Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also ...
0
votes
0answers
23 views
Public-only KDF
I need a variant of KDF (key deviation function) capable of generating public keys only.
The use-case is the following: there's a master KDF, initialized by some secret data, which can generate ...
1
vote
0answers
21 views
HW wallet and multisignaters in ECC
I need to design a system where there is a secure device (a.k.a. HW wallet), with the following functionality:
Deterministic key generation for key parameters (speaking simply: key ID).
Never expose/...
1
vote
1answer
62 views
How Elliptic-Curve affects the Server Key Exchange parameters
In Finite Field DHE, the server sends the following parameters in the server key exchange message:
$p$: prime
$g$: group
$g^b$: the server's public DH key
In DHE_RSA (non anonymous DHE), the server ...
2
votes
1answer
44 views
Usefulness of OAEP with ECC
Does OAEP make sense for use in an ECC ElGamal cryptosystem? The way I see it, OAEP makes questionable sense even for RSA because even though it's a "all or nothing" transformation, many RSA ...
0
votes
1answer
29 views
Given paramaters of an Edward's curve and x, determine a y value if it exists
I'm making a demonstration cryptosystem using ECC ElGamal. I've currently got a working implementation of Edward's Curve operations and a basic ElGamal implementation (Encrypts only points on the ...
3
votes
1answer
72 views
How to securely map messages to points on an elliptic curve
I'm implementing a demonstration hybrid cryptosystem in Python (FinCrypt, I know the name is bad) and I'm migrating over from my Weierstrass curve implementation, which was based off of this, to one ...
-1
votes
1answer
45 views
How to use public/private keys in elliptic curve cryptography to encrypt/decrypt information
I'm reading a bit about elliptical curve cryptography. The basic idea is to define a dot-operator on the points of an elliptic curve. Given a starting point $P$, and applying this dot-operation $n$ ...
1
vote
0answers
43 views
Hashing into a supersingular elliptic curve
Is there any way to hash from a string
$\in \{0,1\}^{*}$ into a supersingular elliptic curve $E(F_p)$ such that the hash function behaves(provably) like a random oracle, and is efficient?
Using ...
-1
votes
0answers
36 views
There is DH and ECDH, and DSA and ECDSA… why isn't there an Elliptic Curve iteration of RSA? [duplicate]
Diffie-Hellman has an Elliptic Curve variant (ECDH).
Digital Signature Algorithm has an Elliptic Curve variant (ECDSA).
RSA (to my knowledge) does not have an Elliptic Curve variant.
Why?
(please ...
2
votes
1answer
73 views
Restoring a point on an elliptic curve
I received a representation of a point on an elliptic curve $GF(2^m)$ (with curve coefficient A, B) in specific format and some description how to decode it but not all is clear to me. I would be ...
0
votes
1answer
46 views
How to calculate Trace function for a point on an elliptic curve
I encountered trouble with calculating Tr (trace function) for points on an elliptic curve in polynomial basis ( $GF(2^m), m = 431$). Maybe there are any assumptions that can simplify and allow ...
2
votes
1answer
48 views
Are the following asymmetric encryption schemes equivalent?
Consider the scenario where you want a machine to be able to send daily encrypted backups to a storage server.
You'd prefer to not use simply a symmetric key for encryption, because if the machine ...
0
votes
0answers
73 views
What math should I learn to get in depth with Elliptic Curve Cryptography research?
My background is computer scientist. I have done applied cryptography research for a while. Currently, I'm working on Elliptic curve cryptography.
To understand the idea and how to use Elliptic curve ...
0
votes
2answers
41 views
ecdsa where the group order is larger than the hash size?
According to wikipedia, when generating a signature for ECDSA, you do the following (among other things):
Calculate $e=HASH(m)$, where $HASH$ is a cryptographic hash function, such as SHA-2.
...
1
vote
0answers
30 views
How to prove two ECDSA public keys on two different curves are generated from the same private key [duplicate]
I wonder if I provide someone with two public keys from different elliptic curves, is there any way to prove that these two public keys are generated from the same private key without revealing the ...
1
vote
1answer
45 views
what is the order for the brainpool twisted curves?
Per What is the difference between regular and "twisted" ECC curves? I guess the brainpool twisted curves and the brainpool regular curves use the same point addition and point doubling ...
