Questions tagged [elliptic-curve-generation]

ECC is an approach to public-key cryptography based on the algebraic structure of elliptic curves over finite fields. ECC allows smaller keys compared to non-EC cryptography (based on plain Galois fields) to provide equivalent security. Elliptic curves are applicable for key agreement, digital signatures, pseudorandom generators, and other tasks. they can be used for encryption by combining the key agreement with an asymmetric encryption scheme.

Filter by
Sorted by
Tagged with
2 votes
0 answers
37 views

Generating pairs of elliptic $\mathbb{F}_q$-curves isogenous over $\mathbb{F}_q$ such that nobody knows an $\mathbb{F}_q$-isogeny between them

Let $\mathbb{F}_q$ be a large finite field. What if I invent how to efficiently construct pairs of elliptic "cryptographically strong" $\mathbb{F}_q$-curves $E_1$, $E_2$ isogenous over $\...
user avatar
2 votes
1 answer
72 views

Follow-up II: Number of points on an elliptic curve

Context: paper on pairing based cryptography, question 1, question 2. Let $E: y^2 = x^3+x$ be an elliptic curve over $\mathbb{F}_{q}$ where $q=3^m$ for some $m\geq 1$. Then I know that $$ \# E(\mathbb{...
user avatar
2 votes
1 answer
87 views

Follow-up: Number of points on an elliptic curve

Consider this question. Say I would want to do something similar for $E_2:y^2=x^3−x+1$ over $\mathbb{F}_{3^m}$. How would I proceed?
user avatar
3 votes
1 answer
122 views

Number of points on an elliptic curve

In his paper on pairing based cryptography, Menezes claims that for $$ E_1: y^2+y = x^3+x+1 $$ the number of $\mathbb{F}_{2^m}$-points is $2^m +1 - (1+i)^m - (1-i)^m$. Whereas this is clear, it is not ...
user avatar
1 vote
1 answer
82 views

Distribution of elliptic curves with rank 2?

An elliptic curve defined over a finite field is either cyclic, or a direct sum of two cyclic groups. In cryptography, we use exclusively the former. I was wondering if there is any result on how ...
user avatar
1 vote
0 answers
32 views

How is ECDH shared secret represented in SoftHSM

I am working on implementing ECDH with some HSM. According to the theory behind ECDH, the generated shared secret is a point on the elliptic curve (x, y) which is exactly what is returned by the HSM. ...
user avatar
4 votes
3 answers
647 views

Do you know protocols, where it is necessary to obtain several "independent" points on the same elliptic curve?

Consider an elliptic curve $E$ defined over a finite field $\mathbb{F}_{\!q}$ with a fixed non-zero $\mathbb{F}_{\!q}$-point $P$. For simplicity, let the order of the $\mathbb{F}_{\!q}$-point group $E(...
user avatar
1 vote
1 answer
282 views

What is the order of the generator point G=9 in curve25519?

In Curve25519 we typically have this generator point or base point: ...
user avatar
  • 1,315
0 votes
0 answers
150 views

What attacks exist on ECDSA if there are more than 10 million signatures?

I am aware that there are weaknesses in ECDSA when reusing NONCE and I am aware that there is a lattice attack on ECDSA. Are ...
user avatar
  • 3
3 votes
0 answers
284 views

Elliptic Curve how to calculate y value [duplicate]

I have been reading the book Mastering Bitcoin written by Andreas. It was the process of compressing public keys that hurt my mind. Specifically, a public key after being generated from a private key ...
user avatar
2 votes
2 answers
385 views

Modulo p in Elliptic Curve Cryptography

To carry out Elliptic Curve Cryptography between parties, are all elliptic curve equations considered to be in the form $\bmod p$? For example, the $secp256k1$ Bitcoin curve of the equation $y^2=x^3+7$...
user avatar
3 votes
2 answers
446 views

Can two different hash function create two unlinkable `ed25519` keys from the same randomness?

Assume the following scenario: Alice has access to 32 bytes of true randomness $s$. Alice hashes $s$ with SHA-512, and uses the resulting hash as the secret $d_{A}$ for ...
user avatar
5 votes
1 answer
172 views

Why is Montgomery Ladder fast on Montgomery Curves?

When I look at the Montgomery Ladder algorithm, I don't find anything that is specific to the Montgomery curve. We are dealing with the points all the time i.e. we are either adding two points or ...
user avatar
0 votes
0 answers
54 views

How to decompose a public key into subgroups EC?

Is it possible to decompose the public key into its own subgroups? Suppose we know the order P with which the public key was generated ...
user avatar
0 votes
0 answers
62 views

How to get a common coordinate from two different coordinates on Elliptic Curves? [duplicate]

I am trying to write a SageMath script that multiplies two coordinates on Elliptic Curves into one common coordinate. SageMath Elliptic curves over finite fields ...
user avatar
2 votes
1 answer
193 views

How to find out what the order of the base point of the elliptic curve is?

