Questions tagged [elliptic-curve-generation]

ECC is an approach to public-key cryptography based on the algebraic structure of elliptic curves over finite fields. ECC allows smaller keys compared to non-EC cryptography (based on plain Galois fields) to provide equivalent security. Elliptic curves are applicable for key agreement, digital signatures, pseudorandom generators, and other tasks. they can be used for encryption by combining the key agreement with an asymmetric encryption scheme.

Filter by
Sorted by
Tagged with
2 votes
1 answer
47 views

Is it possible to generate an elliptic curve (with the hard discrete logarithm problem) by iterating only a finite field, but not its $j$-invariant?

Let me ask one question. Maybe, you know an answer. Thanks in advance for any response. Let's fix an elliptic curve $E$ over the field $\mathbb{Q}$ of rationals without complex multiplication, i.e., ...
Dimitri Koshelev's user avatar
1 vote
0 answers
55 views

Creating a weak BLS

I am exploring the implementation of a cryptographic signature that users can manually input, and I am willing to compromise security to a level where a hacker investing several thousand dollars in ...
Ehsan's user avatar
  • 51
2 votes
1 answer
147 views

Generating pseudorandom numbers using Dual_EC_DRBG

I am currently learning about the Dual_EC_DRBG protocol and I am stuck at the calculation of the initial state with the point P. For context, I am using the secp256k1 curve with a = 0 and b = 7. I ...
Nosticlov's user avatar
3 votes
1 answer
131 views

Standard Montgomery curves over prime field

Is there some source of standard, vetted, efficient Montgomery elliptic curves over prime field? I'm looking for curves $B\,y^2\equiv x^3+A\,x^2+x\pmod p$ engineered for efficient computation of ...
fgrieu's user avatar
  • 141k
0 votes
0 answers
83 views

Generating a new curve using an existing curve and new prime

Can you take a curve equation from https://safecurves.cr.yp.to and a large safe prime from existing DH parameters (for example openssl dhparam 9000), combine them, ...
user avatar
3 votes
0 answers
156 views

EC public key with leading zeros

Let us take example of secp256k1 curve. The current known public key with most leading zero (in x cordinate) is: ...
madhurkant's user avatar
0 votes
0 answers
47 views

Practical deployments of ECC with cofactor of elliptic curves $4$ or $8$?

Are cofactor $4$ and $8$ ECC schemes widely used in practical deployments such as those in cryptocurrencies? Can you name some practical settings where there curves are used and cryptocurrencies where ...
Turbo's user avatar
  • 908
0 votes
1 answer
89 views

Non-interactive EC DKG (Distributed Key Generation) question

Normally, when computing an EC threshold DKG, I have all parties reveal a commitment to the public key, and only reveal their own public key after verifying the commitments. Otherwise it's trivial ...
Erik Aronesty's user avatar
5 votes
1 answer
298 views

Binary Elliptic Curves Point Doubling Formula - Calculate Lambda from P3

As I am studying ordinary (non-supersingular) binary elliptic curves in the Guide to ECC book by Hankerson (Section 3.1, page 81), for point doubling, the equations presented in the book are: $x_3 = \...
prairie99's user avatar
2 votes
2 answers
188 views

Can you find a secure curve defined over the scalar field of secp256k1?

Is it possible to find a secure curve which's base field is the scalar field of secp256k1? In general, can you find a secure curve defined over the scalar field of any secure curve? (For example, a ...
RobinLinus's user avatar
1 vote
1 answer
53 views

Scalar Multiplication using NAF method

I am learning about Elliptic curve scalar multiplications and I am on NAF, and I am trying to figure out the concept. What I understand is if I have K=27 with using ...
Cisco Saeed's user avatar
2 votes
0 answers
194 views

Forging an ECDSA signature for a random public key string

An adversary is able to insert a random string (which he does not control: he can only randomly generate it and insert it). The random string is parsed by the victim as an ECDSA public key. This ...
Joe's user avatar
  • 73
2 votes
1 answer
140 views

What is the equation to get P-Q in Montgomery curve XZ coordinates

Based on Differentia-addition on P I can understand (Xp,Zp) which is the base point, (Xq,Zq) which comes from Doubling, but I ...
Cisco Saeed's user avatar
3 votes
1 answer
424 views

Criteria for choice of prime field in secp256k1?

