All Questions
Tagged with ecc or elliptic-curves
2,278 questions
0
votes
0
answers
14
views
I have a question is exist any post quantum replace for secp256k1 ? ( ECDSA , schnorr )
I tried to look for information, but I get the feeling that all algorithms stated as post-quantum are nothing more than noise generators, there is no support for deterministic keys, there is no ...
1
vote
0
answers
49
views
Why does computing qth rooth mod q doesn’t help for fixed pairing inversion?
There are many research papers that reduce the fixed pairing inversion problems down to expoentiation inversion. I understand how computing qth roots mod q where $q=p^m$ is different from ...
- 339
0
votes
0
answers
21
views
Is there anything that would prevent peforming Weil Descent on binary curves of large characteristics?
The ghs attack involve creating an hyperlliptic curve cover for a given binary curve. The reason the attack fails most of the time is the resulting genus grows exponentially relative to the curve’s ...
- 339
2
votes
1
answer
67
views
Better understanding jacobian coordinates on elliptic curve
I know that many similar questions exist but the nature of this question is more of theoretical rather being help in implementation.
I am reading Washington’s book Elliptic Curves, Number Theory and ...
- 686
2
votes
0
answers
42
views
Can EdDSA do signature aggregation like BLS and supports batch verification
BLS is mostly used for signature aggregation and batch verification. I want to know if I can implement an EdDSA-based scheme where a single document (the same message) needs to be signed by multiple ...
- 21
2
votes
0
answers
67
views
In finite fields of large characteristics,what does prevent shrinking the field size down to their larger order in order to solve discrete logarithms?
In the recent years, several algorithms were proposed to leverage elliptic curves for lowering the degree of a finite field and thus allow to solve discrete logarithm modulo their largest suborder/...
- 339
-1
votes
1
answer
53
views
Is it possible to uses large partial private key exposure to recover the ecdsa nonce?
There’s many algorithms for recovering the private key from nonce leakage but I’m not aware of any of them for recovering a nonce from a ecdsa signature.
In details, I know the higher order 120 bits ...
- 339
2
votes
1
answer
50
views
Large nonce leakage with single signature but not severe enough for being able to use Pollard kangaroo
There’s lot of papers on how to recover a private key from a nonce leakage in a ecdsa signature. But the less bits are known the more signatures are required.
Now, suppose I have a 150Bits nonce ...
- 339
3
votes
1
answer
115
views
+100
ECDSA signature allowing unambiguous public key recovery, somewhat as in Ethereum
An ECDSA signature encodes the $(r,s)$ integers each in $[1,n)$, where $n$ is the order of the (sub)group generator. For a standard 256-bit prime curve one standard byte form for such signature is 64-...
- 145k
2
votes
0
answers
73
views
Proof-of-Work Challenge with a Built-In Advantage
I come here feeling like Don Quixote chasing windmills. I'm a complete newbie in cryptography, but I find myself trying to solve a problem without even knowing if it's solvable.
I want to design a ...
- 21
2
votes
0
answers
75
views
Problems with Ellipitc curve implementration SAFE [closed]
I'm currently trying to implement the SAFE Protocol by Kochhar in Javascript. (https://link.springer.com/chapter/10.1007/978-3-031-24367-7_29)
I'm following the formulas in the paper, but I don't get ...
- 21
0
votes
0
answers
61
views
How the Baretto Naehrig rules for computing a sextic extension having the exact same order as the prime curve were computed?
For example, EIP197, I have $Y^2 = X^3 + 3$ having order $q$ equal to
21888242871839275222246405745257275088548364400416034343698204186575808495617
It’s the ...
- 339
1
vote
4
answers
300
views
Is it possible to adapt Nigel’s Smart algorithm for establishing an isomorphism when the curve is only partially anomalous?
An anomalous elliptic curve is a curve for which $\#E(\mathbf{F}_q ) = q$.
But in my case, the curve has order $j×q$ and the underlying field has order $i×q$. In the situation I’m thinking about, I do ...
- 339
0
votes
1
answer
91
views
ECC Point-Scalar multiplication
I implemented my own Double-and-add method to make a public key from a private key using SECP256K1's parameters, this is how my code looks so far
...
- 11
0
votes
0
answers
78
views
How to build a prime curve having a specific a prime order or an order containing a specific prime divisor?
There’s algorithms for computing curves’s order from prime curves or even algorithms for building binary curves containing a specific order through torsion.
But if I want a prime curve having or ...
- 339
-1
votes
1
answer
66
views
0
votes
0
answers
19
views
How to apply Pohlig Hellman using a very limited set of auxiliary inputs in that case?
So I was reading about Talotti, Paier, and Miculan - ECC’s Achilles’ Heel: Unveiling Weak Keys in Standardized Curves. The underlying idea is to lift the discrete logarithm problem to $\mathrm{prime}−...
