Questions tagged [elliptic-curve-generation]
ECC is an approach to public-key cryptography based on the algebraic structure of elliptic curves over finite fields. ECC allows smaller keys compared to non-EC cryptography (based on plain Galois fields) to provide equivalent security. Elliptic curves are applicable for key agreement, digital signatures, pseudorandom generators, and other tasks. they can be used for encryption by combining the key agreement with an asymmetric encryption scheme.
125
questions
0
votes
1
answer
73
views
What does AZ^4 = -3 (mod p) mean in the context of elliptic curve cryptography?
In the documentation of TeraFire® cryptocore, the following statement is given (page 14):
For For elliptic curves of the form y² = x³ + Ax + B, if there exists a solution to AZ^4 = -3 (mod p), then [....
0
votes
1
answer
54
views
Using a public key's points (other than the generator point) to calculate the order of the group (SECP256k1)?
Imagine if we were on a mission to try to calculate the order of the cyclic group $n$
...
- 49
1
vote
1
answer
76
views
in elliptic curve over finite field we get two values of y for each x now how can we draw elliptic curve using these points?
as we can see in the image one side elliptic is wrapping around torus in clockwise and other in anticlockwise direction my question is when we find two values of y for each x how can we know which y ...
- 11
0
votes
1
answer
77
views
Getting the slope of a public key given its x and y coordinates
Is it possible to get the slope of a public key given its $x$ and $y$ coordinates?
Since all the ECC calculations come from geometry, I thought this calculation might be possible.
- 11
1
vote
2
answers
183
views
Example of elliptic curves endomorphism construction
I've started learning about complex multiplication (CM) on elliptic curves. For clarity (and intuition), I want to make some basic example of elliptic curves endomorphism construction for a concrete ...
2
votes
1
answer
64
views
Is it possible to generate an elliptic curve (with the hard discrete logarithm problem) by iterating only a finite field, but not its $j$-invariant?
Let me ask one question. Maybe, you know an answer. Thanks in advance for any response.
Let's fix an elliptic curve $E$ over the field $\mathbb{Q}$ of rationals without complex multiplication, i.e., ...
- 425
1
vote
0
answers
62
views
Creating a weak BLS
I am exploring the implementation of a cryptographic signature that users can manually input, and I am willing to compromise security to a level where a hacker investing several thousand dollars in ...
- 51
2
votes
1
answer
187
views
Generating pseudorandom numbers using Dual_EC_DRBG
I am currently learning about the Dual_EC_DRBG protocol and I am stuck at the calculation of the initial state with the point P. For context, I am using the secp256k1 curve with a = 0 and b = 7. I ...
- 21
3
votes
1
answer
164
views
Standard Montgomery curves over prime field
Is there some source of standard, vetted, efficient Montgomery elliptic curves over prime field?
I'm looking for curves $B\,y^2\equiv x^3+A\,x^2+x\pmod p$ engineered for efficient computation of ...
- 144k
0
votes
0
answers
85
views
Generating a new curve using an existing curve and new prime
Can you take a curve equation from https://safecurves.cr.yp.to and a large safe prime from existing DH parameters (for example openssl dhparam 9000), combine them, ...
user113099
3
votes
0
answers
223
views
EC public key with leading zeros
Let us take example of secp256k1 curve. The current known public key with most leading zero (in x cordinate) is:
...
- 674
0
votes
0
answers
47
views
Practical deployments of ECC with cofactor of elliptic curves $4$ or $8$?
Are cofactor $4$ and $8$ ECC schemes widely used in practical deployments such as those in cryptocurrencies?
Can you name some practical settings where there curves are used and cryptocurrencies where ...
- 972
0
votes
1
answer
110
views
Non-interactive EC DKG (Distributed Key Generation) question
Normally, when computing an EC threshold DKG, I have all parties reveal a commitment to the public key, and only reveal their own public key after verifying the commitments. Otherwise it's trivial ...
- 450
5
votes
1
answer
378
views
Binary Elliptic Curves Point Doubling Formula - Calculate Lambda from P3
As I am studying ordinary (non-supersingular) binary elliptic curves in the Guide to ECC book by Hankerson (Section 3.1, page 81), for point doubling, the equations presented in the book are:
$x_3 = \...
- 53
2
votes
2
answers
219
views
Can you find a secure curve defined over the scalar field of secp256k1?
Is it possible to find a secure curve which's base field is the scalar field of secp256k1?
In general, can you find a secure curve defined over the scalar field of any secure curve? (For example, a ...
- 361
1
vote
1
answer
67
views
Scalar Multiplication using NAF method
I am learning about Elliptic curve scalar multiplications and I am on NAF, and I am trying to figure out the concept.
What I understand is if I have K=27 with using ...
