Questions tagged [elliptic-curve-generation]
ECC is an approach to public-key cryptography based on the algebraic structure of elliptic curves over finite fields. ECC allows smaller keys compared to non-EC cryptography (based on plain Galois fields) to provide equivalent security. Elliptic curves are applicable for key agreement, digital signatures, pseudorandom generators, and other tasks. they can be used for encryption by combining the key agreement with an asymmetric encryption scheme.
116
questions
3
votes
0
answers
94
views
EC public key with leading zeros
Let us take example of secp256k1 curve. The current known public key with most leading zero (in x cordinate) is:
...
- 31
0
votes
0
answers
43
views
Practical deployments of ECC with cofactor of elliptic curves $4$ or $8$?
Are cofactor $4$ and $8$ ECC schemes widely used in practical deployments such as those in cryptocurrencies?
Can you name some practical settings where there curves are used and cryptocurrencies where ...
- 908
0
votes
1
answer
73
views
Non-interactive EC DKG (Distributed Key Generation) question
Normally, when computing an EC threshold DKG, I have all parties reveal a commitment to the public key, and only reveal their own public key after verifying the commitments. Otherwise it's trivial ...
- 420
5
votes
1
answer
249
views
Binary Elliptic Curves Point Doubling Formula - Calculate Lambda from P3
As I am studying ordinary (non-supersingular) binary elliptic curves in the Guide to ECC book by Hankerson (Section 3.1, page 81), for point doubling, the equations presented in the book are:
$x_3 = \...
- 53
2
votes
2
answers
133
views
Can you find a secure curve defined over the scalar field of secp256k1?
Is it possible to find a secure curve which's base field is the scalar field of secp256k1?
In general, can you find a secure curve defined over the scalar field of any secure curve? (For example, a ...
- 339
1
vote
1
answer
46
views
Scalar Multiplication using NAF method
I am learning about Elliptic curve scalar multiplications and I am on NAF, and I am trying to figure out the concept.
What I understand is if I have K=27 with using ...
- 241
0
votes
0
answers
34
views
Binary vs Prime field-Elliptic Curve Cryptography [duplicate]
Binary extension and prime field-based elliptic curves are used in Elliptic curve cryptography (ECC). From the performance point of view, ECC using Binary field are faster and easy to compute on ...
- 307
2
votes
0
answers
155
views
Forging an ECDSA signature for a random public key string
An adversary is able to insert a random string (which he does not control: he can only randomly generate it and insert it). The random string is parsed by the victim as an ECDSA public key. This ...
- 73
2
votes
1
answer
113
views
What is the equation to get P-Q in Montgomery curve XZ coordinates
Based on Differentia-addition on P I can understand (Xp,Zp) which is the base point, (Xq,Zq) which comes from Doubling, but I ...
- 241
3
votes
1
answer
315
views
Criteria for choice of prime field in secp256k1?
In secp256k1, the prime order field $\mathbb F_p$ uses
$$p=2^{256}-2^{32}-977$$
This is the largest prime $p$ less than $2^{256}-2^{32}$ allowing to construct a Koblitz curve $y^2\equiv x^3+b\bmod p$ ...
- 138k
2
votes
1
answer
124
views
Elliptic curve Jacobian coordinates example
I am working on Matlab Jacobian coordinates, I want a jacobian coordinates example with numbers include doubling and additions based on k value to test the code if ...
0
votes
0
answers
29
views
How can I use w-NAF(k) scalar method in curves
I am studying Elliptic curve and I got the scalar methods like NAF(k) w-NAF(K) double-and-Add...
- 241
3
votes
1
answer
160
views
Elliptic Curve NAF scalar method
I am new in Elliptic curve and I got a lot of knowledge through reading :) but I reached to NAF method as a scalar multiplication method, but don't understand how in this example get it:
...
- 241
1
vote
1
answer
746
views
How to know if a public key has been created based on the ECDSA algorithm?
Suppose in a network, the identity of users is their public key, which is generated based on the ECDSA algorithm. That is, to create a valid identity, a user must generate an ECDSA public key and then ...
- 211
0
votes
0
answers
144
views
Fast methods for adding the basepoint to an elliptic curve point?
Are there any clever (fast) methods for adding the basepoint (generator) to an arbitrary point on elliptic curve, finally ending in affine coordinates?
I.e. if G is ...
- 1
2
votes
2
answers
162
views
How is the edwards448 generator derived from the curve448 generator in RFC 7748?
In RFC 7748, it is explained how the Montgomery curve, curve448, is deterministically generated from the prime $p = 2^{448} - 2^{224} - 1$. It is also explained how the generator (given below) for ...
