Skip to main content

All Questions

Tagged with or
Filter by
Sorted by
Tagged with
0 votes
0 answers
43 views

I have a question is exist any post quantum replace for secp256k1 ? ( ECDSA , schnorr ) [closed]

I tried to look for information, but I get the feeling that all algorithms stated as post-quantum are nothing more than noise generators, there is no support for deterministic keys, there is no ...
blockchainman's user avatar
1 vote
0 answers
63 views

Why does computing qth rooth mod q doesn’t help for fixed pairing inversion?

There are many research papers that reduce the fixed pairing inversion problems down to expoentiation inversion. I understand how computing qth roots mod q where $q=p^m$ is different from ...
user2284570's user avatar
0 votes
0 answers
21 views

Is there anything that would prevent peforming Weil Descent on binary curves of large characteristics?

The ghs attack involve creating an hyperlliptic curve cover for a given binary curve. The reason the attack fails most of the time is the resulting genus grows exponentially relative to the curve’s ...
user2284570's user avatar
2 votes
1 answer
68 views

Better understanding jacobian coordinates on elliptic curve

I know that many similar questions exist but the nature of this question is more of theoretical rather being help in implementation. I am reading Washington’s book Elliptic Curves, Number Theory and ...
madhurkant's user avatar
2 votes
0 answers
43 views

Can EdDSA do signature aggregation like BLS and supports batch verification

BLS is mostly used for signature aggregation and batch verification. I want to know if I can implement an EdDSA-based scheme where a single document (the same message) needs to be signed by multiple ...
Hasanain's user avatar
1 vote
0 answers
69 views

In finite fields of large characteristics,what does prevent shrinking the field size down to their larger order in order to solve discrete logarithms?

In the recent years, several algorithms were proposed to leverage elliptic curves for lowering the degree of a finite field and thus allow to solve discrete logarithm modulo their largest suborder/...
user2284570's user avatar
-1 votes
1 answer
55 views

Is it possible to uses large partial private key exposure to recover the ecdsa nonce?

There’s many algorithms for recovering the private key from nonce leakage but I’m not aware of any of them for recovering a nonce from a ecdsa signature. In details, I know the higher order 120 bits ...
user2284570's user avatar
2 votes
1 answer
51 views

Large nonce leakage with single signature but not severe enough for being able to use Pollard kangaroo

There’s lot of papers on how to recover a private key from a nonce leakage in a ecdsa signature. But the less bits are known the more signatures are required. Now, suppose I have a 150Bits nonce ...
user2284570's user avatar
3 votes
1 answer
120 views

ECDSA signature allowing unambiguous public key recovery, somewhat as in Ethereum

An ECDSA signature encodes the $(r,s)$ integers each in $[1,n)$, where $n$ is the order of the (sub)group generator. For a standard 256-bit prime curve one standard byte form for such signature is 64-...
fgrieu's user avatar
  • 145k
2 votes
0 answers
73 views

Proof-of-Work Challenge with a Built-In Advantage

I come here feeling like Don Quixote chasing windmills. I'm a complete newbie in cryptography, but I find myself trying to solve a problem without even knowing if it's solvable. I want to design a ...
Expand5309's user avatar
2 votes
0 answers
76 views

Problems with Ellipitc curve implementration SAFE [closed]

I'm currently trying to implement the SAFE Protocol by Kochhar in Javascript. (https://link.springer.com/chapter/10.1007/978-3-031-24367-7_29) I'm following the formulas in the paper, but I don't get ...
Lukas's user avatar
  • 21
0 votes
0 answers
61 views

How the Baretto Naehrig rules for computing a sextic extension having the exact same order as the prime curve were computed?

For example, EIP197, I have $Y^2 = X^3 + 3$ having order $q$ equal to 21888242871839275222246405745257275088548364400416034343698204186575808495617 It’s the ...
user2284570's user avatar
1 vote
4 answers
300 views

Is it possible to adapt Nigel’s Smart algorithm for establishing an isomorphism when the curve is only partially anomalous?