- 339
0
votes
1
answer
59
views
ECC Point addition implementation in cpp
I have a c++ code snippet that produces a point that is the result of R = P + Q using SECP256K1's parameters, yet for some reason, the values i recieve are incorrect.
This is the code:
...
- 11
0
votes
1
answer
70
views
Is ECDH still secure if I embed the server public key?
I'm pretty new to the concept of key exchange.
Diffie-Hellman does not have authentication, so it makes no guarantees on who is the other party of the connection.
Both key pairs (client/server) need ...
- 103
1
vote
1
answer
68
views
How can i use partial keys to generate a bitcoin wallet?
The SEEDCARD project is a new approach to creating Bitcoin keys for use in a physical bitcoin card. Below is a diagram to show how the wallet generation software works on two SeedSigner devices:
My ...
- 11
0
votes
1
answer
98
views
Is ECCDH P-256 still secure in 2024? [duplicate]
I find it really easy to implement this algorithm in a browser and on my NodeJS server without any third-party dependencies.
After a little searching, I discovered that it seems outdated in 2024.
But ...
- 185
-1
votes
1
answer
76
views
How to Convert a Point from secp256k1 to secp384r1 in Elliptic Curve Cryptography
I'm working with elliptic curve cryptography and have a generator point $G$ on the secp256k1 curve. For example, I can express a point as $5G$ (the result of multiplying the generator point by 5).
...
1
vote
1
answer
75
views
Why secp521r1 curve EC point Hex representation starting with 0x048185 instead of 0x0485?
For prime256v1/secp256r1 or secp256k1 I see the EC point value in HEX as per SEC standard starts with ...
- 13
2
votes
4
answers
614
views
Is there any division operation in elliptic curve cryptography?
Suppose there are two points P and Q on an elliptic curve. For it, we have two operations.
Point addition $P + Q$
Point doubling $[2]P$ or $[2]Q$
Is there any way to get a reminder?
P%Q or division ...
- 21
1
vote
1
answer
64
views
What are the typical sizes of Lucas/Differential addition chains used in practice?
I have never looked at Lucas chains until this paper caught my attention:
Bernstein, Daniel J., Jolijn Cottaar, and Tanja Lange. "Searching for differential addition chains." Cryptology ...
- 33
1
vote
0
answers
60
views
Edwards curve vs. Montgomery curve
Why is the Edwards curve (like Ed25519) preferred for digital signatures, while the Montgomery curve (like Curve25519) is preferred for Diffie-Hellman key exchange? Since both curves perform scalar ...
- 101
0
votes
0
answers
25
views
OPRF and HashToGroup security
In OPRF protocol client needs to deterministically map an array of bytes x to an element of Group, namely an elliptic curve point.
I know that it's insecure to replace HashToCurve with scalar ...
- 149
1
vote
1
answer
50
views
How does the use of Elliptic Curve Pairings in ZK-Proofs not make it vulnerable to the MOV attack?
The key size in an Elliptic Curve Group where the discrete log problem is hard is much smaller than the key size in a Multiplicative Group of a Finite Field in which the discrete log problem is hard ...
- 2,316
0
votes
0
answers
46
views
Inverting Point Doubling in ECC? [duplicate]
There are (at least) two well-known operations in Elliptic-Curve Cryptography, namely
Point Addition: One maps $(P, Q)\mapsto P + Q$, and
Point Doubling: One maps $P\mapsto P + P = 2P$.
I'm ...
- 21
-1
votes
1
answer
64
views
Is there any way of point square in elliptic curve cryptography?
From elliptic curve cryptography we can evaluate
Point addition P+ Q
Point doubling P+P
But is there any way we can determine point square?
P^2
- 21
1
vote
1
answer
102
views
Could the "100 Prisoners Problem" strategy help find a private key from a public key in elliptic curve cryptography?
In elliptic curve cryptography (ECC), repeatedly adding the generator point G to itself essentially forms a long cycle, with the length of the cycle being equal to the order of the curve (the total ...
1
vote
0
answers
51
views
Increasing the probability of membership in an elliptic curve
Suppose $R$ is an elliptic curve and $G$ is a group on it (the order of group is $n$ which is a big prime number). Also suppose $P_1 \in G$ and $P_2\in G$ and $M \subset G , (|M|=m)$. $M$ is a subset ...
- 11
1
vote
1
answer
116
views
Is it easier to compute discrete logarithms resulting from a point addition?
Let’s say I have 2 publicly known randomly sampled points $G_1$ and $G_2$ belonging to a short Weirestrass prime curve with prime order. Let’s say I have $G_3=G_1+G_2$ and a scalar $s$ such as $G_3=[s]...
