# Tag Info

1

I recently came across a paper that may interest you that I think answers your question. To quote from the abstract: Unfortunately, in all existing HD wallets---including BIP32 wallets---an attacker can easily recover the master private key given the master public key and any child private key. This vulnerability precludes use cases such as a combined ...

0

The method you describe is called the "pencil and paper algorithm" and is well described in Knuth's Book, Semi-Numerical Algorithm II. In fact the number of steps can be easily determined by the size of operands. If Dividend D, is m-bit and Divisor d, is n-bit, then the Quotient q, will be (m-n+1)-bit, and the remainder in case of binary division will be at ...

0

My educated guess is that $z=x^3+ax+b$. After all, $y$ satisfies $y^2=z$. The reason as to why that formula works comes from Fermat's little theorem. If $u\not\equiv0\pmod p$, then we have $u^{p-1}\equiv1\pmod p$. Because we are working in $GF(p)$ where equality is defined via congruence modulo $p$ I keep it simpler and write this as $u^{p-1}=1$ for all ...

0

I had trouble with this as well when I was learning about ECC. I have no idea if this is the technically correct way to do it, but it works in my program... Well, I know for a fact it works with secp256k1, secp384r1, and secp511r1 at least. i = (first byte of compressed point) mod 2 y2 = ((x ^ 3 mod p) + a*x + b) mod p y_ = (y2 ^ ((p+1)/4)) mod p if i is ...

3

You want to find a point $(X,Y)$ on an elliptic curve $y^2 = x^3 + ax + b$ knowing only $X$ and a single bit indicating whether $Y$ is even or odd. To find $Y$, you use the relation defining the curve: you know that $Y^2 = X^3 + aX + b$ since the point is on the curve. So you compute $X^3 + aX + b$ using your value of $X$ and the public parameters $a, b$, ...

0

The signature with the 256-bit curve should be 64 bytes, not 128. Was that a typo or are you doing something wrong? If you encode that in Base16 (hex), the efficiency is 50%, you would get 128 characters. Instead, if you go with Base64, you'd get 75%, so you would be looking at 86 characters. Since this is not an application that needs a very high level of ...

1

ElGamal works for any ring. What is badly specified is the glue between the protocols (some network packets) and the exact implementation variants in the math library. C25519 use arithmetic over Montgomery curves. Ed25519 use arithmetic over twisted Edwards curves. Huff curves implementations can be "faster", but there are not in the repository of curves ...

1

1. What standard curves could I use? I know curves like p192 etc exists, am I allowed to use these? Yes, of course you may use those, for more curves - including safer ones - check the safecurves website. 2. How can I find valid points to use for messages and generator on these huge curves? So far I've done it using brute force on smaller curves with a ...

5

Now to calculate Q this will take a lot of time since it means I will need to perform point addition an insane number of times unless I'm not understanding something about it. You're missing a point; elliptic curve point addition is associative; that is, for any three points $A, B, C$, we have: $$(A + B) + C = A + (B+C)$$ Now, why is this a big deal? ...

Top 50 recent answers are included