In secp256k1, the prime order field $\mathbb F_p$ uses $$p=2^{256}-2^{32}-977$$ This is the largest prime $p$ less than $2^{256}-2^{32}$ allowing to construct a Koblitz curve $y^2\equiv x^3+b\bmod p$ ...
fgrieu's user avatar
  • 141k
2 votes
1 answer
159 views

Elliptic curve Jacobian coordinates example

I am working on Matlab Jacobian coordinates, I want a jacobian coordinates example with numbers include doubling and additions based on k value to test the code if ...
Mohammad Khaled's user avatar
3 votes
1 answer
180 views

Elliptic Curve NAF scalar method

I am new in Elliptic curve and I got a lot of knowledge through reading :) but I reached to NAF method as a scalar multiplication method, but don't understand how in this example get it: ...
Cisco Saeed's user avatar
1 vote
1 answer
1k views

How to know if a public key has been created based on the ECDSA algorithm?

Suppose in a network, the identity of users is their public key, which is generated based on the ECDSA algorithm. That is, to create a valid identity, a user must generate an ECDSA public key and then ...
Questioner's user avatar
0 votes
0 answers
163 views

Fast methods for adding the basepoint to an elliptic curve point?

Are there any clever (fast) methods for adding the basepoint (generator) to an arbitrary point on elliptic curve, finally ending in affine coordinates? I.e. if G is ...
pointat8's user avatar
2 votes
2 answers
190 views

How is the edwards448 generator derived from the curve448 generator in RFC 7748?

In RFC 7748, it is explained how the Montgomery curve, curve448, is deterministically generated from the prime $p = 2^{448} - 2^{224} - 1$. It is also explained how the generator (given below) for ...
user61836's user avatar
2 votes
0 answers
57 views

Generating pairs of elliptic $\mathbb{F}_q$-curves isogenous over $\mathbb{F}_q$ such that nobody knows an $\mathbb{F}_q$-isogeny between them

Let $\mathbb{F}_q$ be a large finite field. What if I invent how to efficiently construct pairs of elliptic "cryptographically strong" $\mathbb{F}_q$-curves $E_1$, $E_2$ isogenous over $\...
Dimitri Koshelev's user avatar
2 votes
1 answer
82 views

Follow-up II: Number of points on an elliptic curve

Context: paper on pairing based cryptography, question 1, question 2. Let $E: y^2 = x^3+x$ be an elliptic curve over $\mathbb{F}_{q}$ where $q=3^m$ for some $m\geq 1$. Then I know that $$ \# E(\mathbb{...
fish_monster's user avatar
2 votes
1 answer
105 views

Follow-up: Number of points on an elliptic curve

Consider this question. Say I would want to do something similar for $E_2:y^2=x^3−x+1$ over $\mathbb{F}_{3^m}$. How would I proceed?
fish_monster's user avatar
3 votes
1 answer
147 views

Number of points on an elliptic curve

In his paper on pairing based cryptography, Menezes claims that for $$ E_1: y^2+y = x^3+x+1 $$ the number of $\mathbb{F}_{2^m}$-points is $2^m +1 - (1+i)^m - (1-i)^m$. Whereas this is clear, it is not ...
fish_monster's user avatar
1 vote
1 answer
121 views

Distribution of elliptic curves with rank 2?

