorem we know that$n$is relatively close to$p$; namely, the theorem states that: $$|n-(p+1)| \leq 2\sqrt{p}$$ So you get a range of possible values for ... 4 The problem doesn't lie with curves in Weierstrass form necessarily, but with naive implementations of elliptic curve arithmetic on such curves. Basically, if you implement an ECC scheme (ECDH, ECDSA or whatever) on a smart card using a curve in Weierstrass form in the most straightforward way possible (by writing a simple double-and-add loop for ... 3 In fact the equation is not used directly. If you work in the field of integers modulo$p$, both the$x$and$y$coordinates are integers in the$0$to$p-1$range, so there are$p^2$possible points. The equation tells you which points are part of the curve (the$(x,y)$such that$y^2 = x^3 + ax + b$) and which points are not. In that sense, the equation ... 2 Yes for sure you can do that. Mapping this protocol to an elliptic curve setting is just like mapping DH key exchange to ECDH key exchange. In AugPAKE you work in a prime order$q$subgroup of$Z_p^*$and in the EC setting you use a prime order$q$elliptic curve group. Observe that in the EC setting a multiplication of group elements in AugPAKE is then ... 2 Use a zero-knowledge proof of knowledge (ZKPoK) of a value$(r,s)$that is a valid signature. For instance, you might be able to adapt existing ZKPoKs for proof of knowledge of a discrete logarithm to this problem. Because it is zero-knowledge, you will know that it reveals nothing about$(r,s)$and is not transferable. 0 I am not aware of a scheme that fulfills your requirements as defined above, but: If your goal is that Bob can sign a message such that only Alice can verify it and she can proof no one else that this message was sent by Bob then chameleon signatures aka deniable signatures are the tool you are looking for. Schemes were proposed in Hugo Krawczyk, Tal ... 0 In Ed25519 a private key is simply a 256 bit random number, and the public key is derived easily from this. The public key can also easily be interpreted as a 256 bit number. Bob can send Alice his public key, Alice can generate a secrete nonce, and then use a HMAC of the key and nonce to generate herself a new private key. If she communicates the nonce ... 1 Bouncy Castle does not support curves of the Edwards form (such as the one E-521 has). See related question: Elliptic Curves of different forms Bouncy Castle's FpCurve supports curves of the Weierstrass simple form. You can convert Edwards curves to this form by a series of (complex) calculations. SafeCurves shows you the necessary equations. First convert ... 2 The number of points on the curve$|E({\mathbb F}_p)|$is defined as$|E({\mathbb F}_p)|=p+1-t$where$t$is the so called trace of Frobenius. Using Hasse's theorem one can bound$t$as$|t| \leq 2\sqrt p$, which gives you an estimation for the number of points for$E({\mathbb F}_p)$. Now you could use a naive algorithm and simply run through all elements ... 1 There was review of Java implementation https://gist.github.com/doctorevil/9521116 and the authour thinks it's safe 5 CodesInChaos has it correct, however since you're just learning, I think I'll lay it out rather explicitly. When we have an abstract group, there are two ways of expressing operations in the group. One way is writing the operation as if it were the multiplication operation, for example, if we apply the operation to elements$A$and$B\$ and the result is ...