-1
votes
0answers
18 views
Elliptic Curve: Extract Public part from Private Part
I would like to obtain the public part of an Elliptic Curve key (brain-pool type) from the private part and the components "X" and "Y" of the curve as inputs.
I would like to extract the public part ...
0
votes
2answers
54 views
Do I need to know the curve for ECIES decryption?
Let's assume that I have key pair generated using the following curves: brainpoolP256r1, brainpoolP320r1, brainpoolP384r1 or brainpoolP512r1.
Do I need information which curve was used to decrypt ...
0
votes
0answers
19 views
Pseudo random point (non floating and perfect square)
Hy, sorry I'm still learning Elliptic Curve Crypto. Recently I'm studying a paper ECC in a dynamic way, which we can generate the key. in this paper, they mention about generating a pseudorandom point ...
1
vote
0answers
36 views
What does the absence of Abelian group actions on supersingular isogenies implicate?
There are no Abelian group actions on supersingular isogenies. Why does this make them secure? - motivated by De Feo's Paper on mathematics of IBS
3
votes
1answer
115 views
How are isogeny graphs made and how are they helpful to crypto?
I don't understand how the shapes of isogeny graphs are determined. While Alice and Bob do walk on it and don't backtrack, are they actually relevant to crypto?
Also, I was told that supersingular ...
1
vote
0answers
37 views
Is my way safe to remove SSL CA Cert by DHT and PoW NodeID for a decentralized system?
To implement a decentralized system, I wrote a TLS like P2P net stack.
The main idea is removing CA Cert from the whole system by using a DHT for Naming and Key Exchange.
I am not a crypto expert, so ...
2
votes
0answers
34 views
Creating ECC Signature - Is “R” necessary in calculating “S”
After going through the mathematical proof in confirming ECDSA, it doesn't seem apparent to me that "R" is necessary in calculating "S" for the signature.
In other words, what's the problem with ...
4
votes
1answer
91 views
questions about modular reduction algorithm over $F_{2^m}$
So I'm trying to understand algorithm 2.40 (arbitrary reduction polynomials) from the Guide to Elliptic Curve Cryptography and have some questions.
The very first sentence of this section says this:
...
2
votes
1answer
78 views
Discrete logarithm on Montgomery curve twist
So for some context I've been playing with some crypto challenges, and ran into this interesting problem.
There's Montgomery curve C, point ...
0
votes
0answers
74 views
Understanding BLS12-381 Curve
I have some basic understanding of ECC - but pretty far from advanced concepts. I've been reading about BLS12-381 curve here and here, but I can't seem to fully understand it.
The things that I think ...
1
vote
2answers
78 views
Using the same private key to generate Schnorr and BLS signatures
I am wondering if it is possible or if there are any limitations to using the same private key to generate Schnorr and BLS signatures. Specifically, assuming I have a private key $x$, I want to use it ...
2
votes
1answer
34 views
choices for k in binary finite field modular reduction algorithm
In the Guide to Elliptic Curve Cryptography there's this algorithm:
My question is... what is $k$? Is it just some random value we pick? If so are some numbers better than others?
0
votes
1answer
48 views
Signing with RSA-SHA256 algorithm using EC keys
Is it practical to sign a data using RSA-SHA256 algorithm with EC keys?
I used a small NodeJS script and crypto module (uses openSSL internally) to test this and I could successfully sign the data ...
1
vote
2answers
68 views
Multiparty key exchange for end-to-end encryption
I need to make end-to-end encrypted messaging between 2 and more parties without trusting a server. Each party has it's secret and private keys. The obvious solution is to make ECDH between all of ...
0
votes
1answer
60 views
ECDSA signing and verification between Python and JS [closed]
I'm trying to have Python (2.7) and JS solutions for ECDSA signing (with secp256k1 curve) where ideally signatures generated by one side can be verified by the other.
For the python side, I'm using ...
-1
votes
1answer
26 views
Question About ECC Primitives (GnuPG)
In version 2.1, GnuPG featured primitives that use elliptic curves. For encryption, one option was ECDH, which confused me. I thought ECDH was for key agreement, not public key encryption. How does ...
2
votes
2answers
53 views
Why would Diffie-Hellman Group 21 be 521 bits rather than 512?