An elliptic curve defined over a finite field is either cyclic, or a direct sum of two cyclic groups. In cryptography, we use exclusively the former. I was wondering if there is any result on how ...
zugzwang's user avatar
  • 119
1 vote
0 answers
216 views

How is ECDH shared secret represented in SoftHSM

I am working on implementing ECDH with some HSM. According to the theory behind ECDH, the generated shared secret is a point on the elliptic curve (x, y) which is exactly what is returned by the HSM. ...
Fan Zhang's user avatar
4 votes
3 answers
677 views

Do you know protocols, where it is necessary to obtain several "independent" points on the same elliptic curve?

Consider an elliptic curve $E$ defined over a finite field $\mathbb{F}_{\!q}$ with a fixed non-zero $\mathbb{F}_{\!q}$-point $P$. For simplicity, let the order of the $\mathbb{F}_{\!q}$-point group $E(...
Dimitri Koshelev's user avatar
1 vote
1 answer
895 views

What is the order of the generator point G=9 in curve25519?

In Curve25519 we typically have this generator point or base point: ...
RocketNuts's user avatar
  • 1,387
0 votes
0 answers
668 views

What attacks exist on ECDSA if there are more than 10 million signatures?

I am aware that there are weaknesses in ECDSA when reusing NONCE and I am aware that there is a lattice attack on ECDSA. Are ...
JDop's user avatar
  • 3
3 votes
0 answers
294 views

Elliptic Curve how to calculate y value [duplicate]

I have been reading the book Mastering Bitcoin written by Andreas. It was the process of compressing public keys that hurt my mind. Specifically, a public key after being generated from a private key ...
John Pham's user avatar
3 votes
2 answers
1k views

Modulo p in Elliptic Curve Cryptography

To carry out Elliptic Curve Cryptography between parties, are all elliptic curve equations considered to be in the form $\bmod p$? For example, the $secp256k1$ Bitcoin curve of the equation $y^2=x^3+7$...
EKahyaoglu's user avatar
3 votes
2 answers
506 views

Can two different hash function create two unlinkable `ed25519` keys from the same randomness?

Assume the following scenario: Alice has access to 32 bytes of true randomness $s$. Alice hashes $s$ with SHA-512, and uses the resulting hash as the secret $d_{A}$ for ...
cryptobeginner's user avatar
5 votes
1 answer
374 views

Why is Montgomery Ladder fast on Montgomery Curves?

When I look at the Montgomery Ladder algorithm, I don't find anything that is specific to the Montgomery curve. We are dealing with the points all the time i.e. we are either adding two points or ...
Gautham Krishna's user avatar
0 votes
0 answers
145 views

How to decompose a public key into subgroups EC?

Is it possible to decompose the public key into its own subgroups? Suppose we know the order P with which the public key was generated ...
Dew Debra's user avatar
0 votes
0 answers
69 views

How to get a common coordinate from two different coordinates on Elliptic Curves? [duplicate]

I am trying to write a SageMath script that multiplies two coordinates on Elliptic Curves into one common coordinate. SageMath Elliptic curves over finite fields ...
Dew Debra's user avatar
3 votes
1 answer
731 views

How to find out what the order of the base point of the elliptic curve is?

I wanted to use https://github.com/AntonKueltz/fastecdsa library and the function parameters for creating curve are: ...
Amadeusz Kreta's user avatar
0 votes
1 answer
103 views

what does "product of two cyclic groups" mean

I am reading "Elliptic curve cryptosystems" and the link is here(https://www.ams.org/journals/mcom/1987-48-177/S0025-5718-1987-0866109-5/S0025-5718-1987-0866109-5.pdf). I don't understand ...
painter Qiao's user avatar
8 votes
2 answers
994 views

Why Elliptic Curve Cryptography protocols depend on fixed curves?