I wanted to use https://github.com/AntonKueltz/fastecdsa library and the function parameters for creating curve are: ...
user avatar
0 votes
0 answers
86 views

Is it possible to get the x point of the secp256k1 elliptic curve knowing only the y point

There is a list where, using the coordinates of the x points, it was determined whether there are points in the curve Here's a link It can be seen that the generator according to the formula ...
user avatar
0 votes
1 answer
55 views

what does "product of two cyclic groups" mean

I am reading "Elliptic curve cryptosystems" and the link is here(https://www.ams.org/journals/mcom/1987-48-177/S0025-5718-1987-0866109-5/S0025-5718-1987-0866109-5.pdf). I don't understand ...
user avatar
8 votes
2 answers
898 views

Why Elliptic Curve Cryptography protocols depend on fixed curves?

I'm learning about Ed25519. It depends on a bunch of magic values: The finite field of order $2^{255}-19$, the specific elliptic curve over that field, a specific ...
user avatar
  • 181
1 vote
1 answer
109 views

ECDH public keys restrictions

I know that Bob can calculate the shared DH key without knowing the private key. If he sends to Alice a public key = 1, then the the DH key would be 1. Can i achieve something like this in ECDH? where ...
user avatar
4 votes
3 answers
287 views

Order of Edwards curve and its twist

In Mike Hamburg's Ed448-Goldilocks, a new elliptic curve (eprint 2015, WECCS 2015) it is studied untwisted Edwards curves in the prime field $\mathbb F_p$ $$E_d:\,y^2+x^2\,=\,1+d\,x^2\,y^2$$ with ...
user avatar
  • 125k
1 vote
2 answers
214 views

How to generate a random point on an elliptic curve without knowing it's corresponding scalar private key

Given an elliptic curve with generator $G$, is it possible to generate a random point on the curve $Q = a \cdot G$ without knowing the secret value $a$ that generated it? Note that just using an $a$ ...
user avatar
  • 335
3 votes
1 answer
201 views

In The Ristretto Group, do all points sampled with Elligator have the same order?

Assume the Hash-to-ristretto255 function Elligator as laid out here. Assume a random hash that is then mapped to a point in the <...
user avatar
0 votes
1 answer
287 views

Deterministic Key using a seed for ECNamedCurve

I am trying to generate deterministic keys using EC curve secp521r1 in java. I went through KDF but, couldn't find any references to use it with EC curves. I would appreciate if someone could point me ...
user avatar
0 votes
2 answers
175 views

Break El Gamal for Elliptic Curves

There is an elliptic curve El Gamal digital signature scheme. Alice fixes an elliptic curve $E$, a prime $p$, a point $A$ on $E$, a secret integer $a$, and computes $B = aA$. She makes $(E, ...
user avatar
0 votes
2 answers
318 views

The Generator point and Mod P in ECDSA

I've been reading about The discrete logarithm problem as of recent and i decided to try it out on a small portion of numbers myself and i actually came to a mental gridlock after watching this Video....
user avatar
1 vote
0 answers
58 views

Why is it necessary that the mod in an elliptic curve is a prime? [duplicate]

For the elliptic curve y^2 = x^3+2x+2 mod(23), why is it necessary that 23 is a prime. Why is the elliptic curve y^2 = x^3+2x+2 mod(24) not suitable for elliptic curve cryptography?
user avatar
1 vote
1 answer
216 views

How are the points in an elliptic curve over the finite field calculated?

For the elliptic curve with equation $y^2 = x^3 + x + 0 \pmod{13}$ in the finite field, how are all the points in this curve calculated. See the image below for an example created via https://graui.de/...
user avatar
1 vote
0 answers
89 views

SafeCurves verification script

The SafeCurves project provides a Sage script to verify the SafeCurves criteria for given curves, https://safecurves.cr.yp.to/verify.html According to the description, the script works simply as: $ ...
user avatar
2 votes
1 answer
156 views

Diffie Hellman groups

I saw that non-negative integers with the addition operation cannot be the Diffie Hellman group. I'm having trouble understanding why it cannot be the DHKE group. To be DHKE group, there are five ...
user avatar
1 vote
0 answers
87 views

Elliptic curve subgroup with $p$ elements in field of characteristic $p$

Are there any elliptic curves defined over a finite field $\mathrm{GF}(p^k)$ with a subgroup of order $p$ where the discrete log (and preferably DDH) problem is hard? Elliptic curve with prime ...
user avatar
  • 243
1 vote
2 answers
325 views

How to convert coordinates o a point from y^2=x^3+7 to y^2=x^3+4? [closed]

To moderator, this my question is not off topic !!! Please OPEN MY QUESTION. If for this place elliptic curves was off topic this so world is crazy. ...
user avatar
  • 11
3 votes
1 answer
293 views

Significance of y-coordinates in ECDH public key exchange

In the research paper Breaking the Bluetooth Pairing – The Fixed Coordinate Invalid Curve Attack? by Biham and Neumann, 2019, they talk about attacks in Bluetooth pairing, they state that in the ...
user avatar
  • 53
2 votes
1 answer
216 views

Calculate a base point on the twist of secp192k1 with maximal order

I want to calculate a base point on the twist of secp192k1 with maximal order. ...
user avatar
  • 21
1 vote
0 answers
52 views

How to maintain the width of the cipher image in ECC Image Encryption from Singh and Singh (2015)?

