Questions tagged [elliptic-curves]
Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.
2,096
questions
0
votes
0
answers
44
views
Same message different nonce but similarities in r value of the signatures(r,s)
I'm studying a case where when i sign a same message with the same private key and a different nonce, i sometimes get signatures (r,s) where r values share some similarities (same numbers at the same ...
- 101
1
vote
2
answers
193
views
PAGE 2: Can I move elements from cyclic subgroup to its cyclic parent group?
We will continue our previous topic here⬇️ for clarity...
The following context is based on elliptic curves in short-weierstrass form y^2 = x^3 + b.
pls read carefully-
I am looking for a function/...
- 21
1
vote
1
answer
171
views
Can I move elements from cyclic subgroup to its cyclic parent group?
The following context is based on elliptic curves in short-weierstrass form y^2 = x^3 + b.
I know that elements of a non-prime order cyclic group G can be moved to its subgroup H by a process called &...
- 21
1
vote
2
answers
66
views
Zero Knowledge Argument for Elliptic Curve Multiplication/Inverse Multiplication Correctness?
I was reading this post and the accepted answer wrote about a way to “prove that some list of points $[A,B,C,...]$ when multiplied by $x$ produces $[A′,B′,C′,...]$”. However, in their explanation ...
6
votes
0
answers
163
views
Who originally generated the elliptic curve now known as P256/secp256r1
Background: there is a theory going around that claims that P256 was backdoored by the NSA. The theory goes is that the NSA found a weakness that applies to a nontrivial fraction of elliptic curves (...
- 143k
0
votes
1
answer
56
views
Does BearSSL Library Support ECC Encryption/Decryption Functionality?
I'm researching cryptographic libraries for a project I'm working on, and I'm particularly interested in the BearSSL Library due to its lightweight nature. But I'm not sure if it supports ECC (...
- 1
0
votes
0
answers
55
views
Formula for deriving the x-coordinate using the y-coordinate (decompressing a compress public key)
According to my understanding a public key is made up of x and y coordinate and a compress public key is made up of the y-coordinate since it's possible to directly calculate the uncompress public key ...
- 31
5
votes
1
answer
491
views
Why do Ed25519 use Twisted Edwards curve but not regular Edwards curve
I'm trying to understand benefits of using Twisted Edwards curve over regular Edwards curve. I'm aware of some properties of Twisted Edwards curve that regular Edwards curve missing like isomorphism ...
- 207
0
votes
0
answers
15
views
Use secp384r1 PEM key to sign a Verifiable Credential with Linked Data proofs
Ok, let me preface this by clarifying that I am not a cryptographer by trade, but I've been using cryptographic suites in the context of signing w3c Verifiable Credentials, and I am not sure if this ...
- 101
1
vote
1
answer
117
views
2
votes
1
answer
106
views
Statistics-heavy crypto papers
I'm currently taking a course in which we choose a stats-heavy paper and analyse it, summarising our work in the form of a written report and presentation. I have tried to find such a paper in crypto, ...
1
vote
0
answers
19
views
Does exist an Elliptic analogue of Benaloh encryption scheme?
The definition of Benaloh encryption scheme can be found here.
Does exist an elliptic analogue of this scheme?
I want to use this scheme but the length of the key ...
- 160
2
votes
1
answer
45
views
Reflecting a point on the Edwards curve
Let's say we have a point $nP = (x,y)$ on a curve $E$ over a prime $p$. The corresponding Edwards curve coordinates are $(u,v)$. I want to construct the point corresponding to $(u,-v)$ on the Edwards ...
- 135
1
vote
2
answers
70
views
Deriveing y-coordinate
Is there any formula for deriveing the y-coordinate using the x-coordinate and the slope in secp256k1 elliptic curve?
Example
$Calculate$ $the$ $slope$
...
- 31
1
vote
0
answers
85
views
Why are my Curve25519 points so different than standard? [closed]
I'm trying to implement X25519 for a little game I'm working on. I knew nothing about this stuff a week ago so it's been a bit of a learning curve (that was really funny).
Most of the resources I ...
0
votes
2
answers
53
views
Determining the order of operations in elliptic curve cryptography: Point doubling vs point addition for obtaining x and y values of a public key
I have a question regarding the operations performed on an elliptic curve, specifically related to point doubling and point addition. I am trying to understand whether it is possible to determine the ...
- 31
1
vote
1
answer
60
views
In TLS 1.2 and TLS 1.3, does the EC curve used to generate the ephemeral keys be the same on both client and server sides?
In TLS 1.2 and TLS 1.3, does the EC curve used to generate the ephemeral keys at the client side, does it need to be the same as that on the and server sides?
For example can I use secp521r1 at the ...
