Linked Questions

1 vote
0 answers
138 views

What’s the relationship between P-256 and Dual EC DRBG?

It is said that Dual EC DRBG has a backdoor given the values of the curve. Hence some people do not trust it. With that in mind, some people also distrust NIST P-256 Curve. Why? Is it purely because ...
Eduardo Andrés Castillo Perera's user avatar
1 vote
1 answer
407 views

P256 seed problem

I'm reading up on elliptic curves and their history and it seems that people don't trust P256 seed which is defined in FIPS 186-3 on page 89 to be SEED = c49d3608 86e70493 6a6678e1 139d26b7 819f7e90 ...
Ukneshi's user avatar
  • 11
1 vote
1 answer
608 views

How to determine secp256r1 or secp256k1 is used on the web sites

I'm pretty new at Cryptography (and at Cryptanalysis), but I went to the website Elliptic to try to discover the elliptic curve they use, and I found they use ECDP 256. So, by SEC2 I discovered they ...
Anonymous's user avatar
2 votes
0 answers
379 views

Kleptographic attack of ECDSA key generation?

Kleptographic attacks can be designed for RSA key generation, Diffie–Hellman key exchange, DSA/ECDSA signing, etc. Is it also possible for ECDSA key generation? More detailed: Is it possible for an ...
zzh1996's user avatar
  • 121
6 votes
1 answer
4k views

What EC curve is used by Apple iOS platform?

I can't find information about EC curve used by Apple's iOS platform. The algorithm name that I could see in their docs is: ...
Oleg Gryb's user avatar
  • 366
4 votes
1 answer
2k views

Why is the strength of an Elliptic Curve Cryptography (ECC) half the size of the prime field size?

I've looked around and couldn't find a direct answer. As a general rule, I've read from various sources (here here, and here) that the strength of an elliptical curve key is half of the size of the ...
THG's user avatar
  • 163
3 votes
2 answers
1k views

How to interpret the article claiming NIST P-256 curve to be unsafe?

Here: http://safecurves.cr.yp.to/ , I read that the NIST P-256 elliptic-curve is not safe. The article lists several aspects (off-curve point, side-channel, etc.) where implementing P256 can fail the ...
PLL's user avatar
  • 31
3 votes
1 answer
268 views

Why do we use $a=1$ in elliptic curves?

$y^2 + xy = x^3 + ax^2 + b$ is the elliptic curve over $\mathbb F_{2^m}$. In the elliptic curve standard, most of the curves use $a=1$ a lot. Is there any mapping for this such that $y^2 + xy = x^3 +...
Hoo's user avatar
  • 31
4 votes
1 answer
295 views

Elliptic curves with field sizes that not byte-aligned

Why there are abnormal field size like 521, 571, 233, 283 bits in prime and binary fields that are defined by NIST?
Venkatesh's user avatar
  • 482
2 votes
1 answer
4k views

Limitations of Elliptic Curve Cryptography?

Simple question, what are the limitations of ECC, both in terms of application and how secure it is? I heard that the NSA were able to read emails a few years back due to a backdoor they had ...
Ali's user avatar
  • 481
8 votes
1 answer
5k views

Curve25519 vs "Million Dollar Curve"

Quoting from the Million Dollar Curve website: By using publicly verifiable randomness produced in February 2016 by many national lotteries from all around the world, we propose to generate a ...
Tim McLean's user avatar
  • 2,844
16 votes
2 answers
5k views

How do I get the equivalent strength of an ECC key?

I know how to calculate the comparable symmetric strength of an RSA modulus: calculate the running time for a field sieve. This is how NIST gives approximate symmetric sizes for asymmetric algos in ...
mikemaccana's user avatar
8 votes
2 answers
5k views

Do Weak Elliptic Curves Exist?

I'm running into very contradictory opinions when try to understand if weak elliptic curves exist. I'm not interested in the case when a curve's weakness is attributed to properties of an EC's prime, ...
Oleg Gryb's user avatar
  • 366
1 vote
2 answers
386 views

Severity of Cooking NIST P Curve Constants

Bruce Schneier and Gregory Maxwell have both stated that they believe the constants chosen for NIST's P curves (i.e. P-256r) are cooked. DJB has put together a detailed list of red flags but, outside ...
Indolering's user avatar
3 votes
1 answer
690 views

Proving Non-Existence of ECC Backdoors

In light of the NIST Dual EC DRBG scandal, I was intrigued by a NIST slide (slide 9) that said the two points P and Q can be chosen so that the chooser can prove they don't have a backdoor. This ...
crockeea's user avatar
  • 131

15 30 50 per page