Questions tagged [elliptic-curves]
Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.
1,750
questions
0
votes
0answers
14 views
Short Nonces in ECDSA signature generation
Recently I noticed that my device generates short-sized Nonces.
Approximately $2 ^ {243} - 2^{244}$.
Could it turn out that there will be a small leak of ...
1
vote
1answer
58 views
Convert secp256k1 private key to sr25519 private key
Is it possible to convert secp256k1 private key to valid sr25519 key?
4
votes
1answer
81 views
Would being able of factoring integers efficiently have some consequences over Elliptic Curve Cryptography?
Let's assume you can factor integers in a very efficient manner. Would that endanger the security of e.g. elliptic curve cryptography, or is there no link between the two ? You can often read that ...
0
votes
3answers
108 views
Two Elliptic Curve Points having the Same X coordinate
Suppose in a elliptic curve (say the curve equation is: $y^2 = x^3 -17$) with prime order $q$, we have $(x,y_1) = nP$, where $P$ is a generator and $n<\lceil{q/2}\rceil$. Can we claim that there ...
1
vote
0answers
40 views
Birational transformation from Edwards curve with not square d to Edwards curve with square d
How can I transform a complete twisted Edwards curve $ax^2+y^2 = 1+dx^2y^2$ with not square $d$ and square $a$ into an isomorphic Edwards curve $X^2+Y^2 = 1+DX^2Y^2$ with a square $-D$ i.e. $D = -r^2$?...
0
votes
0answers
35 views
Is it possible (and if so how) to make one proof for multiple private keys in ECDSA
Lets say I have a message that needs to be signed by two keys that were generated using ECDSA
Is it possible to make a signature that accounts for both keys, meaning I can verify with both and see ...
2
votes
0answers
64 views
ElGamal with elliptic curves and semantic security
To encrypt a group element $P$ with public key $K$ and randomness $r$ using ElGamal on elliptic curves with base point $G$ we do the following $(c_1, c_2) = (r\cdot G; P+r\cdot K)$.
When we want to ...
1
vote
1answer
76 views
Are there any public keys for which the private key can be easily derived (ECDSA)?
I know that generally it's infeasible to find the private for any given public key. But I also came across the question "Find ECDSA PrivKey to PubKey = 0", in which it was explained that the ...
0
votes
1answer
120 views
Can I know from a Bitcoin public key if the private key is odd or even?
Can I know just from a Bitcoin public key if the private key is odd or even?
[moderator note] That is, can we find parity of the private key from a secp256k1 public key?For the original dump of ...
1
vote
0answers
20 views
running Project Wycheproof against crypto implementations in languages other than Java
So I guess https://github.com/google/wycheproof "tests crypto libraries against known attacks". It appears to mainly be intended for Java crypto providers but can it easily be adapted to be ...
3
votes
1answer
64 views
What is/was SEC#1 ECC public key leading octet 0x01 for?
In the SEC#1 elliptic curve cryptography standard, the encoding of the public key involve a leading octet:
00h: The public key is the point at infinity.
02h, 03h: The public key is the compressed ...
0
votes
0answers
39 views
Why does ECDSA produce a pair of values in its' signature (r,s)?
I was wondering why ecdsa generates a signature in form of a pair (r and s) and why it can't be only one value.
1
vote
2answers
855 views
What is the difference between "Elliptic Curve Function" and "Hash Functions" like SHA256?
I am reading about bitcoin and I am a little confused about "elliptic curve function" and "SHA256".
Do they have the same properties? Can both be used to generate private and ...
1
vote
1answer
78 views
Multiuser encryption, singleuser decryption [duplicate]
I have an hybrid encryption (RSA, AES) for a file sharing project I am working on, where I use a single public key for encryption on the sender side and corresponding private key for decryption on the ...
1
vote
1answer
64 views
ECDSA - generating a new private key each time we sign?
So, I kinda get the mathematics behind the ECDSA, but I can't seem to find precise information about private key generation. In other words, do we have to generate private key, each time we generate a ...
1
vote
1answer
106 views
Size of group elements in a bilinear context
In a asymetric pairing context, which size (in bits) should have the elements of $\mathbb{G}_1,\mathbb{G}_2$ and $\mathbb{G}_T$ if we consider the most efficient elliptic curves?
1
vote
2answers
108 views
What is the meaning of $F_{p^k}$ and the elliptic curve over it, $E(F_{p^k})$?
