All Questions
Tagged with ecc or elliptic-curves
2,278 questions
1
vote
1
answer
149
views
Mapping two different elliptic curve on same finite field
There exist two such question but I have noticed my question is fundamentally different as it asks for mapping between two different curves, rather two different prime field like this.
Given a finite ...
- 686
1
vote
2
answers
457
views
Understanding Pollard's Rho method for solving ECDLP
I am trying to understand illustrative example of Pollard's Rho method to solve ECDLP from the book "Guide to Elliptic Curve Cryptography"
I am referring to Algorithm 4.3 and Example 4.4
...
- 25
0
votes
1
answer
149
views
Which SafeCurves critics about Brainpool twisted curves apply to the corresponding random curves?
In SafeCurves: choosing safe curves for elliptic-curve cryptography, Daniel J. Bernstein and Tanja Lange characterize Brainpool curves of the twisted variety (e.g. brainpoolP256t1) as not "Safe&...
- 145k
0
votes
3
answers
127
views
Elliptic curves parameters data
Is there an official database with curve parameters for common curves? Asking for generator point, order, prime, a, b
I found one for secp256k1 in the mbedtls ...
2
votes
1
answer
689
views
BN254 specification?
Sorry for asking another question but is BN254 specification standardized? I am using two different implementations one python another solidity and the prime field $F_p,F_{p^2}$ and the the group ...
- 661
1
vote
2
answers
269
views
Challenge with curve ed25519
Recently a friend of mine showed me a "puzzle" he created with curve ed25519
It is based on adding and multiplying points on the curve
You supply three arguments to the program
...
- 11
1
vote
1
answer
77
views
Similar to Diffie Hellman for BLS in asymmetric pairing?
I had asked one question before One-More Computational Diffie-Hellman in asymmetric pairing groups and have not received answer. I am posing a supplementary question now that I just realized I don't ...
- 661
3
votes
2
answers
441
views
Cost of solving multiple Discrete Logarithm Problems in the same group
We consider the Discrete Logarithm Problem of finding integer $x$ random in $[0,n)$ where $n$ is the group order, given $Y=G^x$ (or $Y=xG$) computed in the group noted multiplicatively (or additively),...
- 145k
0
votes
0
answers
87
views
Generating a new curve using an existing curve and new prime
Can you take a curve equation from https://safecurves.cr.yp.to and a large safe prime from existing DH parameters (for example openssl dhparam 9000), combine them, ...
user113099
1
vote
1
answer
78
views
Difference between a a doubled point and a point from point addition
Are all doubled points on an elliptic curve even, meaning if you compress the point, it will have '02' plus the $x$ coordinate? If not, what distinguishes a doubled point from a point resulting from ...
- 11
0
votes
1
answer
155
views
Z-coordinate in Jacobian coordinates
secp256k1 Generator:(G_X, G_Y, 0x1),
secp256k1 any public key using affine coordinates : B=(X, Y)
secp256k1 any Public key using jacobian coordinates:BB=(P_X, P_Y, P_Z)
(B's private key)==(BB's ...
- 23
1
vote
1
answer
87
views
Probability when representing message as a point on elliptic curve
There is a very popular method to represent a message $m$ (number) as a point on elliptic curve over a finite field:
Set $i = 0$
Check whether $m'=m\cdot K+i$ is on elliptic curve. If not, try again ...
- 13
1
vote
1
answer
171
views
Point doubling for a point on Elliptic Curve (15,13) + (15,13) = (2,)
Consider the elliptic curve E1:y2=x3+7 over F17 with the base point G=(15,13)
I am trying to compute point double of (15,13) i.e (15,13)+ (15,13)
Expected point is (2,10) , however I am not able to ...
- 25
5
votes
1
answer
272
views
Integrating Elligator mapping with libsodium Curve25519 implementation
I'm currently working on a project where I want to map Curve25519 public keys to uniformly random noise. The main idea is that when these transformed public keys are sent over a network, an outsider ...
- 95
0
votes
0
answers
65
views
Ed25519 and sealed boxes libsodium
Accidentally used ed25519 public key to create libsoidum_sealed_box. Is there any way to decrypt the data if the private key ed25519 is known?
3
votes
0
answers
254
views
EC public key with leading zeros
Let us take example of secp256k1 curve. The current known public key with most leading zero (in x cordinate) is:
...
- 686
1
vote
0
answers
73
views
Does ECC give the most secure assymetric cipher for a given public key size?
Cracking an ideal block cipher is basically a brute force key enumeration. The complexity of the attack is exponential, growing as $2^b$. Cracking ECC is also exponential, but the cost grows as $2^{\...
- 21
3
votes
1
answer
2k
views
Why do we need additional secret value (k) in ECDSA?