I'm learning about Ed25519. It depends on a bunch of magic values: The finite field of order $2^{255}-19$, the specific elliptic curve over that field, a specific ...
Jasiu's user avatar
  • 181
1 vote
1 answer
258 views

ECDH public keys restrictions

I know that Bob can calculate the shared DH key without knowing the private key. If he sends to Alice a public key = 1, then the the DH key would be 1. Can i achieve something like this in ECDH? where ...
Ashraf Yassin's user avatar
4 votes
3 answers
664 views

Order of Edwards curve and its twist

In Mike Hamburg's Ed448-Goldilocks, a new elliptic curve (eprint 2015, WECCS 2015) it is studied untwisted Edwards curves in the prime field $\mathbb F_p$ $$E_d:\,y^2+x^2\,=\,1+d\,x^2\,y^2$$ with ...
fgrieu's user avatar
  • 141k
1 vote
2 answers
580 views

How to generate a random point on an elliptic curve without knowing it's corresponding scalar private key

Given an elliptic curve with generator $G$, is it possible to generate a random point on the curve $Q = a \cdot G$ without knowing the secret value $a$ that generated it? Note that just using an $a$ ...
chausies's user avatar
  • 335
3 votes
1 answer
355 views

In The Ristretto Group, do all points sampled with Elligator have the same order?

Assume the Hash-to-ristretto255 function Elligator as laid out here. Assume a random hash that is then mapped to a point in the <...
networkstudent's user avatar
0 votes
1 answer
791 views

Deterministic Key using a seed for ECNamedCurve

I am trying to generate deterministic keys using EC curve secp521r1 in java. I went through KDF but, couldn't find any references to use it with EC curves. I would appreciate if someone could point me ...
Nitish Bhardwaj's user avatar
0 votes
2 answers
237 views

Break El Gamal for Elliptic Curves

There is an elliptic curve El Gamal digital signature scheme. Alice fixes an elliptic curve $E$, a prime $p$, a point $A$ on $E$, a secret integer $a$, and computes $B = aA$. She makes $(E, ...
budding_crypto's user avatar
0 votes
2 answers
824 views

The Generator point and Mod P in ECDSA

I've been reading about The discrete logarithm problem as of recent and i decided to try it out on a small portion of numbers myself and i actually came to a mental gridlock after watching this Video....
Dave Kent 's user avatar
1 vote
0 answers
60 views

Why is it necessary that the mod in an elliptic curve is a prime? [duplicate]

For the elliptic curve y^2 = x^3+2x+2 mod(23), why is it necessary that 23 is a prime. Why is the elliptic curve y^2 = x^3+2x+2 mod(24) not suitable for elliptic curve cryptography?
Stijn de Vries's user avatar
3 votes
1 answer
861 views

How are the points in an elliptic curve over the finite field calculated?

For the elliptic curve with equation $y^2 = x^3 + x + 0 \pmod{13}$ in the finite field, how are all the points in this curve calculated. See the image below for an example created via https://graui.de/...
Stijn de Vries's user avatar
2 votes
1 answer
175 views

SafeCurves verification script

The SafeCurves project provides a Sage script to verify the SafeCurves criteria for given curves, https://safecurves.cr.yp.to/verify.html According to the description, the script works simply as: $ ...
x8cb91e82a33's user avatar
2 votes
1 answer
309 views

Diffie Hellman groups

I saw that non-negative integers with the addition operation cannot be the Diffie Hellman group. I'm having trouble understanding why it cannot be the DHKE group. To be DHKE group, there are five ...
user19283043's user avatar
1 vote
0 answers
115 views

Elliptic curve subgroup with $p$ elements in field of characteristic $p$

Are there any elliptic curves defined over a finite field $\mathrm{GF}(p^k)$ with a subgroup of order $p$ where the discrete log (and preferably DDH) problem is hard? Elliptic curve with prime ...
qbt937's user avatar
  • 258
1 vote
2 answers
663 views

How to convert coordinates o a point from y^2=x^3+7 to y^2=x^3+4? [closed]

To moderator, this my question is not off topic !!! Please OPEN MY QUESTION. If for this place elliptic curves was off topic this so world is crazy. ...
Marex's user avatar
  • 11