Linked Questions

5 votes
0 answers
431 views

Using a product of a series of curve25519 scalars as a private key [duplicate]

There are a few systems like the GNU Name System and the Sphinx mixnet packet format that employ a series of curve25519 scalars all multiplied together as a private key. Are there any caveats to ...
Jeff Burdges's user avatar
  • 1,116
31 votes
2 answers
4k views

When using Curve25519, why does the private key always have a fixed bit at 2^254?

When using Curve25519, the private key always seems to have a fixed bit set at position $2^{254}$. Why is that? Is there any good reason to use a fixed positioned most-significant-bit in the private ...
Trina's user avatar
  • 694
5 votes
1 answer
1k views

Can I use any number as an ECC key?

I've been looking into elliptic curve cryptography, and have been trying to understand how I can and can't use it. Note that this is a hobby project and I am not making my own crypto systems for ...
Daniel Causebrook's user avatar
11 votes
1 answer
1k views

HD (Hierarchical Deterministic) Keys using Safe Curves?

Bitcoin's HD (Hierarchical Deterministic) Keys as described in BIP32 allow for a master key to be created (a private key and a chain code) such that a tree of both public and private keys can be ...
Christopher Allen's user avatar
4 votes
1 answer
1k views

Ed25519 key generation

the following rfc describes the key-pair generation mechanism for Ed25519; the first two steps are as follows: Hash the 32-byte private key using SHA-512, storing the digest in a 64-octet large ...
Marc Ilunga's user avatar
  • 3,188
2 votes
1 answer
1k views

Questions about the Curve25519-donna implementation

I'm trying to understand the implementation of the following function: Please note questions in comments. ...
Vega4's user avatar
  • 234
2 votes
2 answers
327 views

Why is there a slight mismatch most of the time in X25519 private keys depending on functions used, but public keys always match (same seed for both)?

I'm trying to wrap my head around going from a seed to a SigningKey, and also obtaining a ...
mkl's user avatar
  • 107
4 votes
1 answer
554 views

Understanding the small cofactor attack with Elliptic Curves of non-prime order

I came across 2 older answers (2 different but similar questions on the small cofactor attack) which cover this attack. https://crypto.stackexchange.com/a/12614/3941 Here the attacker replaces the $...
user93353's user avatar
  • 2,225
2 votes
1 answer
679 views

ed25519 attacks

I try to understand invalid curve attack and small subgroup attack. The lower 3 bits of a ed25519 private key are cleared to be a multiple by 8. So an attacker is unable to gain any information using ...
FooBar's user avatar
  • 45
0 votes
1 answer
656 views

Order of subgroups formed by Elliptic Curves with a Cofactor

In this question: Why are the lower 3 bits of curve25519/ed25519 secret keys cleared during creation? The answer indicates that the order of all points on the curve over the finite field ...
Woodstock's user avatar
  • 1,394
1 vote
1 answer
355 views

Why are hashing private key in Ed22519 key generation and later the modifications required?

In EdDSA with Ed25519 the algorithm of public key computing is following: h = hash (privateKey) h[0] &= 0xF8 h[31] &= 0x7F h[31] |= 0x40 publicKey = h * B ...
Кирилл Волков's user avatar
0 votes
1 answer
257 views

Trying out the small subgroup attack on a group of non-prime order using a simple additive group instead of an Elliptic Curve Group?

This is the attack I am talking about - Why are the lower 3 bits of curve25519/ed25519 secret keys cleared during creation? An elliptic curve group of order $8p$ where $p$ is a prime. Let $G$ be the ...
user93353's user avatar
  • 2,225
0 votes
1 answer
134 views

the probability of sampling a group element that falls in the subgroup on elliptic curve

Given an elliptic curve $E$ on $Z_q$. There is a subgroup $<G>$ on $E$, and the order of $<G>$ is $p$, where $p$ is a prime. And the discrete log problem on $<G>$ is hard. Now we ...
user77340's user avatar
  • 797
0 votes
0 answers
65 views

ed25519: Scalar multiplication guaranteed to land in prime order subgroup?

ed25519 is defined over curve edwards25519 which has a large prime order subgroup and a small subgroup of order 8. During key generation, bit clamping is used to ...
mti's user avatar
  • 655