Formula for calculating an ECDSA signature (r, s) is:
s = k-1(z + qr)
k - private key for a random point R
z - hash of a message
q - original private key
r - x(R)
I am interested in why do we need ...
- 133
2
votes
1
answer
294
views
Is there an algebra group (or ring) in which computing the inverse element is hard without some trapdoor information?
Specifically, I want an algebra group $G$ (or ring $R$) features:
Given elements $g,h\in G$ (or $R$ ), computing $g\cdot h \in G$ (or $R$ ) is easy.
Given an element $g \in G$ (or $R$ ), finding the ...
- 456
0
votes
3
answers
402
views
Understanding Point Negation in secp256k1 Elliptic Curve
I'm exploring the secp256k1 elliptic curve in the context of cryptography and encountered the concept of Point negation. I would appreciate clarification on what point negation means in this context.
...
- 41
1
vote
0
answers
70
views
Can the byte overhead of an ECDH based hybrid cryptosystem be reduced by encoding data in ephemeral key?
Motivation
I have a use case that involves sending small (25-50 byte) encrypted messages over a very constrained channel. Many senders send public key encrypted messages to other receivers. Anonymity (...
- 1,751
0
votes
0
answers
267
views
Efficiently using BSGS or other algorithms if key range is known on Elliptic Curves
Let $X$ be a point on an elliptic curve such that $X = [x]G$, where $G$ is a generator. Let us assume that we know $x$ is something $x = 65t + 1$ where $t$ is an integer.
Now if I know that the key ...
- 686
0
votes
1
answer
429
views
Implementing Floor Division on secp256k1 Elliptic Curve in Python
I understand that the // operator is used for floor division in regular arithmetic
result = 7 // 3 # This will result in 2
but ...
- 41
1
vote
1
answer
707
views
Key exchange for encrypted firmware update
I'm trying to implement encrypted firmware update functionality for an embedded device. The goal is to prevent reverse engineering of our firmware when the update files are shared with our customers.
...
- 33
2
votes
1
answer
169
views
Recover Y coordinate from xz elliptic curve multiplication
I have an elliptice curve in the form
y² = x³ + ax + b (mod p)
And I have a multiplication algortihm which uses only x and z coordinate
How can I recover the Y coordinate ?
I tried to use the curve ...
- 21
2
votes
2
answers
144
views
Is it possible to check pedersen commitment is of postive or negative number without knowing the original value
I generated a Pedersen commitment for a given account balance (say, 10) and stored it in the ledger. Now, when I debit 15 tokens from the same account, I first retrieve the Pedersen commitment of 10 ...
- 21
2
votes
0
answers
51
views
SRP on elliptic curves: replacing + and - operations?
I was thinking about how SRP might be used with Curve25519 or Curve448. In this question, Can SRP be used with Elliptic Curves?, the answer is that you can't directly translate SRP to a group that ...
- 2,625
1
vote
1
answer
206
views
Double- and -add algorithm
I am currently doing the elliptic curves and I'm stuck for 8 hours without finding solutions. I under stand the process of double and add but don't know how to obtain 5 * 8P = 4OP =11 P. 11 P was in ...
- 11
1
vote
1
answer
530
views
Finding scalar in scalar multiplication on secp256k1 elliptic curve
In elliptic curve cryptography using the secp256k1 curve, how can I determine the number of times the base point $G$ has been multiplied to derive a new point? The formula is as follow:
$k * G = Q$
...
- 21
2
votes
1
answer
92
views
What would be the security consequences of replacing $H(R, A, M)$ with $H(R, M)$ in EdDSA?
The question is mainly stated in the title. We don't consider any other changes to the scheme except for the following:
We replace $S = H(R,A,M) \cdot a + r$ with $S = H(R,M) \cdot a + r$.
My thoughts ...
- 992
3
votes
0
answers
119
views
Elliptic Curve Scalar Multiplication - Boneh & Shoup
I'm currently reading the 'A Graduate Course in Applied Cryptography' paper written by Boneh and Shoup. More precisely, I'm reading the chapter about 'Elliptic Curve' and I'm stuck at the exercise ...
- 31
-1
votes
1
answer
284
views
Why don't secp256k1 use a prime order subgroup?
Using a prime order subgroup prevents mounting a Pohlig–Hellman algorithm attack. Meanwhile, secp256k1 doesn't use a ...
- 491
2
votes
1
answer
262
views
Which benefits do Twists of elliptic curves bring?
I understand that an elliptic curve $E$ over a field $K$ has an associated twist, that is another elliptic curve which is isomorphic to $E$ over an algebraic closure of $K$.
Which cryptographic ...