An anomalous elliptic curve is a curve for which $\#E(\mathbf{F}_q ) = q$. But in my case, the curve has order $j×q$ and the underlying field has order $i×q$. In the situation I’m thinking about, I do ...
user2284570's user avatar
0 votes
1 answer
91 views

ECC Point-Scalar multiplication

I implemented my own Double-and-add method to make a public key from a private key using SECP256K1's parameters, this is how my code looks so far ...
DayDrunk's user avatar
0 votes
0 answers
78 views

How to build a prime curve having a specific a prime order or an order containing a specific prime divisor?

There’s algorithms for computing curves’s order from prime curves or even algorithms for building binary curves containing a specific order through torsion. But if I want a prime curve having or ...
user2284570's user avatar
-1 votes
1 answer
66 views

Decode Elliptic Curve Point

I have a Point on the elliptic curve that I call G. ...
Picaso's user avatar
  • 1
0 votes
0 answers
19 views

How to apply Pohlig Hellman using a very limited set of auxiliary inputs in that case?

So I was reading about Talotti, Paier, and Miculan - ECC’s Achilles’ Heel: Unveiling Weak Keys in Standardized Curves. The underlying idea is to lift the discrete logarithm problem to $\mathrm{prime}−...
user2284570's user avatar
0 votes
1 answer
59 views

ECC Point addition implementation in cpp

I have a c++ code snippet that produces a point that is the result of R = P + Q using SECP256K1's parameters, yet for some reason, the values i recieve are incorrect. This is the code: ...
DayDrunk's user avatar
0 votes
1 answer
70 views

Is ECDH still secure if I embed the server public key?

I'm pretty new to the concept of key exchange. Diffie-Hellman does not have authentication, so it makes no guarantees on who is the other party of the connection. Both key pairs (client/server) need ...
Reaper's user avatar
  • 103
1 vote
1 answer
69 views

How can i use partial keys to generate a bitcoin wallet?

The SEEDCARD project is a new approach to creating Bitcoin keys for use in a physical bitcoin card. Below is a diagram to show how the wallet generation software works on two SeedSigner devices: My ...
SeedCard's user avatar
0 votes
1 answer
100 views

Is ECCDH P-256 still secure in 2024? [duplicate]

I find it really easy to implement this algorithm in a browser and on my NodeJS server without any third-party dependencies. After a little searching, I discovered that it seems outdated in 2024. But ...
Kim Mỹ's user avatar
  • 185
-1 votes
1 answer
76 views

How to Convert a Point from secp256k1 to secp384r1 in Elliptic Curve Cryptography

I'm working with elliptic curve cryptography and have a generator point $G$ on the secp256k1 curve. For example, I can express a point as $5G$ (the result of multiplying the generator point by 5). ...
Victor maith's user avatar
1 vote
1 answer
75 views

Why secp521r1 curve EC point Hex representation starting with 0x048185 instead of 0x0485?

For prime256v1/secp256r1 or secp256k1 I see the EC point value in HEX as per SEC standard starts with ...
Cloudy's user avatar
  • 13
2 votes
4 answers
614 views

Is there any division operation in elliptic curve cryptography?

Suppose there are two points P and Q on an elliptic curve. For it, we have two operations. Point addition $P + Q$ Point doubling $[2]P$ or $[2]Q$ Is there any way to get a reminder? P%Q or division ...
Asif Iqbal's user avatar
1 vote
1 answer
64 views

What are the typical sizes of Lucas/Differential addition chains used in practice?

