Tag Info

New answers tagged

0

The general idea to derive keys from (ephemeral) Diffie-Hellman key agreement is to use a KBKDF - a key based key derivation function. KBKDFs are mostly ill defined with regards to what security requirements they adhere to. Fortunately creating a KBKDF isn't thought to be too hard. Using a cryptographically secure hash generally gets you a long way. You ...


1

What format must the x-coordinate bignum be converted to before hashing it? Any format works as long as it uniquely encodes the shared secret and is used by all parties. So if your code doesn't need to interact with other implementations, you can use whichever you like. If you need interoperability, you need to look at what others are using. E.g. SP ...


8

There is a rather deep polynomial-time algorithm for counting the $\mathbb F_q$-rational points of an elliptic curve published by René Schoof in 1985 (with subsequent improvements by Noam Elkies and A. O. L. Atkin). It is based on two core ideas: The number of points is closely linked to a functional equation $$ \varphi^2-t\varphi+q = 0 ...


1

What is its signature length ? Depends on what algorithms you use, but with ECDSA the signature length is twice the length of the order of the base point. For P-521 that's 1042 bits, or 132 bytes when using whole bytes for each part. For E-521 it's 1038 bits or 130 bytes. How is it better ? The design criteria for E-521 are stated in A note on ...


1

The generated private key is same for both client and server is it true? No, that's not true. The key pairs and thus the private keys will be different. They will only be the same if the random number generator creates 521 identical bits for both the server and the client when the key pairs are generated. Client send its public key first or Server? ...


2

Curve25519 makes use of a special x-coordinate only form to achieve faster multiplication. Ed25519 uses Edwards curve for similar speedups, but includes a sign bit. While it could have been done differently, doing it this way simplifies implementations that only need one of encryption or signing.


6

If I understand your question correctly, you are essentially asking if points in Edwards and Montgomery curves can be represented in Weierstrass coordinates. This is true; in fact, any elliptic curve over a prime field can be represented in Weierstrass form $\mathcal{E}_{w}^{a, b} : y^2 = x^3 + ax + b$, and by extension its points can too. The question, ...


4

No, Curve25519 signature is not vulnerable to bad RNG during signature generation; that's because Curve25519 signature needs no random number during signature generation. By contrast, in ECDSA, a fresh random number is needed for each signature, and if it gets known, that allows to recover the private key from the signature and public key; same if the same ...


5

Any key generation algorithm for any cryptosystem is going to be weak if the attacker can predict what seed was used to generate the key. They can just generate the same key. However, assuming the the random number generator is not that bad, different algorithms start to look different. If you are just using the output of the random number generator as a ...


13

Some claim that Curve25519 has 112 bit security, others that it has 128 bit security; which is it? Well, actually, neither - it's actually somewhere in the middle. For a curve without known weaknesses (and Curve25519 doesn't have known weaknesses), then if the curve order has a large prime factor around $2^{2k}$, then the best known attacks against it ...


1

Also, the algorithm given in the mentioned paper has a complexity os $\tilde{O}(p^{\frac{1}{4}})$. The best known attack (As mentioned by de Feo, Jao and Plut) on the SSIKE is based on the claw finding problem (see below) and has a complexity of $\theta(p^{\frac{1}{6}})$. Very interesting paper btw ;): Claw finding algorithm using quantum walk


2

[...] the only one that is listed (secp256k1) are marked as unsafe. Some of the others are there too. NIST P-224 is the same curve as secp224r1, and similarly for P-256 and P-384. Those are marked unsafe as well. Assuming we trust djb, are the elliptic curves that are currently supported by this reasonably new version of OpenSSL (and therefore ...


2

Sorry I will have to answer my own question. I received a mail from Luca De Feo a moment ago. "Nope, I discussed this at length with Jean-François Biasse, and we couldn't find a way to apply this kind of attack to SSIKE." I'll leave this question around for reference for the next person who wonders.


0

In the document the P-256 parameters describe the curve P-256 on which you want to perform the operations. Traditionally a curve is represented in Weierstrass-form as the set of points for which $$y^2\equiv x^3 + ax+b \pmod p$$ holds. Where $p$ is the prime defining the field for the operation and $a$ and $b$ define the shape of the curve. A point on the ...


0

Most probably, the elligator (hiding in here) will jump onto the attackers and bite them, so that they will not risk any further attack. :) As an additional security, as described in section 5.1 of the paper, the definition of Elligator 2 is parametrized with a non-square element $u\in \mathbb{F}_q$. So if I understand this correctly, an attacker will not ...


0

I provide a specific example. Say $p=11.$ You want to find the points of the elliptic curve $y^2=x^3+1$ over the finite field $L=GF(p^2).$ Also set $K=GF(p).$ Then a defining polynomial of the quadratic extension $L/K,$ will be an irreducible quadratic polynomial over $K.$ Suffices to take $f(z)=z^2+7z+2.$ Now you have to take every element of $L$ as the ...


1

TL;DR: use (D)TLS. This is exactly the kind of problem it was meant to solve. If possible, use cert pinning too (if you get to deploy the code on both ends of the channel, this should be possible). The general rule is: don't design your own crypto protocol unless both of the following apply. You have done a detailed review of what exists already and ...


6

SHA-1 is still thought to be secure whenever collision resistance isn't required. The hash is both used for signing certificates and ECDHE public keys. There's however a difference with regard to collision attacks. It is possible for an attacker to attack the collision resistance with certificates by getting their own certificate signed by a CA. In ECDHE ...


0

Here's a good amount of hard data on a variety of curves, well-analysed and the findings summarised in a readable way: http://safecurves.cr.yp.to/ The chosen answer is not nearly up to the same standard of analysis and, I would argue, deceptive, whether maliciously (v. unlikely) or just due to lack of understanding of basic research methodology.


2

Edwards curves can be implemented using a unified formula for addition and doubling; i.e., one can implement addition such that $$\mathrm{dbl}(P)=\mathrm{add}(P,P).$$ Performance wise it is however more efficient to consider both functions separately, since the doubling can be implemented more efficiently than the addition. Depending on the representation ...


3

1. The equation $-x^2+y^2=1-(121665/121666)x^2y^2$ defining the curve $E$ is quadratic in $x$, hence for any given $y\in\mathbb F_q$, there are at most two points on $E$ which have $y$ as their second coordinate. In this case, the two possible $x$-coordinates for a point on $E$ with $y$-coordinate $4/5\in\mathbb F_q$ are the solutions to the equation $$ ...



Top 50 recent answers are included