- 491
0
votes
1
answer
98
views
can secrets be deciphered from the proofs generated with ZK-Snarks if a quantum attack were plausible?
can secrets be deciphered from the proofs generated with ZK-Snarks if a quantum attack were plausible?
I understand the concern that ZK-snarks and some of their cryptography may be broken by quantum ...
- 3
0
votes
0
answers
70
views
Framework for manipulating digital signatures
for a research project, i am currently looking for a way to manipulate the digital signature of a HTTPS TLS message flow. More specifically, i am trying to create a working example for a malicious ...
2
votes
2
answers
349
views
Elliptic curves over extension fields
I'm trying to understand which benefits can using of extension fields in elliptic curve cryptography bring over prime fields. Popular curves like secp256k1, curve25519, secp384r1 are defined over a ...
- 491
-1
votes
1
answer
367
views
Can the public key be derived from the private key? [closed]
The calculation/formula i use in deriving a public key from the private key without importing any module in python3 script involves the following steps:
Define the parameters of the secp256k1 ...
3
votes
2
answers
452
views
Could a EC public key have zero coordinate?
Take secp256r1 as an example, the parameter of the curve is
...
- 133
-2
votes
1
answer
198
views
Validating slope (s) in secp256k1 elliptic curve
knowing the coordinates of $R$ on secp256k1 and an integer $s$, how do we validate that $s$ is the slope at the point $Q$ on secp256k1 such that $R=2Q$ ?
- 45
2
votes
1
answer
542
views
Point halving formula for Koblitz curve over prime field
Consider a Koblitz elliptic curve over a prime field $\mathbb F_p$, with equation $y^2=x^3+b$, prime order $n$ close to (but different from) $p$. This includes secp256k1, secp224k1, secp192k1, ...
- 21
3
votes
0
answers
78
views
Real-world protocols based on pairings such that the number of additions in $\mathbb{G}_1$ is equal to the number of additions in $\mathbb{G}_2$
Consider a pairing-friendly elliptic curve $E$ over a finite field $\mathbb{F}_q$ with embedding degree $k$. Do you know examples of real-world cryptographic protocols based on pairings $\mathbb{G}_1 \...
- 425
-1
votes
1
answer
303
views
How to convert (Rx1 and Ry1) to (Rx2 and Ry2)
I'm working with the secp256k1 elliptic curve and have point doubling and point addition formulas for this curve.
If a point is given $Q_x$ and $Q_y$
...
- 45
0
votes
0
answers
82
views
Same message different nonce but similarities in r value of the signatures(r,s)
I'm studying a case where when i sign a same message with the same private key and a different nonce, i sometimes get signatures (r,s) where r values share some similarities (same numbers at the same ...
- 101
-2
votes
2
answers
529
views
How to map elements from subgroup to larger subgroup of its parent group?
The following context is based on elliptic curves in short-weierstrass form y^2 = x^3 + b.
pls read carefully-
I am looking for a function/formula/algorithm that can be applied on any curve, say for e....
- 5
0
votes
3
answers
359
views
Can I move elements from cyclic subgroup to its cyclic parent group?
The following context is based on elliptic curves in short-weierstrass form y^2 = x^3 + b.
I know that elements of a non-prime order cyclic group G can be moved to its subgroup H by a process called &...
- 5
1
vote
2
answers
113
views
Zero Knowledge Argument for Elliptic Curve Multiplication/Inverse Multiplication Correctness?
I was reading this post and the accepted answer wrote about a way to “prove that some list of points $[A,B,C,...]$ when multiplied by $x$ produces $[A′,B′,C′,...]$”. However, in their explanation ...
9
votes
1
answer
2k
views
Who originally generated the elliptic curve now known as P256/secp256r1
Background: there is a theory going around that claims that P256 was backdoored by the NSA. The theory goes is that the NSA found a weakness that applies to a nontrivial fraction of elliptic curves (...
- 151k
0
votes
1
answer
83
views
Does BearSSL Library Support ECC Encryption/Decryption Functionality?
I'm researching cryptographic libraries for a project I'm working on, and I'm particularly interested in the BearSSL Library due to its lightweight nature. But I'm not sure if it supports ECC (...
- 1
0
votes
2
answers
454
views
Formula for deriving the x-coordinate using the y-coordinate (decompressing a compress public key)
According to my understanding a public key is made up of x and y coordinate and a compress public key is made up of the y-coordinate since it's possible to directly calculate the uncompress public key ...
- 45
9
votes
1
answer
903
views
Why does Ed25519 use a twisted Edwards curve rather than a regular Edwards curve?
I'm trying to understand benefits of using Twisted Edwards curve over regular Edwards curve. I'm aware of some properties of Twisted Edwards curve that regular Edwards curve missing like isomorphism ...
- 491