- 33
1
vote
1
answer
50
views
is it possible to calculate the difference between 2 public keys of secp256k1
I am inquiring about the feasibility of calculating the point difference between two distinct secp256k1 elliptic curve points. Given the nature of secp256k1, which is widely used in cryptographic ...
- 11
1
vote
0
answers
26
views
Disjunctive ZK Proof of knowledge of discrete log
I want to construct a non-interactive ZK proof that in a set of pairs of group (where the DDH-assumption holds true) elements:
$(g_1, Y_1), (g_2, Y_2), ..., (g_n, Y_n)$
, the prover knows at least one ...
- 21
2
votes
0
answers
122
views
Equality of ElGamal plaintext & Pedersen commitment message
Let's imagine two entities: Bob and Alice. Bob's public key is $B = bG$. Alice's public key is $A = aG$.
Alice encrypts her number $n$ with Bob's public key so Bob could decrypt it ($n$ is small ...
- 33
0
votes
0
answers
42
views
Practical deployments of ECC with cofactor of elliptic curves $4$ or $8$?
Are cofactor $4$ and $8$ ECC schemes widely used in practical deployments such as those in cryptocurrencies?
Can you name some practical settings where there curves are used and cryptocurrencies where ...
- 908
1
vote
0
answers
33
views
How are elliptic curves designed for encryption purpose? [closed]
Why can't we use any random elliptic curve? What are the properties that need to be satisfied?
- 11
0
votes
0
answers
16
views
How to get equation from given three points(with doubling) on twisted edwards curve over finite field?
I have given three points $ P $, $ Q $, $ R $ on Twisted Edwards Curve over prime finite field $ \mathbb{Z}_p $.
$$ ax^2 + by^2 = dx^2y^2 + 1 $$
I know about given points that point $ Q $ is doubling ...
- 1
3
votes
1
answer
533
views
How brittle is the current public key encryption infrastructure
Edit: One half of the answer to this question also applies to a recently asked and now deleted question regarding the impact of an algorithm which breaks DLP over integers but has no impact on ...
- 21k
0
votes
1
answer
83
views
Elliptic curve signature scheme without a nonce
ECDSA and EdDSA both require the generation of a single-use value. Are there any elliptic curve signature schemes in existence which don't require nonce and maintain the usual security strength equal ...
- 3,605
1
vote
1
answer
46
views
Are (0,0) the coordinates of the "point at infinity"?
Christel Bach's elliptic curve calculator has the coordinates for the "point at infinity" be $(0,0)$. Is that just a stand-in?
- 3,605
0
votes
0
answers
17
views
Fixed-base exponentation with preprocessing [duplicate]
Is anyone aware of an in-depth study of algorithms using preprocessing to compute fixed-base exponentiations? Assuming I am willing to do arbitrary computation in the preprocessing phase (but not ...
- 270
1
vote
0
answers
38
views
How to calculate ECDSA compressed public key in HEX? [closed]
I am given the ECDSA public key x and y coordinates below, calculate the compressed public key in HEX:
PubKey.X :
61702053028733271054209908027052318932346644879827564097906752978487519734153
PubKey....
- 11
0
votes
1
answer
51
views
Multiplicative inversion of a generated point?
Let's say I have a public generator $G$, an unknown, private $p$ and a public point $pG$ on an elliptic curve.
Given $pG$ it's easy to construct $-pG$ by just taking the negative. But can you ...
- 135
0
votes
0
answers
28
views
Transportation Key (KEK)
I was studying about how to transport keys from one HSM environment to another and it came to me that I would need some sort of transportation key so the HSM keys would be double encrypted.
How would ...
- 101
0
votes
1
answer
24
views
Is it wrong that in a JWK, if the "d" value is **omitted**, that JWK represents a private key?
This is not a programming question. This is to confirm whether a crypto documentation is incorrect.
I am using Rust's p384 crate. I am creating a private key from a JWK string.
In the source code, at ...
0
votes
1
answer
79
views
Given pedersen commitments of some elements, how to prove that the sum of only one subset of these elements is equal to the given element θ？
Assume that Prover have $n$ pedersen commitments ($V_{a_1},V_{a_2},\cdots,V_{a_n}$ where $V_{a_i}=G \cdot a_i + H \cdot r_{a_i}$) of $n$ elements $a_1,a_2,\cdots,a_n$. The Prover have another element $...
- 11
0
votes
0
answers
59
views
Trouble detecting cyclic group order crossovers in SECP256K1
There's a problem in detecting whether the sum of public key addition has crossed the cyclic group order boundary
For this example, think of public keys $Pub$ as private keys $Priv$, (private scalars),...
1
vote
2
answers
124
views
How to prove that a Pedersen commitment has the same value as at least one of a set of other Pedersen commitments, without revealing which
A prover has two pedersen commitments, $V_{a}=G\cdot a+H\cdot r_a$ and $V_{b}=G\cdot b+H\cdot r_b$, which commit the values $a$ and $b$ respectively.
