Questions tagged [elliptic-curves]
Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.
1,400
questions
0
votes
0answers
33 views
Elliptic Curve Point at Infinity
Let's take into account the curve SECP256K1. My questions are:
What exactly is the "point at infinity"?
Is there more than one "point at infinity"
How can I identify if my EC generated x and y are ...
0
votes
0answers
15 views
Using ECDH for authentication
I've found this method for using ECDH for asymmetric encryption.
Is there a similar method for using ECDH (rather than the more usual ECDSA, let's say my hardware can do ECDH but not ECDSA) to ...
2
votes
0answers
50 views
Attack on Weierstrass Elliptic Curve
I have a naive question(as non specialist in this field).
While reading Weierstrass Curve description,I found that it turns into 2 periodic tori on 2D complex plane.
Is is it possible to create ...
-1
votes
0answers
30 views
How to verify signature of .asice container (ecdsa-sha256) via command line or API?
We are using E-Estonia DigiDoc software:
File: https://cdn.discordapp.com/attachments/691402249586343946/697033738097262602/wallet.txt
Signature container: https://gateway.pinata.cloud/ipfs/...
3
votes
1answer
34 views
Understanding the groups used in bilinear Ate-pairing
The bilinear ate pairing $e:G_1\times G_2 \rightarrow G_T$ is defined over the following groups:
\begin{equation}
\begin{aligned}
& G_1 = E(\mathbb{F}_p)[r] \cap Ker(\pi_p-[1]), \\
& G_2 = E(...
0
votes
3answers
72 views
Curve25519 Specification
The Curve25519 is defined over the prime $2^{255}-19$ with $A = 486662$, so that the curve equation is: $y^2 = x^3 + 486662x^2 + x$
I'm trying to understand, why the parameters are what they are.
...
2
votes
1answer
140 views
Why can you use shorter keys with elliptic curve Diffie Hellman key exchange?
I am a layperson interested in how cryptography works. I would like to know why you can use shorter keys with elliptic curve Diffie-Hellman (ECDH) than with the discrete log DH key exchange. Both have ...
1
vote
1answer
29 views
Small complex multiplication field discriminant for solving ECDLP
I've seen from the SafeCurve criteria that one should try to avoid small complex multiplication field discriminant as it can speedup the discret log computation via the Polard Rho method.
However, I ...
0
votes
0answers
68 views
Partially Repeated Roots of Classical Modular Polynomial
So I was trying to compute a normalized model of elliptic curve as described here. Consider $p$= ...
0
votes
0answers
82 views
3
votes
1answer
46 views
When using Ristretto or Decaf with Ed25519 and Ed448, do scalars still need pruning/trimming/clamping?
Decaf is a point compression method that builds a prime-order group for (twisted) Edwards curves and Montgomery curves with cofactor $h = 4$ based on the Jacobi quartic [H2015]. The promise is to ...
0
votes
0answers
23 views
Point-halving/solving quartic equations over the elliptic curve E(Z_N)/ring Z_N where N = pq
I am wondering whether there are any results/whether there is any knowledge about the following problem:
Given a univariate polynomial (say, a quartic) equation defined over $\mathbb{Z}_N$, is it ...
4
votes
3answers
979 views
Why do people criticize and mistrust the e-voting based block chain?
I am planning to implement an e-voting system based on hyperledger fabric blockchain, however, I came across many criticisms from well-known security experts like Josh Benaloh and others. The problem ...
0
votes
0answers
29 views
Is it possible to “convert” to a curve
Assuming I have a 2 black boxes
Box A: generates a private key and use it to sign whatever data I sent it (using secp256r1). It also returns the corresponding public key
Box B: gets a public key, and ...
1
vote
1answer
79 views
Curve25519 key exchange in detail
So I'm trying to understand how the key exchange with Curve25519 works. I read the original Paper from Bernstein "Curve25519: new Diffie-Hellman speed records", but I still got some questions. First ...
0
votes
2answers
118 views
Why is Curve25519 mostly used for key exchange?
When i studied the Applications where Curve25519 is used, i found out, that it is mostly used for the key exchange. Examples are the Signal Protocol and Threema.
I know, that Curve25519 has a pretty ...
0
votes
2answers
64 views
Why the output of elliptic curve based cryptosystems is smaller than the ordinary public key cryptosystems?
I am trying to understand how much the output of elliptic curve based cryptosystems (for example elliptic curve ElGamal) is smaller than the ordinary public key cryptosystems.
I know that the ...
