New answers tagged

7

What's missing is the authentication of the entities. If you don't authenticate the entity then you don't know who you've established the master secret with. This means an attacker can pose as a man in the middle or the attacker can simply act as one of the entities. You can use static DH key pairs, but in that case the DH public keys must be trusted and ...


2

This does indeed appear to be a typo. Using that $e_m$ is bilinear and alternating, one calculates $$\begin{align*} F_W(a,P_b,Q_c) \;&=\; e_m([b]P,[c]Q)^a \\&=\; e_m(P,Q)^{abc} \\&=\; e_m(Q,P)^{-abc} \\&=\; e_m([b]Q,[c]P)^{-a} \\&=\; F_W(a,Q_b,P_c)^{-1} \text. \end{align*}$$ (However, note that these are only different if the order of $...


1

First of all, you would probably want to put the shared secret into a KDF even if you have enough bits to use it in a symmetric encryption algorithm. Check these two related posts: Key Derivation Function (KDF): Can a key derived from KDF be considered as a secure key? and How to derive a symmetric key from ECDH shared secret? So, the question: Is there ...


7

Actually, you can recover $n$ from ECDSA signatures (assuming that you can obtain several signatures with the same $k$ value, which means that the ECDSA signature implementation is broken); however it would require 3 such signatures (if you don't mind factoring a value circa $n^2$), or 4 such signatures (if you don't have that many resources conveniently at ...


3

As far as I know, the elliptic curve order $n$ (which denotes the number of points on the curve) cannot be recovered from ECDSA signatures. It is a public data and if you know which elliptic curve has been used to sign the messages, then you should not have trouble to find it. There are several methods to determine $n$ from the curve equation. If you want ...


1

Proposition One-wayness of ElGamal encryption holds under the Computational Diffie-Hellman (CDH), and conversely. CDH Problem (informally) Given $(P, [r]P, [s]P)$ find $[rs]P$. Let the public key be $Q = [s]P$ where $s$ is the corresponding secret key. Let also a ciphertext $C = (C_1, C_2)$ with $C_1 = [r]P$ and $C_2 = M + [r]Q$ for a message $M$ (...


3

What you actually want is called a key-based key derivation function (KBKDF). The most prominent KBKDF (and really the standard solution here) is HKDF. This is a function that takes a secret key (e.g. a KEK or a root key or something) and outputs (a set of) derived keys enjoying some nice properties. You can customize the keys to get different keys for ...


1

First a preliminary: a base point $G$ on an elliptic curve generates a group of points on the curve such that every point in that group can be written as $dG$ ($d$ times $G$) where $d$ is an integer. This group is also cyclic in that for a certain value $q > 1$ we have that $qG = \mathcal{O}$, where $\mathcal{O}$ is the identity element, known as the ...


9

This is not correct, the private key $d_A$ must always be an integer. Your mistake is that you are doing modular division e.g. $\frac{a}{b} \text{ mod } n$ incorrectly. You cannot simply divide the integers and then reduce by the modulus. The correct way to do this is to compute the modular inverse of $b$ i.e. $b^{-1} \text{ mod } n$ and then compute $a*b^{-...


1

It depends your compilation options but the function ecurve_mult in MIRACL/source/mrcurve.c seems to use the w-ary non-adjacent form (wNAF) method.


0

TL;DR: If you separate the keys then you're fine. In my answer I'll outline an encryption algorithm using two ECC keys and achieving (nearly) squared security and the general result for how to properly use two keys in group-based cryptography. First note that a private key $a_1$ is a random integer used to multiply a base point on elliptic curves like $P=...


2

Given two points $P_1 = (x_1,y_1)$ and $P_2 = (x_2, y_2)$ on an elliptic curve $y^2 = x^3 + ax +b$, the sum $P_3$ of $P_1$ and $P_2$ is $P_3 = P_1 + P_2 = (x_3,y_3)$ where $x_3 = \lambda^2 - x_1 - x_2$ and $y_3 = y_1 + \lambda(x_3 - x_1)$ where $\lambda = (y_1 - y_2)/(x_1 - x_2)$ if $P_1 \neq P_2$ and $\lambda = (3x_1^2 + a)/(2y_1)$ if $P_1 = P_2$. The ...



Top 50 recent answers are included