The prover has another commitment $S_{\sigma}=G\...
- 11
0
votes
1
answer
40
views
Using plaintext + ciphertext combination as substitute for authentication/signature in elliptic curve cryptography
I'm working on a system where I need to sign some data using an ECC private key and share the data and signature over a BLE ADV packet. Since an ADV packet is limited in space, I can't use a full ...
1
vote
0
answers
62
views
Is it possible to get the negative point with −x in that version of the Pedersen hash over the BaybyJubJub curve?
The Pedersen hash is a low constraints friendly hash for Zk-Snarks.
Unlike many algorithms, the Pedersen hash returns a point P = (x,y) on a curve as a hash. ...
- 153
1
vote
1
answer
61
views
Can anyone explain the algorithm that OpenSSL uses to add two points on an elliptic curve?
I am trying to understand how OpenSSL adds points on an elliptic curve. I have understood from here that ossl_ec_GFp_simple_add() is where the addition op works. Can anyone explain the algorithm used ...
- 11
0
votes
1
answer
102
views
Given a safe elliptic curve with generator $g_1$. Is there a function $f:(g_1^a,g_1,a)\leftrightarrow g_2$? For random $g_3,g_4$ -> $a$ unknown
In use-case we have a (random) generator $g_1$ and perform operations $g_1^{a}$ for known $a$ inside a safe elliptic curve modulo $p$.
Is there any function $f$ which gives us a new (most likely ...
- 571
0
votes
1
answer
45
views
Create PKCS12 file from EC Private and Public key pair
I have a file with an EC Public Private Key Pair and curve parameters:
...
- 143
0
votes
0
answers
51
views
Hybrid encryption parameters when using elliptic curve keys
I wrote a command line application for encrypting/decrypting files to your local machine. The idea is you have an asymmetric key pair where the private key is stored encrypted and the public key is ...
1
vote
1
answer
149
views
On the bit security of elliptic curves
My understanding is that an elliptic curve $E$ over a finite field $\mathbf{F}_q$ has a bit security of $\sqrt{q}$ assuming Pollard rho or Baby-step giant-step. In this thread, it is explained that ...
- 13
0
votes
0
answers
80
views
Which encryption/decryption to use with ECC?
I'm using ECDH for generating shared key for STM32 MCU. Which encryption/decryption algorithm should I use? I looked at RSA and AES project samples provided by STM32 but where do I provide shared key ...
- 1
2
votes
1
answer
121
views
Encryption within the groups of BLS12-381
I have been investigating libraries that implement operations and protocols involving BLS12-381 curves. I have noticed an absence of libraries that support encryption over (either of) the groups G1 ...
- 53
1
vote
1
answer
201
views
Pedersen Hash : when truncating the hash to keep only the X coordinate, is it possible to compute a collision when the Babyjubjub curve is used?
The Pedersen hash is a low constraints friendly hash for Zk-Snarks.
Unlike many algorithms, the Pedersen hash returns a point P = (x,y) on a curve as a hash. ...
- 153
1
vote
2
answers
61
views
How to redistribute shares for Distributed Shamir Secret Sharing?
I'm working on a Distributed Key Generation protocol. The idea is similar to this.
TLDR: Aggregated Shamir Secret Sharing, each participant acts as a dealer & distributed the secret shares of its ...
- 111
1
vote
2
answers
1k
views
Is there a way to get time from signature? Or is it possible to ensure the message was signed at the time that it says it was signed?
Suppose my server receives a message, the public key, and the signature. The message contains a time stamp.
Is there a way to get the time stamp from the signature to match it with the message time ...
1
vote
1
answer
94
views
modular reduction using solinas prime
I want to perform a modular reduction using Solinas prime value as q = 2^383-2^33+1. How can I efficiently compute it taking advantage of q being Solinas prime?
- 11
1
vote
1
answer
60
views
What is the reverse formula from Coords on E11 to Coords on E1 [closed]
U= 115792089237316195423570985008687907852598652813156864395638497411212089444244
a = 20412485227
E1 = EllipticCurve(GF(p), [0,1]) with order U
E11 = EllipticCurve(GF(p), [0,1]) with order a
...
- 11
1
vote
0
answers
30
views
Ethereum signature as xml-dsig11
This question was originally posted in https://ethereum.stackexchange.com/questions/151471/ethereum-signature-as-xml . I post it here aswell because I rarely get any response there.
I am seeking to ...
- 111
1
vote
0
answers
145
views
Edwards curve ed25519 puzzle
Recently a friend of mine showed me a "puzzle" he created with edwards curve ed25519
It is based on adding and multiplying points on the curve
You supply four arguments to the program
The '...
- 11