- 241
2
votes
0
answers
255
views
Forging an ECDSA signature for a random public key string
An adversary is able to insert a random string (which he does not control: he can only randomly generate it and insert it). The random string is parsed by the victim as an ECDSA public key. This ...
- 83
2
votes
1
answer
163
views
What is the equation to get P-Q in Montgomery curve XZ coordinates
Based on Differentia-addition on P I can understand (Xp,Zp) which is the base point, (Xq,Zq) which comes from Doubling, but I ...
- 241
3
votes
1
answer
549
views
Criteria for choice of prime field in secp256k1?
In secp256k1, the prime order field $\mathbb F_p$ uses
$$p=2^{256}-2^{32}-977$$
This is the largest prime $p$ less than $2^{256}-2^{32}$ allowing to construct a Koblitz curve $y^2\equiv x^3+b\bmod p$ ...
- 144k
2
votes
1
answer
242
views
Elliptic curve Jacobian coordinates example
I am working on Matlab Jacobian coordinates, I want a jacobian coordinates example with numbers include doubling and additions based on k value to test the code if ...
3
votes
1
answer
200
views
Elliptic Curve NAF scalar method
I am new in Elliptic curve and I got a lot of knowledge through reading :) but I reached to NAF method as a scalar multiplication method, but don't understand how in this example get it:
...
- 241
1
vote
1
answer
2k
views
How to know if a public key has been created based on the ECDSA algorithm?
Suppose in a network, the identity of users is their public key, which is generated based on the ECDSA algorithm. That is, to create a valid identity, a user must generate an ECDSA public key and then ...
- 211
0
votes
0
answers
205
views
Fast methods for adding the basepoint to an elliptic curve point?
Are there any clever (fast) methods for adding the basepoint (generator) to an arbitrary point on elliptic curve, finally ending in affine coordinates?
I.e. if G is ...
- 1
2
votes
2
answers
259
views
How is the edwards448 generator derived from the curve448 generator in RFC 7748?
In RFC 7748, it is explained how the Montgomery curve, curve448, is deterministically generated from the prime $p = 2^{448} - 2^{224} - 1$. It is also explained how the generator (given below) for ...
- 45
2
votes
0
answers
58
views
Generating pairs of elliptic $\mathbb{F}_q$-curves isogenous over $\mathbb{F}_q$ such that nobody knows an $\mathbb{F}_q$-isogeny between them
Let $\mathbb{F}_q$ be a large finite field. What if I invent how to efficiently construct pairs of elliptic "cryptographically strong" $\mathbb{F}_q$-curves $E_1$, $E_2$ isogenous over $\...
- 425
2
votes
1
answer
82
views
Follow-up II: Number of points on an elliptic curve
Context: paper on pairing based cryptography, question 1, question 2.
Let $E: y^2 = x^3+x$ be an elliptic curve over $\mathbb{F}_{q}$ where $q=3^m$ for some $m\geq 1$.
Then I know that
$$
\# E(\mathbb{...
- 177
2
votes
1
answer
105
views
Follow-up: Number of points on an elliptic curve
Consider this question.
Say I would want to do something similar for $E_2:y^2=x^3−x+1$ over $\mathbb{F}_{3^m}$. How would I proceed?
- 177
3
votes
1
answer
155
views
Number of points on an elliptic curve
In his paper on pairing based cryptography, Menezes claims that for
$$
E_1: y^2+y = x^3+x+1
$$
the number of $\mathbb{F}_{2^m}$-points is $2^m +1 - (1+i)^m - (1-i)^m$. Whereas this is clear, it is not ...
- 177
1
vote
1
answer
145
views
Distribution of elliptic curves with rank 2?
An elliptic curve defined over a finite field is either cyclic, or a direct sum of two cyclic groups. In cryptography, we use exclusively the former. I was wondering if there is any result on how ...
- 119
1
vote
0
answers
256
views
How is ECDH shared secret represented in SoftHSM
I am working on implementing ECDH with some HSM. According to the theory behind ECDH, the generated shared secret is a point on the elliptic curve (x, y) which is exactly what is returned by the HSM.
...
- 11
4
votes
3
answers
681
views
Do you know protocols, where it is necessary to obtain several "independent" points on the same elliptic curve?
Consider an elliptic curve $E$ defined over a finite field $\mathbb{F}_{\!q}$ with a fixed non-zero $\mathbb{F}_{\!q}$-point $P$. For simplicity, let the order of the $\mathbb{F}_{\!q}$-point group $E(...
- 425
1
vote
1
answer
1k
views
What is the order of the generator point G=9 in curve25519?
In Curve25519 we typically have this generator point or base point:
...
- 1,387
0
votes
0
answers
719
views
What attacks exist on ECDSA if there are more than 10 million signatures?