In pairing based cryptography, there will be the finite field $F_{p^k}$ where $p$ is prime number and $k$ is an integer. The elliptic curve is constructed on that finite field as $E(F_{p^k})$.
For ...
1
vote
1answer
53 views
Isomorphic mapping of BLS12-381 G2 points to G1
I'm attempting to reproduce ring signatures as described in Section 5 of https://crypto.stanford.edu/~dabo/pubs/papers/aggreg.pdf but applied to the BLS12-381 system.
One of the assumptions in their ...
1
vote
1answer
65 views
kleptography SETUP attack in ecdsa
I'm trying to implement kleptography SETUP attack of ecdsa with python.
Just a simply script to verify the algorithm. However i can't get the right output as the paper said. Where is the problem? Can ...
0
votes
2answers
102 views
Is it possible to give a definition for point multiplication on elliptic curve?
As we know that at least in cryptography, the group operation on elliptic curve is just the point addition(https://en.wikipedia.org/wiki/Elliptic_curve_point_multiplication), which is defined on $E:y^{...
1
vote
1answer
243 views
Why does point addition work on EC curves?
This may be more of a math question but I cannot find an intuitive answer.
On an EC curve why is 2P+2P equal to P+P+P+P?
The addition operation seems to a layman as some arbitrary sequence of steps. ...
0
votes
1answer
88 views
Notation question: Dividing 2 Elliptic Curve Points producing a third point
I'm working my way through some papers and ran across what seems to be division of two points that produce a third point. I'm new to ECC and am having a terrible time trying to figure out what this ...
2
votes
3answers
435 views
How to decide if a point on a elliptic curve belongs to a group generated by a generator g?
In the elliptic curve encryption scheme, there is a cyclic group generated by a base point $G$ on the elliptic curve.
Given a random point on the elliptic curve, is there a way to decide if the random ...
0
votes
0answers
40 views
How to decompose a public key into subgroups EC?
Is it possible to decompose the public key into its own subgroups?
Suppose we know the order P with which the public key was generated ...
2
votes
1answer
63 views
What is the quadratic character of the field over which elliptic curve is defined?
I'm trying to understand the injective encoding of a message to an elliptic curve point (from this paper).
However, I'm not sure what do they mean by the quadratic character of the field. Do you know ...
0
votes
0answers
60 views
How to get a common coordinate from two different coordinates on Elliptic Curves? [duplicate]
I am trying to write a SageMath script that multiplies two coordinates on Elliptic Curves into one common coordinate.
SageMath Elliptic curves over finite fields ...
2
votes
1answer
104 views
How to find out what the order of the base point of the elliptic curve is?
I wanted to use https://github.com/AntonKueltz/fastecdsa library and the function parameters for creating curve are:
...
2
votes
1answer
100 views
How to have a hash function that maps from a group element to a binary string of a certain size in charm-crypto?
I am facing a problem in programming with the charm-crypto library. The hash functions for pairing group elements in charm-crypto can only map from a string to a specific field: $\mathbb Z_r$, $G_1$ ...
2
votes
1answer
70 views
How can we link AES with Elliptic Curve Diffie-Hellman Key Exchange Method
Actually, I am working on a project to combine symmetric and asymmetric cryptographic algorithms.
The shared secret key for AES will be generated through the Elliptic Curve Diffie Hellman Key Exchange ...
0
votes
0answers
23 views
How to convert a nacl signing key to encryption key (NACL)
Because of the assumption of joint security, I want to use the same keypair for signing (ed22519) and encryption key exchange (x25519)
How can I share the same public key for my nacl.box.keyPair and ...
2
votes
1answer
49 views
What is FE2OSP (Field Element to Octet String Conversion Primitive)?
The reference below refers to "FE2OSP (Field Element to Octet String Conversion Primitive)".
Would appreciate any help in finding the definition (algorithm) for FE2OSP, and the format of its ...
1
vote
1answer
103 views
On an Elliptic Curve is that possible that from $P$ we can tell if $a$ is quadratic residue modulo $N$?
Imagine that, On an Elliptic Curve cryptography scheme where $P=a\times G$, Bob shares his public key $P$ with Eve (the devil who wants to know secrets he is not supposed to). Bob has also revealed a ...
0
votes
0answers
26 views
Can the same public key be used for ECDH and ECDSA [duplicate]
I want to generate a public key that I can use to sign messages and receive messages (using ECDH for exemple).
