Linked Questions
17 questions linked to/from Should we trust the NIST-recommended ECC parameters?
3
votes
2
answers
1k
views
How to interpret the article claiming NIST P-256 curve to be unsafe?
Here: http://safecurves.cr.yp.to/ , I read that the NIST P-256 elliptic-curve is not safe.
The article lists several aspects (off-curve point, side-channel, etc.) where implementing P256 can fail the ...
- 148
4
votes
1
answer
2k
views
Why is the strength of an Elliptic Curve Cryptography (ECC) half the size of the prime field size?
I've looked around and couldn't find a direct answer. As a general rule, I've read from various sources (here here, and here) that the strength of an elliptical curve key is half of the size of the ...
- 91.8k
1
vote
0
answers
112
views
What’s the relationship between P-256 and Dual EC DRBG?
It is said that Dual EC DRBG has a backdoor given the values of the curve. Hence some people do not trust it.
With that in mind, some people also distrust NIST P-256 Curve. Why? Is it purely because ...
16
votes
2
answers
5k
views
How do I get the equivalent strength of an ECC key?
I know how to calculate the comparable symmetric strength of an RSA modulus: calculate the running time for a field sieve. This is how NIST gives approximate symmetric sizes for asymmetric algos in ...
- 15.1k
1
vote
1
answer
332
views
P256 seed problem
I'm reading up on elliptic curves and their history and it seems that people don't trust P256 seed which is defined in FIPS 186-3 on page 89 to be
SEED = c49d3608 86e70493 6a6678e1 139d26b7 819f7e90
...
CommunityBot
- 1
8
votes
2
answers
4k
views
Do Weak Elliptic Curves Exist?
I'm running into very contradictory opinions when try to understand if weak elliptic curves exist. I'm not interested in the case when a curve's weakness is attributed to properties of an EC's prime, ...
- 47.6k
1
vote
1
answer
457
views
How to determine secp256r1 or secp256k1 is used on the web sites
I'm pretty new at Cryptography (and at Cryptanalysis), but I went to the website Elliptic to try to discover the elliptic curve they use, and I found they use ECDP 256. So, by SEC2 I discovered they ...
- 47.6k
2
votes
0
answers
348
views
Kleptographic attack of ECDSA key generation?
Kleptographic attacks can be designed for RSA key generation, Diffie–Hellman key exchange, DSA/ECDSA signing, etc. Is it also possible for ECDSA key generation?
More detailed: Is it possible for an ...
- 121
5
votes
1
answer
3k
views
What EC curve is used by Apple iOS platform?
I can't find information about EC curve used by Apple's iOS platform. The algorithm name that I could see in their docs is:
...
CommunityBot
- 1
3
votes
1
answer
258
views
Why do we use $a=1$ in elliptic curves?
$y^2 + xy = x^3 + ax^2 + b$ is the elliptic curve over $\mathbb F_{2^m}$.
In the elliptic curve standard, most of the curves use $a=1$ a lot.
Is there any mapping for this such that $y^2 + xy = x^3 +...
- 45.7k
4
votes
1
answer
294
views
Elliptic curves with field sizes that not byte-aligned
Why there are abnormal field size like 521, 571, 233, 283 bits in prime and binary fields that are defined by NIST?
CommunityBot
- 1
8
votes
1
answer
4k
views
Curve25519 vs "Million Dollar Curve"
Quoting from the Million Dollar Curve website:
By using publicly verifiable randomness produced in February 2016 by many national lotteries from all around the world, we propose to generate a ...
CommunityBot
- 1
1
vote
1
answer
3k
views
Limitations of Elliptic Curve Cryptography?
Simple question, what are the limitations of ECC, both in terms of application and how secure it is?
I heard that the NSA were able to read emails a few years back due to a backdoor they had ...
- 91.8k
1
vote
2
answers
356
views
Severity of Cooking NIST P Curve Constants
Bruce Schneier and Gregory Maxwell have both stated that they believe the constants chosen for NIST's P curves (i.e. P-256r) are cooked. DJB has put together a detailed list of red flags but, outside ...
- 103
3
votes
1
answer
639
views
Proving Non-Existence of ECC Backdoors
In light of the NIST Dual EC DRBG scandal, I was intrigued by a NIST slide (slide 9) that said the two points P and Q can be chosen so that the chooser can prove they don't have a backdoor. This ...
CommunityBot
- 1