I am aware that there are weaknesses in ECDSA when reusing NONCE and I am aware that there is a lattice attack on ECDSA.
Are ...
- 3
3
votes
0
answers
295
views
Elliptic Curve how to calculate y value [duplicate]
I have been reading the book Mastering Bitcoin written by Andreas. It was the process of compressing public keys that hurt my mind. Specifically, a public key after being generated from a private key ...
- 85
4
votes
2
answers
2k
views
Modulo p in Elliptic Curve Cryptography
To carry out Elliptic Curve Cryptography between parties, are all elliptic curve equations considered to be in the form $\bmod p$?
For example, the $secp256k1$ Bitcoin curve of the equation $y^2=x^3+7$...
- 43
3
votes
2
answers
513
views
Can two different hash function create two unlinkable `ed25519` keys from the same randomness?
Assume the following scenario:
Alice has access to 32 bytes of true randomness $s$.
Alice hashes $s$ with SHA-512, and uses the resulting hash as the secret $d_{A}$ for ...
- 357
5
votes
1
answer
406
views
Why is Montgomery Ladder fast on Montgomery Curves?
When I look at the Montgomery Ladder algorithm, I don't find anything that is specific to the Montgomery curve. We are dealing with the points all the time i.e. we are either adding two points or ...
0
votes
0
answers
151
views
How to decompose a public key into subgroups EC?
Is it possible to decompose the public key into its own subgroups?
Suppose we know the order P with which the public key was generated ...
0
votes
0
answers
70
views
How to get a common coordinate from two different coordinates on Elliptic Curves? [duplicate]
I am trying to write a SageMath script that multiplies two coordinates on Elliptic Curves into one common coordinate.
SageMath Elliptic curves over finite fields ...
4
votes
1
answer
928
views
How to find out what the order of the base point of the elliptic curve is?
I wanted to use https://github.com/AntonKueltz/fastecdsa library and the function parameters for creating curve are:
...
0
votes
1
answer
113
views
what does "product of two cyclic groups" mean
I am reading "Elliptic curve cryptosystems" and the link is here（https://www.ams.org/journals/mcom/1987-48-177/S0025-5718-1987-0866109-5/S0025-5718-1987-0866109-5.pdf）. I don't understand ...
8
votes
2
answers
1k
views
Why Elliptic Curve Cryptography protocols depend on fixed curves?
I'm learning about Ed25519. It depends on a bunch of magic values: The finite field of order $2^{255}-19$, the specific elliptic curve over that field, a specific ...
- 181
1
vote
1
answer
272
views
ECDH public keys restrictions
I know that Bob can calculate the shared DH key without knowing the private key. If he sends to Alice a public key = 1, then the the DH key would be 1.
Can i achieve something like this in ECDH? where ...
4
votes
3
answers
739
views
Order of Edwards curve and its twist
In Mike Hamburg's Ed448-Goldilocks, a new elliptic curve (eprint 2015, WECCS 2015) it is studied untwisted Edwards curves in the prime field $\mathbb F_p$
$$E_d:\,y^2+x^2\,=\,1+d\,x^2\,y^2$$
with ...
- 144k
1
vote
2
answers
620
views
How to generate a random point on an elliptic curve without knowing it's corresponding scalar private key
Given an elliptic curve with generator $G$, is it possible to generate a random point on the curve $Q = a \cdot G$ without knowing the secret value $a$ that generated it? Note that just using an $a$ ...
- 335
3
votes
1
answer
374
views
In The Ristretto Group, do all points sampled with Elligator have the same order?
Assume the Hash-to-ristretto255 function Elligator as laid out here. Assume a random hash that is then mapped to a point in the <...
0
votes
1
answer
877
views
Deterministic Key using a seed for ECNamedCurve
I am trying to generate deterministic keys using EC curve secp521r1 in java. I went through KDF but, couldn't find any references to use it with EC curves. I would appreciate if someone could point me ...
- 103
0
votes
2
answers
243
views
Break El Gamal for Elliptic Curves
There is an elliptic curve El Gamal digital signature scheme. Alice fixes an elliptic curve $E$, a prime $p$, a point $A$ on $E$, a secret integer $a$, and computes $B = aA$. She makes $(E, ...
0
votes
2
answers
955
views
The Generator point and Mod P in ECDSA
I've been reading about The discrete logarithm problem as of recent and i decided to try it out on a small portion of numbers myself and i actually came to a mental gridlock after watching this Video....
- 35
1
vote
0
answers
60
views
Why is it necessary that the mod in an elliptic curve is a prime? [duplicate]
For the elliptic curve y^2 = x^3+2x+2 mod(23), why is it necessary that 23 is a prime. Why is the elliptic curve y^2 = x^3+2x+2 mod(24) not suitable for elliptic curve cryptography?