0
votes
1answer
65 views
Elliptic Curves - Proving that the group is not cyclic
I have a question from Stinson: 7.14. The question states:
Suppose that $p > 3$ is an odd prime, and $a,b$ is an element of $\mathbb Z_p$. Further, suppose that the equation $x^3 + ax + b$ is ...
8
votes
1answer
741 views
RFC6979: error in reference implementation?
If I correctly understand RFC 6979, there is an error in the ref implementation section 3.2.
In the step H2, RFC specification says
...
1
vote
1answer
45 views
Difference between DER encoded signatures in JavaScript, Java, and C++
I'm trying to understand the DER-encoded signatures for the secp256k1 (ECDSA) curve better, so I have the following data array: 000102030405060708090a, which is a ...
1
vote
2answers
85 views
Symmetric versus asymmetric self encryption
I can encrypt my files with a symmetric encryption algorithm like AES, or with an asymmetric encryption algorithm like RSA or ECC (I encrypt my files with my own public key). No communication is ...
3
votes
1answer
83 views
is using secp256k1 curve for ECIES considered safe?
I read SafeCurves it indicates Secp256k1 is not SafeCurve by their standards but bitcoin and ETH use it in their blockchain.
I researched more and figured out that using Secp256k1 ECDSA(singing ...
0
votes
0answers
79 views
Interactive ECDHE Authentication With Numeric Code
Trying to simplify my question, keeping only core concepts.
Proposed solution:
Both user devices generates ECDHE key pairs. Send pub keys to each other. Generate shared secret.
Device that requests ...
0
votes
0answers
45 views
Elliptic curves over extensions of 64-bit fields
Are there any standard (or at least well-know) elliptic curves over $F_{p^4}$ where $p$ is a ~64-bit prime? I know Microsoft has FourQ curve which works over $F_{p^2}$ where $p$ is a 127-bit prime, ...
0
votes
0answers
54 views
Generate such an Elliptic Curve
I have a basic question. Is there a way to define an Elliptic Curve over (binary) Finite Field of order $q=2^m$ such that by taking the points from $(0, Y_0)$ and $(1, Y_1)$ then maps them to $(q - 1, ...
2
votes
1answer
69 views
What are the implications of limiting the private key space with elliptic curve Schnorr signatures?
Given a curve, I am trying to limit the private key space to ultimately cut down the Schnorr signature size as follows:
Assume an elliptic curve $E$ over a field $F$ with generator point $G$ and the ...
1
vote
1answer
78 views
Why is a prime number used in ECDSA?
So I need to write a piece for school about ECDSA and how it is secure. Now I thought I had a simple question, however, I can't seem to find an answer anywhere:
Why does the p in the formula need to ...
0
votes
1answer
48 views
Is it secure to use ECDSA for any arbitrary point on the Elliptic Curve as the Generator point?
My question concerns the elliptic curve $E$ over a prime field $\mathbb F_p$. To the best of my understanding, ECDSA requires a Generator point $G$ of prime order $n$, and the $r$ and $s$ values of ...
2
votes
1answer
111 views
How to Sample from Frobenius Eigenspace?
So I was implementing the $2$-point method described here[1], which requires to samples two points $P_0, P_1$ in the Frobenius eigenspace initially. It uses a method called Elligator, which seems to ...
1
vote
0answers
44 views
Security of ECC over finite fields of characteristic $p\approx2^{50\pm10}$?
What's the security of Elliptic Curve Cryptography over finite fields of word-sized characteristic $p\approx2^{50\pm10}$? We are talking about $\Bbb F_q$ where $q=p^k$ for some suitable $k$.
...
0
votes
1answer
74 views
Elliptic Curve - X Coordinate
I am currently working on a Koblitz curve. I have found the curve has two matching groups based on the base curve point and N-1 point. My question is as follows: Is there an algorithm to determine how ...
1
vote
1answer
63 views
Is there an asymetric encryption whos output size is quite equal to the input size
I want to verify, that a chunk of data which has a size of around 16 bytes is sent by me, by simply encrypting it via a private rsa key, providing the public key in the source code for the ...
2
votes
1answer
146 views
Is this distributed random oracle scheme safe?
This question comes from an issue raised in another question: Non interactive threshold signature without bilinear pairing (is it possible)?
Is the proposed random oracle model safe when trying to ...
2
votes
0answers
62 views
Probability of a prime number of points on an elliptic curve over a prime field
Suppose we have some elliptic curve defined over $\mathbb F_p$, with $p$ a large prime. Let $n$ be the number of points on the curve. I am interested in what is currently known about the probability* ...