I have never looked at Lucas chains until this paper caught my attention: Bernstein, Daniel J., Jolijn Cottaar, and Tanja Lange. "Searching for differential addition chains." Cryptology ...
Neill Clift's user avatar
1 vote
0 answers
60 views

Edwards curve vs. Montgomery curve

Why is the Edwards curve (like Ed25519) preferred for digital signatures, while the Montgomery curve (like Curve25519) is preferred for Diffie-Hellman key exchange? Since both curves perform scalar ...
Nawras Hussein's user avatar
0 votes
0 answers
25 views

OPRF and HashToGroup security

In OPRF protocol client needs to deterministically map an array of bytes x to an element of Group, namely an elliptic curve point. I know that it's insecure to replace HashToCurve with scalar ...
John dow's user avatar
  • 149
1 vote
1 answer
50 views

How does the use of Elliptic Curve Pairings in ZK-Proofs not make it vulnerable to the MOV attack?

The key size in an Elliptic Curve Group where the discrete log problem is hard is much smaller than the key size in a Multiplicative Group of a Finite Field in which the discrete log problem is hard ...
user93353's user avatar
  • 2,316
0 votes
0 answers
46 views

Inverting Point Doubling in ECC? [duplicate]

There are (at least) two well-known operations in Elliptic-Curve Cryptography, namely Point Addition: One maps $(P, Q)\mapsto P + Q$, and Point Doubling: One maps $P\mapsto P + P = 2P$. I'm ...
Asif Iqbal's user avatar
-1 votes
1 answer
65 views

Is there any way of point square in elliptic curve cryptography?

From elliptic curve cryptography we can evaluate Point addition P+ Q Point doubling P+P But is there any way we can determine point square? P^2
Asif Iqbal's user avatar
1 vote
1 answer
102 views

Could the "100 Prisoners Problem" strategy help find a private key from a public key in elliptic curve cryptography?

In elliptic curve cryptography (ECC), repeatedly adding the generator point G to itself essentially forms a long cycle, with the length of the cycle being equal to the order of the curve (the total ...
Sigmund Kreuzer's user avatar
1 vote
0 answers
51 views

Increasing the probability of membership in an elliptic curve

Suppose $R$ is an elliptic curve and $G$ is a group on it (the order of group is $n$ which is a big prime number). Also suppose $P_1 \in G$ and $P_2\in G$ and $M \subset G , (|M|=m)$. $M$ is a subset ...
ali rahmati's user avatar
1 vote
1 answer
116 views

Is it easier to compute discrete logarithms resulting from a point addition?

Let’s say I have 2 publicly known randomly sampled points $G_1$ and $G_2$ belonging to a short Weirestrass prime curve with prime order. Let’s say I have $G_3=G_1+G_2$ and a scalar $s$ such as $G_3=[s]...
user2284570's user avatar
0 votes
1 answer
44 views

How to determine large point for the same x axis in the elliptic curve cryptography?

For a given X value of elliptic curve cryptography there are two Y values. One point is P(x,y) and another point is Q(x1,y1) where P =-Q or Q = -P. Suppose given X value is ...
Asif Iqbal's user avatar
0 votes
1 answer
70 views

Where is the exact location of Generator point G on curve y^2= x^3 + 7?

Generator point G = [ 'x' => gmp_init('55066263022277343669578718895168534326250603453777594175500187360389116729240'), 'y' => gmp_init('...
Asif Iqbal's user avatar
1 vote
1 answer
63 views

Given the optimal ate pairing e(A,B)=y is to possible to determine I and J such as e(I,J)=2y or even e(I,J)=3y?

Simple question : let’s say I have a pairing friendly curve having a very large trace, and that I have a pairing with points $A∈G_1$ and $B∈G_2$ such as the optimal ate pairing $e(A,B)=y$, then is it ...
user2284570's user avatar
1 vote
1 answer
170 views

The elliptic curve $y^2 = x^3 \pmod p$

Consider the solutions of the equation $y^2 = x^3 \pmod p$ for some prime $p=6k+1$. When considered as an elliptic curve, it has a cusp at $(0, 0)$, and addition involving this point doesn't work out. ...
MERTON's user avatar
  • 225
0 votes
0 answers
64 views

Is it really needed to change both G₂ points of the public & private witness vector in the Groth16’s trusted setup for avoiding public input forgery?