I want to do so to have the smallest payload to share.
Is it possible and proved secure ?
7
votes
1answer
304 views
NSA removed EC-256 and SHA-256 from CNSA recently--should we be alarmed by this?
Recently, the NSA (re-published?) their CNSA guidelines and some information on post-quantum computers (per the title of the document).
Here's the link for convenience (document is titled, 'Quantum ...
2
votes
2answers
400 views
How is the difficulty of discrete logarithm problem related to elliptic curve cryptography?
By definition, the discrete logarithm problem is to solve the following congruence for $x$ and it is known that there are no efficient algorithm for that, in general.
$$\begin{align*}
b^x\equiv r&\...
3
votes
1answer
63 views
The better algorithm for Modular Exponentiation on secp256k1/r1
I know Modular Exponentiation ($r = b^e \bmod m$) is important for RSA, and I can find some algorithm that if e is expressed in binary form (for exp: )--in such way for a n-bit long e, one can expect ~...
-1
votes
1answer
62 views
How long does it take to generate signature for Elliptic Curve keys using the P-256 curve?
If you have a plain text document, known public key to verify generated signature strings against.
EDIT: You do NOT know the private key, this is all you have.
Using a modern computing power with 4 ...
1
vote
1answer
96 views
OpenSSL EC PRIVATE KEY content structure details
Background
I am trying to understand how PEM contents are formatted for "EC Private Key" so e.g. following is private key
...
0
votes
0answers
40 views
Is it possible to get the x point of the secp256k1 elliptic curve knowing only the y point
There is a list where, using the coordinates of the x points, it was determined whether there are points in the curve
Here's a link
It can be seen that the generator according to the formula ...
1
vote
1answer
136 views
Q about points on an ECC curve
I'm trying to learn about ECC. I understand that the points of the finite field are determined by taking the continuous elliptic curve and finding its points that have integer coordinates. Since ECC ...
1
vote
1answer
70 views
The significance of the field of the factor in Lenstra’s ECM
I am going through Lenstra's Elliptic Curve Factorisation from Silverman's Mathematical Cryptography book.
I have understood the algorithm itself, but unable to understand a specific point the book ...
1
vote
1answer
104 views
How to find integer point of a ec curve in a given range?
I was looking inside the basics of ecc and found the examples from Internet either uses continuous domain curve or use a very small prime number p like 17 in a ...
3
votes
1answer
124 views
Is it safe to reveal an arbitrary EC point multiplied by a secret key?
We have a primary-order EC group. Need to perform a (sort-of) DH protocol, whereas the key is permanent, not a nonce (single-usage ephemeral key).
So we receive an arbitrary group element (EC point) ...
-3
votes
1answer
66 views
Show me all the steps and methods used to get from a system of 4 linear equations to solve for X1 and X2
I am looking at an answer to a previous question and I would like more detail about how the answer was arrived at but I am not allowed to comment as I am a new user with low points.
I am therefore ...
1
vote
2answers
1k views
What is a good and bulletproof private key for ECC curves?
I am quite new to cryptography low-level mathematic details, though had worked in the crypto area for 2.5 years before. So if I am wrong about any of below part, please correct me without a facepalm ...
0
votes
1answer
60 views
Elliptic Curve Key Compression
I have an elliptic curve y2 = x3 -x + 3 over a finite field of 127. I am trying to compress a point using the X9.62 standard. I know for the key compression you are supposed to check if the y value is ...
1
vote
0answers
35 views
How to derive Edwards Point Addition formula
Deriving the addition equation for a Weierstrass curve is simple and straightforward (I started with this video that covers the simple case. If you know the basic derivative rules you can find the ...
9
votes
1answer
958 views
How are curve names constructed?
I started with the question: Brainpool curves exist in a variant ending in ..r1 and ..t1. What does it mean?
But there are also "secp.." and "sect.." just like NIST's "..r1&...
2
votes
1answer
81 views
Why the trace of the Elliptic curve should be positive?
In https://eprint.iacr.org/2014/130.pdf , has been suggested to select the positive trace. What is the reason for this? What happened if we select the negative trace? Is there any security problem for ...
1
vote
1answer
78 views
How do we compute the CM discriminants without factoring?
In ECC, there is a parameter known as CM discriminants. Suppose that the trace of the curve is $t$ in $Z_p$. The amount of $s^2$ is the largest square dividing $t^2-4p$ then $\frac{t^2-4p}{s^2}$ is a ...