Tag Info

New answers tagged

0

Is it deliberate that point addition isn't mentioned anywhere in the API or documentation? Yes. The idea is to offer a minimal API that makes doing the right thing for security easy, while avoiding low level operations that allow shooting yourself in the foot. To quote this primer (pdf) on NaCl: A typical cryptographic library is a collection of ...


4

MQV has been standardized by IEEE P1363 (specified in P1363 2000, and amended in P1363a 2004), but it does not involve hashing, and therefore can't provide an answer to the OP's question. HMQV standardization proposal has been submitted to IEEE, but it does not contain the specific details that @jww is asking for. I went through the relevant P1363 docs and ...


1

In elliptic curves you don't have index calculus method. Only the generic algorithms (Shank's, Pollard) as the previous poster said. In order to elaborate a little, why you don't have index calculus, you have to see the steps of index calculus. The first step is to construct a factor base (in $GF(p^n)$ is consisting from polynomials) the second is to find ...


4

DSA relies on $k$ being independent from $d$. You define $k$ as: $k=z^\prime d\mod n$ Substituting $k$ in the signing equation you get: $s = k^{-1} (z+rd) \mod n$ $s z^\prime d = z + rd \mod n$ $d=z (sz^\prime -r)^{-1} \mod n$ The attacker knows everything on the right side and can recover the private key.


6

First off, your equation is correct and there seems to be no calculation mistake. To understand on how to get from $$(2+d)x^{2}+dy^{2}=d+(d-2)x^{2}y^{2}$$ to $$x^{2}+y^{2}=1+e\cdot x^{2}y^{2}$$ one first needs to observe that $e=(d-2)/(d+2)=121665/121666$ holds. The next step is to consider: "What operations are actually allowed with birational ...


1

There is no standard "multiply two group elements" operation in an additive group. So you first need to define what you mean by $P*Q$. From the comments I gather that you want $P*Q = q P = p Q = (p \cdot q) G$. The computational Diffie-Hellman (CDH) problem is: Given $P=pG$ and $Q=qG$ compute $(p\cdot q)G$. which is clearly equivalent to your problem. ...


0

Well the equation $R = P * Q$ simply isn't possible on an elliptic curve. The group of points on the EC is an additive group. Meaning it is only possible to compute $P + Q$ or $[m] P$ for some integer m. Taken $P=p \cdot G$ and $Q=q \cdot G$ you already got the answer yourself: $R=(p \cdot q)G$. Simply add the point $G$ to itself $(p \cdot q)$-times.


4

Yes, exponentiation by squaring can be applied to any associative binary operation with identity (that is, to any monoid, which includes groups like elliptic curves as a special case), independent of the particular representation. However, the main advantage of Montgomery curves is that there is an improved algorithm (appropriately named Montgomery ladder) ...


3

The best option you have is TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA. This is likely to provide most security, as the AES keylength is maximal and ECDSA keys tend to provide more security than RSA keys, as a 128-bit security level is quite common with ECDSA (field size: 256 bit) whereas 112-bit is the standard with RSA (keylength: 2048 bit). However in practice ...


0

Found the answer: The $l$-torsion subgroup is isomorphic to a direct sum of two quotient groups: $E[l] \simeq \mathbb{Z}_n \oplus \mathbb{Z}_n$, hence the basis requires two points and the elements of $E[l]$ are represented by linear combinations of such a basis. [Reference: Elliptic Curves, Washington, section 3.1]


14

The answer is about the difficulty of discrete logarithm. The notion of isomorphism does not capture all that matters in cryptography; we also need to consider computing costs. Suppose that we have an abelian group $\mathbb{G}$ with additive notation. Let $G$ be a conventional element of $\mathbb{G}$ of order $n$. The subgroup generated by $G$ is: $$\langle ...


0

Without knowing what recent work you refer to, I can state that one of the prime benefits of the Edwards curves is the unified adding / doubling, and their completeness -- i.e., no exceptional points. Hence no branching decisions to provide clues to side channel snooping. And also, fewer places to screw up the implementation.


1

First, a bit of background. If we refer to the size of an elliptic curve group as $n$, we select an elliptic curve with $n = hq$, where $q$ is a large prime, and $h$ is a small integer called the cofactor; it is typically either 1, 4 or 8. The values of $q$ and $h$ will be part of the curve definition. As you know, with straight DH, we agree on a point ...


2

ECDH is not for signing. Your sign method using ecdh does not look like any valid signature scheme I have ever seen, and is therefore likely wildly insecure. Note that the Q&A you link to is asking a very different question.


4

Bits of entropy The assumption for all cryptographic operations is that a random key of n bits has n bits of entropy. If it doesn't (due to PRNG defect or implementation error) then the key will be weaker than expected but the underlying assumption of all cryptographic primitives is that an n bit key has n bits of entropy. This is the same for all types ...


1

Consider the rational functions $f_P^k$ and $f_P'$. Since $\operatorname{div}$ is a homomorphism of semigroups (i.e. $\operatorname{div}(fg)=\operatorname{div}f+\operatorname{div}g$), we have $$\operatorname{div}(f_P^k)=k\cdot\operatorname{div}f_P=k\cdot(m[P]-m[\mathcal O])=km[P]-km[\mathcal O]=\operatorname{div}f_P'\text.$$ Now with theorem 5.36 of "An ...


0

"Elliptic curve encryption" is somewhat popular wording; one better be specific like ElGamal encryption with a group of points on elliptic curve. So, start with ElGamal to understand what kind of group is expected. Try ElGamal with multiplicative group modulo a (large) prime. At last, consider objects named points on a curve as an unusual set with highly ...


0

As suggested, here is a hopefully entry-level precis of the paper linked in the comment above. A Discrete Logarithm based asymmetric key system lacks a true trapdoor function - you can't compute a pre-image for an arbitrary image. Instead, a Schnorr signature relies on a slightly weaker condition. A generalized Schnorr signature can be considered to have ...



Top 50 recent answers are included