1
vote
0answers
47 views
How to find Y on an elliptical curve in a finite field?
For example, let's use secp256k1, the curve used by bitcoin, y^2 = x^3 + 7, and x=12. Over the real numbers, that calculation is trivial - I can simply use a calculator. But in a finite field, how ...
0
votes
0answers
20 views
Does reusing the same $R$ in Elliptic Curve ElGamal breach its security? [duplicate]
In Elliptic Curve ElGamal if I reuse the same randomness to get the same point $R$ for different messages, how can it breach its security ?
Can you please illustrate with an example?
Please see my ...
3
votes
1answer
134 views
How to secure Elliptic Curve ElGamal encryption against known plaintext attacks?
If I have an encoding function $f(x)$ that maps a message $m$ to a point $P$ on a suitable Elliptic Curve $E$ . If I have the public key $Q$ of my recepient then I can encrypt the message as follows:
...
6
votes
1answer
86 views
Does any $x < p$ satisfy the curve equation of X25519?
I've been reading about the famous X25519, a montgomery curve from wikipedia and in that article they say that we do not have to check for point validity. Is it because that any $x < p$ satisfy ...
4
votes
1answer
114 views
Is Ed25519 really constant-time as widely implemented?
Despite the frequent claims that Ed25519 is more secure against side-channel attacks than (for instance) signatures performed over NIST P-256, I noticed that most implementations (including the ...
1
vote
0answers
57 views
Elliptic curve of order $p = 2q + 1$
Does anyone know an example of an Elliptic Curve of caracteristic $p$ ($E_p$) that has a point generator $G$ that generates a subgroup of order $q$, with $p$, $q$ being prime numbers and $p = 2q + 1$?
2
votes
0answers
27 views
About the scalar multiplication on Koblitz curve in FIPS PUB 186-4 (2013)
In FIPS PUB 186-4, the computation of scalar multiplication on Koblitz curves is given in p.106~109. In p.109, step 11.3, $(r_0,r_1)$ is updated with $(r_1+\mu\,r_0/2,-r_0/2)$. But under ...
4
votes
1answer
89 views
What is the Bilinear-map accumulator disadvantage
Bilinear-map accumulator [1] is more efficient than the RSA accumulator [2] but do you know any disadvantage for the bilinear-map accumulator when compared to RSA accumulator?
2
votes
1answer
46 views
Does there exist the method of projective coordinates for the computation of scalar multiplication for Koblitz curve?
Although the computation for scalar multiplications for Koblitz curve can be efficiently executed by TNAF method, but it still need to compute the multiplicative inverse for each point addition.
4
votes
2answers
269 views
Why does EdDSA require a b-bit private key instead of b/2-bit?
By design, EdDSA requires a $b$-bit string as the secret key $k$, and when signing, it is expanded to a $2b$-bit string $H(k)$, some bit-twiddling is done, and the first half is used as the private ...
3
votes
0answers
88 views
Which is the smallest safe elliptic curve (bit-length)?
At https://safecurves.cr.yp.to/ some elliptic curves are listed which passed certain security test. The smallest bit-length of a safe curve listed there is 221 bits.
At wiki page discrete logarithm ...
1
vote
1answer
67 views
Double discrete logarithm on elliptic curve
Background:
I am attempting to implement the paper Publicly Verifiable Secret Sharing. I managed to get it working using modular groups, but when I want to make it more efficient by transferring to ...
5
votes
1answer
121 views
Protecting Ed448 against DPA and fault attacks
There are some papers (1, 2) describing fault attacks in EdDSA. One suggested countermeasure is to add randomness to the input of the first hash call, which outputs a scalar.
This paper describes a ...
0
votes
0answers
20 views
Lifting point to quadratic twisted curve
How to lift point to it’s quadratic twisted curve? I use secp256k1. Is the diiscrete log still same? Thanks before
3
votes
0answers
51 views
ECC: Lightweight proof of correct exponentiation
In the context of ECC.
There's an EC point $P$ which is supposed to be a known power of another known point $G$ (generator). That is:
$P = [k]G$ (in additive notation)
This should be verified on an ...
0
votes
0answers
37 views
BIP32 Extended Key to EC Private and Public Key Pair
We are working on an application in Android using Java. In our project, we used to generate EC key pairs (of size 384 bits) using SpongyCastle - an old Android version of Bouncy Castle.
The problem ...