For those who don’t know about Groth16 : By convention, public portions of the witness are the first $\ell$ elements of the vector $\mathbf{a}$. To make those elements public, the prover simply ...
user2284570's user avatar
0 votes
0 answers
28 views

ePassport Active Authentication (ECDSA with SHA224) cannot extract public key

I'm attempting to perform Active Authentication on a passport but am struggling to extract the EC Public Key and verify the signed data. I'm using Python with the Cryptodome library. I came across a ...
UKISU's user avatar
  • 101
1 vote
2 answers
99 views

Has the ideal "pairing" $\langle aG, bG\rangle \mapsto abG$ been ruled out conditionally?

Let $G$ be a prime order $Q$ elliptic curve over a prime field of size $P$ which admits the following mapping $f$ $f(aG, bG) = abG$ which can be computed in polynomial time in $\log(PQ)$. Is the ...
MERTON's user avatar
  • 225
1 vote
1 answer
52 views

EC private key check value by ECDH against base point

I am designing a general purpose software security module. One of my requirements is to "describe" a stored key, including a "check" value. The purpose of this "check" ...
Pedro Lamarão's user avatar
0 votes
1 answer
64 views

Set ECDLP complexity

Consider the following problem which is an easier version of the EC discrete log problem. Fix an elliptic curve and a generator $G$. Given an arbitrary set of points $S$, the task is to find $k$ such ...
MERTON's user avatar
  • 225
0 votes
1 answer
57 views

Complexity of DLP vs ECDLP in MOV attack

In MOV attack we convert the ECDLP problem to a DLP problem in field of $F_{p^2}$ (assuming the embedding degree is 2). According to the answer here, the complexity of solving this DLP is $e^{(1.92+o(...
user120250's user avatar
1 vote
0 answers
44 views

Are there real-world applications of point halving on an elliptic curve over a finite field of prime characteristic?

Let $E\!: y^2 = x^3 + ax + b$ be an elliptic curve over a finite field $\mathbb{F}_{\!q}$ of prime characteristic $p$ (mostly, $q = p$ in practice). It is well known that in the $\mathbb{F}_{\!q}$-...
Dimitri Koshelev's user avatar
0 votes
0 answers
50 views

Convert from one curve to another

How can I convert from one curve to another curve using X points, are there any formulas for that? ...
Dex's user avatar
  • 1
1 vote
1 answer
99 views

What exactly is a VRF?

Random numbers are useful in many use cases such as blockchain. I know many blockchains or smart contracts employ VRF to generate "provably fair random numbers". But what exactly is a VRF? I'...
Yan's user avatar
  • 111
1 vote
1 answer
72 views

How do Non-deterministic signatures in wallets leak key material

Downsides of not using deterministic ECDSA signatures for blockchain validation? here in the last answer it says: "With non-deterministic signatures, your hardware wallet might be leaking key ...
pes oves's user avatar
0 votes
0 answers
59 views

Why hashing when generating account from public key?

When producing an account out of public key it's a common approach to hash the latter multiple times (sometimes using different algos) before encoding and taking a portion of the product. Is this done ...
vladimir_1969_2's user avatar
1 vote
1 answer
72 views

Why do non-prime order curves faciliate efficient computation? [closed]

Most common elliptic curves in use today (Edwards, Montgomery and the likes) have small cofactors. The reason we seem to want these curves in practice is because they facilitate fast scalar ...
honest-but-curious's user avatar
2 votes
1 answer
89 views

Is EC_POINT_is_on_curve a necessary check when using EC_POINT_mul in openssl?

I'm using EC_POINT_mul in OpenSSL, and I would like to avoid an invalid curve attack. I can see that there is a check for ...
John's user avatar
  • 21

1
2 3 4 5
46