Diffie-Hellman groups tend to increment in key sizes as you'd expect up until group 21. Any idea why the key size is 521 rather than 512? I haven't been able to find an answer at all.
0
votes
2answers
53 views
The use of Elliptic Curves as part of a blockchain transaction
As I understand it, Elliptic-Curve Cryptography is used in the verification step of a transaction (i.e. when creating a digital signature), but not in the creation and security of a 'block' (when ...
0
votes
1answer
61 views
Issues with Elliptic Curve Point Addition
I'm trying to implement elliptic curve point addition in hardware. I've managed to create a working module using Affine coordinates however I've been reading about how points can be added by using ...
0
votes
0answers
37 views
How computationally heavy these algorithms?
I want to use Signal protocol to encrypt sensors data. As we know sensors have limited memory, CPU power, and battery. And Signal protocol has the following processes:
Encryption: AES in CBC mode and ...
0
votes
0answers
21 views
how to reduce the size of encrypted messages in elliptive curve cryptography?
how can we reduce the size of encrypted messages in elliptive curve cryptography? Or is it possible to reduce the size? If so what are the latest method to do that??
2
votes
1answer
118 views
X25519 - why openssl shows 253 bits?
When using ECDHE with Curve25519 with openssl:
Server Temp Key: X25519, 253 bits
I thought when we use X25519, it use 256 bit key. Why openssl shows the server temp key as 253 bits?
1
vote
0answers
21 views
How implement doubling point using VHDL language [closed]
I have a problem with my implementation. I want to make a multiplication in finite field. I don't know If my scheme is correct, but I made code on this base. I want to calculate:
D= XY
D=DX
Some ...
5
votes
2answers
100 views
How sensitive to change are elliptic curve formulae In layman's terms?
Take for example a curve from a recent question such as #25519:-
$$y^2 = x^3 + 486662x^2 + x$$
It's considered "safe". What are are the implications of amending it very slightly to:-
$$y^2 = x^3 + ...
1
vote
0answers
40 views
Preserving location privacy
What are cryptographic techniques that could be used so that if I wanna to enable a server to send message to certain nodes in a network with preserving the privacy location for them ??
3
votes
1answer
72 views
What standards of ECC point compression exist?
The method that I used before to decode EC point from public key led me in a dead end. So I just want to know what yet I could try.
I've got a public key that I don't know how to decode and I am ...
4
votes
1answer
174 views
Simple explanation of Miller's algorithm
Could someone explain to me in few lines (even one sentence) what Miller's algorithm computes?
Without talking about divisors and all the other concepts, I would like to be able to explain it to ...
0
votes
1answer
108 views
Birthday Attack against Cryptocurrency
One of my friends is creating his own cryptocurrency, just as a fun project, and he made some design choices that I think are insecure, but I personally don't have enough expertise to evaluate.
...
1
vote
1answer
41 views
What are the differences between ephemeral-static ECDH and static-static ECDH?
As I know ECDH can be used with a fixed public key. I read there are two types of static ECDH, ephemeral-static ECDH, and static-static ECDH.
What are the differences between these two types?
1
vote
1answer
78 views
Exactly what part of SIDH is proven to be NP-hard?
SIDH is quantum secure, why is it quantum secure? Exactly which part of the algorithm is proven to be NP-hard? Computing the isogeny function?
2
votes
1answer
39 views
How could you find the preimage of an isogeny function?
How do you know if an isogeny is surjective or not, and how do you tell how many points on E maps to E'? Does the answer lie in the degree of the isogeny function?
0
votes
0answers
16 views
What pairing does Charm Library use, like Tate or Ate or something else?
I'm implementing a pairing-based key-agreement scheme using Charm Crypto and PBC, and I'm struggling to understand the relationship between the curves proposed for use with pairings and the pairings ...
1
vote
2answers
52 views
powers of g in $GF(256)$
The finite field $GF(256)$ is usually implemented $mod$ 0x11b to keep the numbers inside that field.
I understand that 0x11b was ...
1
vote
1answer
220 views
Which one is faster GCM AES-128 or Curve25519?
As I know the symmetric encryption algorithms are faster than asymmetric encryption algorithms. But when I test GCM AES-128 and Curve25519 encryption time. I find Cure25519 are faster then GCM AES-128....