- 339
0
votes
1
answer
44
views
How to determine large point for the same x axis in the elliptic curve cryptography?
For a given X value of elliptic curve cryptography there are two Y values. One point is P(x,y) and another point is Q(x1,y1) where P =-Q or Q = -P. Suppose given X value is ...
- 21
0
votes
1
answer
70
views
Where is the exact location of Generator point G on curve y^2= x^3 + 7?
Generator point
G = [
'x' => gmp_init('55066263022277343669578718895168534326250603453777594175500187360389116729240'),
'y' => gmp_init('...
- 125
1
vote
1
answer
63
views
Given the optimal ate pairing e(A,B)=y is to possible to determine I and J such as e(I,J)=2y or even e(I,J)=3y?
Simple question : let’s say I have a pairing friendly curve having a very large trace, and that I have a pairing with points $A∈G_1$ and $B∈G_2$ such as the optimal ate pairing $e(A,B)=y$, then is it ...
- 339
1
vote
1
answer
170
views
The elliptic curve $y^2 = x^3 \pmod p$
Consider the solutions of the equation $y^2 = x^3 \pmod p$ for some prime $p=6k+1$. When considered as an elliptic curve, it has a cusp at $(0, 0)$, and addition involving this point doesn't work out. ...
- 225
0
votes
0
answers
64
views
Is it really needed to change both G₂ points of the public & private witness vector in the Groth16’s trusted setup for avoiding public input forgery?
For those who don’t know about Groth16 :
By convention, public portions of the witness are the first $\ell$ elements of the vector $\mathbf{a}$. To make those elements public, the prover simply ...
- 339
0
votes
0
answers
28
views
ePassport Active Authentication (ECDSA with SHA224) cannot extract public key
I'm attempting to perform Active Authentication on a passport but am struggling to extract the EC Public Key and verify the signed data. I'm using Python with the Cryptodome library. I came across a ...
- 101
1
vote
2
answers
99
views
Has the ideal "pairing" $\langle aG, bG\rangle \mapsto abG$ been ruled out conditionally?
Let $G$ be a prime order $Q$ elliptic curve over a prime field of size $P$ which admits the following mapping $f$
$f(aG, bG) = abG$
which can be computed in polynomial time in $\log(PQ)$.
Is the ...
- 225
1
vote
1
answer
51
views
EC private key check value by ECDH against base point
I am designing a general purpose software security module.
One of my requirements is to "describe" a stored key, including a "check" value. The purpose of this "check" ...
- 113
0
votes
1
answer
64
views
Set ECDLP complexity
Consider the following problem which is an easier version of the EC discrete log problem. Fix an elliptic curve and a generator $G$. Given an arbitrary set of points $S$, the task is to find $k$ such ...
- 225
0
votes
1
answer
57
views
Complexity of DLP vs ECDLP in MOV attack
In MOV attack we convert the ECDLP problem to a DLP problem in field of $F_{p^2}$ (assuming the embedding degree is 2). According to the answer here, the complexity of solving this DLP is
$e^{(1.92+o(...
1
vote
0
answers
44
views
Are there real-world applications of point halving on an elliptic curve over a finite field of prime characteristic?
Let $E\!: y^2 = x^3 + ax + b$ be an elliptic curve over a finite field $\mathbb{F}_{\!q}$ of prime characteristic $p$ (mostly, $q = p$ in practice). It is well known that in the $\mathbb{F}_{\!q}$-...
- 425
0
votes
0
answers
50
views
Convert from one curve to another
How can I convert from one curve to another curve using X points, are there any formulas for that?
...
- 1
1
vote
1
answer
99
views
What exactly is a VRF?
Random numbers are useful in many use cases such as blockchain. I know many blockchains or smart contracts employ VRF to generate "provably fair random numbers". But what exactly is a VRF?
I'...
- 111
1
vote
1
answer
72
views
How do Non-deterministic signatures in wallets leak key material
Downsides of not using deterministic ECDSA signatures for blockchain validation? here in the last answer it says:
"With non-deterministic signatures, your hardware wallet might be leaking key ...
- 73
0
votes
0
answers
59
views
Why hashing when generating account from public key?
When producing an account out of public key it's a common approach to hash the latter multiple times (sometimes using different algos) before encoding and taking a portion of the product. Is this done ...
1
vote
1
answer
72
views
Why do non-prime order curves faciliate efficient computation? [closed]
Most common elliptic curves in use today (Edwards, Montgomery and the likes) have small cofactors. The reason we seem to want these curves in practice is because they facilitate fast scalar ...
2
votes
1
answer
88
views
Is EC_POINT_is_on_curve a necessary check when using EC_POINT_mul in openssl?
I'm using EC_POINT_mul in OpenSSL, and I would like to avoid an invalid curve attack. I can see that there is a check for ...
- 21