I am a beginner in cryptosystems and I hope I would be accepted in the community. I was trying to implement Singh and Singh (2015) ECC image encryption algorithm on Matlab. I have been able to ...
user avatar
2 votes
1 answer
434 views

Excluding specific factors for Pohlig-Hellman

I want to use Pohlig-Hellman and BSGS to solve the discrete log of an Elliptic Curve which has a composite order generator. The ...
user avatar
  • 1,264
3 votes
1 answer
104 views

Construction of secure Elliptic Curve subgroup over a much larger field

How can we construct an Elliptic Curve subgroup of cryptographic interest out of an Elliptic Curve over a much larger finite field, including the familiar $\Bbb F_p$ for prime $p$? The Discrete ...
user avatar
  • 125k
4 votes
1 answer
237 views

Probability of a prime number of points on an elliptic curve over a prime field

Suppose we have some elliptic curve defined over $\mathbb F_p$, with $p$ a large prime. Let $n$ be the number of points on the curve. I am interested in what is currently known about the probability* ...
user avatar
2 votes
0 answers
88 views

Elliptic curve of order $p = 2q + 1$

Does anyone know an example of an Elliptic Curve of caracteristic $p$ ($E_p$) that has a point generator $G$ that generates a subgroup of order $q$, with $p$, $q$ being prime numbers and $p = 2q + 1$?
user avatar
  • 515
0 votes
1 answer
263 views

Division of Point in Elliptic Curve: Getting Back Point

Let $P=(x_p,y_p)$ be a point on elliptic curve $E (a, b) := y^2=x^3+ax+b$, for an integer $n$, there exists a point $Q=(x_q,y_q)=nP$ on $E (a, b)$. If $(x_q,y_q)$ and $n$ are given, what is the ...
user avatar
1 vote
0 answers
99 views

Elliptic Curve (Point Counting)

I am studying elliptic curves in particular point counting. If I have coordinates P and 2P, is there a way to calculate the total points in between P and 2P using either curve parameters or algorithm? ...
user avatar
1 vote
0 answers
96 views

Need help understanding SPAKE2 setup values

I am trying to write a simulation of the SPAKE2 protocol in python (just so I can get a better understanding of the protocol altogether). I am reading through the ietf draft here: Datatracker. There'...
user avatar
0 votes
1 answer
413 views

Order of subgroups formed by Elliptic Curves with a Cofactor

In this question: Why are the lower 3 bits of curve25519/ed25519 secret keys cleared during creation? The answer indicates that the order of all points on the curve over the finite field ...
user avatar
  • 1,264
0 votes
0 answers
66 views

Difference in elliptic curve order and finite field size [duplicate]

Must the prime finite field, Fp, an elliptic curve is defined over always have a greater number of elements than the cardinality of an elliptic curve. For example, If I have ...
user avatar
1 vote
1 answer
376 views

Point doubling with only one coordinate

In many source codes that implement ECDH, there is a function that multiplies the base point of that curve with a constant. This function usually takes as arguments the constant and just one ...
user avatar
  • 317
3 votes
0 answers
174 views

Check validity of generated parameters for SIDH

In section 4.1 of the paper Towards quantum-resistant Cryptosystems From Supersingular Elliptic Curve Isogenies by Feo, Jao and Plût it is described how you generate valid parameters for the SIDH ...
user avatar
  • 31
5 votes
1 answer
7k views

curve25519 by openSSL

How can i generate ec curve25519 keys using openSSL? When I run openssl ecparam -name curve25519 -genkey -noout -out private.ec.key I have this message ...
user avatar
1 vote
1 answer
283 views

Does any problem arise when the order of an elliptic curve is equal to its prime field modulus? [duplicate]

Regarding cryptographic schemes in elliptic curve cryptography, is there a problem with having the order of an elliptic curve being equal to its prime field modulus? That is, an elliptic curve where $...
user avatar
  • 163
0 votes
0 answers
134 views

Modifying Elliptic Curve Parameters

For context, I was watching this bit of the video: which goes over this source code. The piece is about elliptic curve cryptography and how it works. I want to use some of this knowledge to make my ...
user avatar
  • 163
0 votes
0 answers
91 views

Isogeny of elliptic curve

If we have two elliptic curves $E$ and $E'$ and the points of both elliptic curves are same. Then all the points of $E$ map to all the points of another elliptic curve $E'$. For example $E$ has ...
user avatar
  • 1