133 views

### How to determine secp256r1 or secp256k1 is used on the web sites

I'm pretty new at Cryptography (and at Cryptanalysis), but I went to the website Elliptic to try to discover the elliptic curve they use, and I found they use ECDP 256. So, by SEC2 I discovered they ...
137 views

### Kleptographic attack of ECDSA key generation?

Kleptographic attacks can be designed for RSA key generation, Diffie–Hellman key exchange, DSA/ECDSA signing, etc. Is it also possible for ECDSA key generation? More detailed: Is it possible for an ...
1k views

### What EC curve is used by Apple iOS platform?

I can't find information about EC curve used by Apple's iOS platform. The algorithm name that I could see in their docs is: ...
895 views

### Why is the strength of an Elliptic Curve Cryptography (ECC) half the size of the prime field size?

I've looked around and couldn't find a direct answer. As a general rule, I've read from various sources (here here, and here) that the strength of an elliptical curve key is half of the size of the ...
220 views

### Why do we use $a=1$ in elliptic curves?

$y^2 + xy = x^3 + ax^2 + b$ is the elliptic curve over $\mathbb F_{2^m}$. In the elliptic curve standard, most of the curves use $a=1$ a lot. Is there any mapping for this such that \$y^2 + xy = x^3 +...
283 views

### Elliptic curves with field sizes that not byte-aligned

Why there are abnormal field size like 521, 571, 233, 283 bits in prime and binary fields that are defined by NIST?
3k views

### Limitations of Elliptic Curve Cryptography?

Simple question, what are the limitations of ECC, both in terms of application and how secure it is? I heard that the NSA were able to read emails a few years back due to a backdoor they had ...
3k views

### Curve25519 vs "Million Dollar Curve"

Quoting from the Million Dollar Curve website: By using publicly verifiable randomness produced in February 2016 by many national lotteries from all around the world, we propose to generate a ...
4k views

### How do I get the equivalent strength of an ECC key?

I know how to calculate the comparable symmetric strength of an RSA modulus: calculate the running time for a field sieve. This is how NIST gives approximate symmetric sizes for asymmetric algos in ...
3k views

### Do Weak Elliptic Curves Exist?

I'm running into very contradictory opinions when try to understand if weak elliptic curves exist. I'm not interested in the case when a curve's weakness is attributed to properties of an EC's prime, ...
273 views

### Severity of Cooking NIST P Curve Constants

Bruce Schneier and Gregory Maxwell have both stated that they believe the constants chosen for NIST's P curves (i.e. P-256r) are cooked. DJB has put together a detailed list of red flags but, outside ...
507 views

### Proving Non-Existence of ECC Backdoors

In light of the NIST Dual EC DRBG scandal, I was intrigued by a NIST slide (slide 9) that said the two points P and Q can be chosen so that the chooser can prove they don't have a backdoor. This ...