- 35
2
votes
0
answers
57
views
Generating pairs of elliptic $\mathbb{F}_q$-curves isogenous over $\mathbb{F}_q$ such that nobody knows an $\mathbb{F}_q$-isogeny between them
Let $\mathbb{F}_q$ be a large finite field. What if I invent how to efficiently construct pairs of elliptic "cryptographically strong" $\mathbb{F}_q$-curves $E_1$, $E_2$ isogenous over $\...
- 395
2
votes
1
answer
82
views
Follow-up II: Number of points on an elliptic curve
Context: paper on pairing based cryptography, question 1, question 2.
Let $E: y^2 = x^3+x$ be an elliptic curve over $\mathbb{F}_{q}$ where $q=3^m$ for some $m\geq 1$.
Then I know that
$$
\# E(\mathbb{...
- 177
2
votes
1
answer
103
views
Follow-up: Number of points on an elliptic curve
Consider this question.
Say I would want to do something similar for $E_2:y^2=x^3−x+1$ over $\mathbb{F}_{3^m}$. How would I proceed?
- 177
3
votes
1
answer
140
views
Number of points on an elliptic curve
In his paper on pairing based cryptography, Menezes claims that for
$$
E_1: y^2+y = x^3+x+1
$$
the number of $\mathbb{F}_{2^m}$-points is $2^m +1 - (1+i)^m - (1-i)^m$. Whereas this is clear, it is not ...
- 177
1
vote
1
answer
107
views
Distribution of elliptic curves with rank 2?
An elliptic curve defined over a finite field is either cyclic, or a direct sum of two cyclic groups. In cryptography, we use exclusively the former. I was wondering if there is any result on how ...
- 119
1
vote
0
answers
176
views
How is ECDH shared secret represented in SoftHSM
I am working on implementing ECDH with some HSM. According to the theory behind ECDH, the generated shared secret is a point on the elliptic curve (x, y) which is exactly what is returned by the HSM.
...
- 11
4
votes
3
answers
670
views
Do you know protocols, where it is necessary to obtain several "independent" points on the same elliptic curve?
Consider an elliptic curve $E$ defined over a finite field $\mathbb{F}_{\!q}$ with a fixed non-zero $\mathbb{F}_{\!q}$-point $P$. For simplicity, let the order of the $\mathbb{F}_{\!q}$-point group $E(...
- 395
1
vote
1
answer
755
views
What is the order of the generator point G=9 in curve25519?
In Curve25519 we typically have this generator point or base point:
...
- 1,397
0
votes
0
answers
617
views
What attacks exist on ECDSA if there are more than 10 million signatures?
I am aware that there are weaknesses in ECDSA when reusing NONCE and I am aware that there is a lattice attack on ECDSA.
Are ...
- 3
3
votes
0
answers
291
views
Elliptic Curve how to calculate y value [duplicate]
I have been reading the book Mastering Bitcoin written by Andreas. It was the process of compressing public keys that hurt my mind. Specifically, a public key after being generated from a private key ...
- 85
3
votes
2
answers
1k
views
Modulo p in Elliptic Curve Cryptography
To carry out Elliptic Curve Cryptography between parties, are all elliptic curve equations considered to be in the form $\bmod p$?
For example, the $secp256k1$ Bitcoin curve of the equation $y^2=x^3+7$...
- 33
3
votes
2
answers
501
views
Can two different hash function create two unlinkable `ed25519` keys from the same randomness?
Assume the following scenario:
Alice has access to 32 bytes of true randomness $s$.
Alice hashes $s$ with SHA-512, and uses the resulting hash as the secret $d_{A}$ for ...
- 347
5
votes
1
answer
339
views
Why is Montgomery Ladder fast on Montgomery Curves?
When I look at the Montgomery Ladder algorithm, I don't find anything that is specific to the Montgomery curve. We are dealing with the points all the time i.e. we are either adding two points or ...
0
votes
0
answers
126
views
How to decompose a public key into subgroups EC?
Is it possible to decompose the public key into its own subgroups?
Suppose we know the order P with which the public key was generated ...
0
votes
0
answers
68
views
How to get a common coordinate from two different coordinates on Elliptic Curves? [duplicate]
I am trying to write a SageMath script that multiplies two coordinates on Elliptic Curves into one common coordinate.
SageMath Elliptic curves over finite fields ...
3
votes
1
answer
544
views
How to find out what the order of the base point of the elliptic curve is?
I wanted to use https://github.com/AntonKueltz/fastecdsa library and the function parameters for creating curve are:
...
0
votes
1
answer
89
views
what does "product of two cyclic groups" mean
I am reading "Elliptic curve cryptosystems" and the link is here（https://www.ams.org/journals/mcom/1987-48-177/S0025-5718-1987-0866109-5/S0025-5718-1987-0866109-5.pdf）. I don't understand ...
