Linked Questions

0 votes
0 answers
41 views

Formatting first/last byte of curve25519 private key? [duplicate]

Can anyone dumb it down for me on why you would need to format the first and last byte of a random number to properly generate a curve25519 private key as noted in 'Computing secret keys' section of ...
nikegolf05's user avatar
7 votes
2 answers
3k views

How to create an EC point from a plaintext message for encryption

It seems that ElGamal encryption is also possible for Elliptic Curve cryptography. However, that requires the user to convert the message to a point on the curve. What strategies are there to derive a ...
Maarten Bodewes's user avatar
  • 92.4k
2 votes
1 answer
959 views

Is the STARK Curve a SafeCurve?

SafeCurves defines criterias for choosing safe curves in elliptic-curve cryptography. STARK Curve defines a Stark-friendly elliptic curve that can be used with ECDSA. I was wondering: Is the STARK ...
oberstet's user avatar
  • 447
2 votes
1 answer
753 views

Ed25519 to X25519 transportation

Using montgomeryX = (edwardsY + 1)*inverse(1 - edwardsY) mod p it is possible to transport an Edwards curve point (Ed25519 ...
FooBar's user avatar
  • 45
2 votes
1 answer
656 views

ed25519 attacks

I try to understand invalid curve attack and small subgroup attack. The lower 3 bits of a ed25519 private key are cleared to be a multiple by 8. So an attacker is unable to gain any information using ...
FooBar's user avatar
  • 45
2 votes
1 answer
448 views

How do I validate Curve448 public keys?

Performing an ECDH calculation with an invalid public key can leak information about your own private key. With Weierstrass curves, it's important to verify that the peer's public key is actually a ...
Gilles 'SO- stop being evil''s user avatar
3 votes
1 answer
345 views

How does sending compressed points in ECC can limit the attacker's capabilities?

While sending an EC point we mainly have two options, send it compressed or uncompressed. The uncompressed has prefix 04 and compressed has ...
kelalaka's user avatar
  • 48.3k
1 vote
1 answer
433 views

Are there any public keys for which the private key can be easily derived (ECDSA)?

I know that generally it's infeasible to find the private for any given public key. But I also came across the question "Find ECDSA PrivKey to PubKey = 0", in which it was explained that the ...
Rosco Kalis's user avatar
3 votes
1 answer
124 views

Whats the reason for using elliptic curves of order |E| = fr

To be more precise, in the books I sometimes see that they just require you that the order of your elliptic curve is $|E| = fr$, where $f$ is some small integer with possible factors, but $r$ is a ...
killertoge's user avatar
1 vote
1 answer
233 views

A few questions about the elliptic curves functionalities

I've been learning about the elliptic curves and how they work, and their usage in cryptography, and I'm trying to figure out how to use them using Go. Where is the 'a' parameter from my ECC equation ...
brewandrew's user avatar
2 votes
1 answer
178 views

What happens if the Edwards curve isn't quadratic twist secure?

On this webpage, Daniel Bernstein offers that the curve must be quadratic twisted secure. This means that if the curve has $\#E$ points on $Z_p$ where $\#E=p+1-t$, then the quadratic twist curve has $\...
Mahdi Mahdavi's user avatar
2 votes
1 answer
206 views

Ed25519 signature verification as described in RFC 8032

In RFC 8032, section 5.1.7, it is prescribed that an Ed25519 signature is verified if $[8][S]B = [8]R + [8][k]A'.$ The text then says It's sufficient, but not required, to instead check $[S]B = R + ...
Jay Smith's user avatar
1 vote
0 answers
197 views

"Add" points that are not on the same elliptic curve?

Assume elliptic curve in Weierstrass form. $y^2 = x^3 + a x + b$ where $x,y,a,b \in F$ I noticed the point addition formula does not involve parameters $a,b$. Furthermore, one can always solve for $a,...
Kh40tiK's user avatar
  • 121
0 votes
1 answer
133 views

the probability of sampling a group element that falls in the subgroup on elliptic curve

Given an elliptic curve $E$ on $Z_q$. There is a subgroup $<G>$ on $E$, and the order of $<G>$ is $p$, where $p$ is a prime. And the discrete log problem on $<G>$ is hard. Now we ...
user77340's user avatar
  • 787
1 vote
0 answers
96 views

Why does EDDSA secret scaler pruning not prevent values >= prime L or zero?

I have been exploring and studying the EDDSA algorithm for curve 25519 and curve 448 in RFC 8032 (https://www.rfc-editor.org/rfc/rfc8032) as well as for curves 414 and 521 from this (https://eprint....
cookiecipher's user avatar

15 30 50 per page