8
votes
2
answers
985
views
Why Elliptic Curve Cryptography protocols depend on fixed curves?
I'm learning about Ed25519. It depends on a bunch of magic values: The finite field of order $2^{255}-19$, the specific elliptic curve over that field, a specific ...
- 181
1
vote
1
answer
233
views
ECDH public keys restrictions
I know that Bob can calculate the shared DH key without knowing the private key. If he sends to Alice a public key = 1, then the the DH key would be 1.
Can i achieve something like this in ECDH? where ...
4
votes
3
answers
599
views
Order of Edwards curve and its twist
In Mike Hamburg's Ed448-Goldilocks, a new elliptic curve (eprint 2015, WECCS 2015) it is studied untwisted Edwards curves in the prime field $\mathbb F_p$
$$E_d:\,y^2+x^2\,=\,1+d\,x^2\,y^2$$
with ...
- 138k
1
vote
2
answers
511
views
How to generate a random point on an elliptic curve without knowing it's corresponding scalar private key
Given an elliptic curve with generator $G$, is it possible to generate a random point on the curve $Q = a \cdot G$ without knowing the secret value $a$ that generated it? Note that just using an $a$ ...
- 335
3
votes
1
answer
334
views
In The Ristretto Group, do all points sampled with Elligator have the same order?
Assume the Hash-to-ristretto255 function Elligator as laid out here. Assume a random hash that is then mapped to a point in the <...
0
votes
1
answer
685
views
Deterministic Key using a seed for ECNamedCurve
I am trying to generate deterministic keys using EC curve secp521r1 in java. I went through KDF but, couldn't find any references to use it with EC curves. I would appreciate if someone could point me ...
- 103
0
votes
2
answers
221
views
Break El Gamal for Elliptic Curves
There is an elliptic curve El Gamal digital signature scheme. Alice fixes an elliptic curve $E$, a prime $p$, a point $A$ on $E$, a secret integer $a$, and computes $B = aA$. She makes $(E, ...
0
votes
2
answers
704
views
The Generator point and Mod P in ECDSA
I've been reading about The discrete logarithm problem as of recent and i decided to try it out on a small portion of numbers myself and i actually came to a mental gridlock after watching this Video....
- 35
1
vote
0
answers
60
views
Why is it necessary that the mod in an elliptic curve is a prime? [duplicate]
For the elliptic curve y^2 = x^3+2x+2 mod(23), why is it necessary that 23 is a prime. Why is the elliptic curve y^2 = x^3+2x+2 mod(24) not suitable for elliptic curve cryptography?
3
votes
1
answer
664
views
How are the points in an elliptic curve over the finite field calculated?
For the elliptic curve with equation $y^2 = x^3 + x + 0 \pmod{13}$ in the finite field, how are all the points in this curve calculated. See the image below for an example created via https://graui.de/...
2
votes
1
answer
162
views
SafeCurves verification script
The SafeCurves project provides a Sage script to verify the SafeCurves criteria for given curves, https://safecurves.cr.yp.to/verify.html
According to the description, the script works simply as:
$ ...
- 21
2
votes
1
answer
284
views
Diffie Hellman groups
I saw that non-negative integers with the addition operation cannot be the Diffie Hellman group. I'm having trouble understanding why it cannot be the DHKE group.
To be DHKE group, there are five ...
- 123
1
vote
0
answers
109
views
Elliptic curve subgroup with $p$ elements in field of characteristic $p$
Are there any elliptic curves defined over a finite field $\mathrm{GF}(p^k)$ with a subgroup of order $p$ where the discrete log (and preferably DDH) problem is hard? Elliptic curve with prime ...
- 258
1
vote
2
answers
586
views
How to convert coordinates o a point from y^2=x^3+7 to y^2=x^3+4? [closed]
To moderator, this my question is not off topic !!! Please OPEN MY QUESTION. If for this place elliptic curves was off topic this so world is crazy.
...
- 11
3
votes
1
answer
536
views
Significance of y-coordinates in ECDH public key exchange
In the research paper Breaking the Bluetooth Pairing – The Fixed Coordinate Invalid Curve Attack? by Biham and Neumann, 2019,
they talk about attacks in Bluetooth pairing, they state that in the ...
- 153
2
votes
1
answer
288
views
Calculate a base point on the twist of secp192k1 with maximal order
I want to calculate a base point on the twist of secp192k1 with maximal order.
...
- 21
1
vote
0
answers
54
views
How to maintain the width of the cipher image in ECC Image Encryption from Singh and Singh (2015)?
I am a beginner in cryptosystems and I hope I would be accepted in the community.
I was trying to implement Singh and Singh (2015) ECC image encryption algorithm on Matlab.
I have been able to ...
- 11