Questions tagged [elliptic-curves]
Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.
0
votes
1answer
15 views
curve25519 by openSSL
How can i generate ec curve25519 keys using openSSL?
When I run
openssl ecparam -name curve25519 -genkey -noout -out private.ec.key
I have this message
...
0
votes
0answers
9 views
Build a PEM file by having ec public key coordinates
I have the coordinates (x,y) of eliptic curve point that is my public key.
How can i build the PEM ( or DER ) file for my public key?
I don't care about language (java, python, javascript, ...), ...
1
vote
1answer
32 views
Does any problem arise when the order of an elliptic curve is equal to its prime field modulus? [duplicate]
Regarding cryptographic schemes in elliptic curve cryptography, is there a problem with having the order of an elliptic curve being equal to its prime field modulus?
That is, an elliptic curve where $...
0
votes
0answers
39 views
Modifying Elliptic Curve Parameters
For context, I was watching this bit of the video: which goes over this source code. The piece is about elliptic curve cryptography and how it works. I want to use some of this knowledge to make my ...
0
votes
0answers
24 views
What is the cryptography involved in the initial setup of a cryptocurrency?
I keep hearing that when a cryptocurrency is created it goes through an initial setup phase wherein cryptographic parameters are created that are used by the cryptocurrency network throughout its ...
0
votes
0answers
48 views
Is my approach for authenticated key derivation based on a master key secure? [on hold]
My goal is to be able to have a single Master Key and store this on a central machine. A client communicates with this central machine to request and receive a certified key derived from this master ...
0
votes
0answers
27 views
The ECC private key is generated with 0x00 at the beginning.(prefix)
I created a private key using the prime256v1 curve.
My purpose is to get a 32 byte private key.
However, the private key is preceded by 0x00, resulting in 33 bytes.
Why is this happening?
The only ...
0
votes
0answers
23 views
How to get a random point of a specific EC group with cofactor Not-Equal 1?
We got a EC group generated with point G, and the cofactor of E(G) is with the similar size of the Order. Now we need a random point of E(G) and not revealing the "logarithm" of the random point, so ...
2
votes
1answer
68 views
Are there any security risks in using Elliptic Curves defined over fields $\mathbf{F}_{p^n}$ where $n>1$
I've recently been studying elliptic curves, and I've found that most of the current implementations use fields $\mathbf{Z_p}$ or in some cases $\mathbf{F}_{2^n}$. All the reasons I've seen for not ...
1
vote
1answer
37 views
Replacing elliptic curve diffie-hellman primitive with elliptic curve cofactor diffie-hellman for specifc curves?
From what I've read about elliptic curve Diffie-hellman with and without cofactor (I am pretty new to the whole thing so I am not able to understand everything) is that when the cofactor of the curve $...
0
votes
1answer
55 views
Why does Hasse's theorem sometimes seem to be invalid?
In order to generate secure elliptic curves, this answer recommends to
Calculate the cardinal $|E(\mathbb{F}_p)|$
Check this cardinal is in the hasse interval
(with $p$ prime) and to ...
4
votes
1answer
93 views
Elliptic Curve Cryptography insecure when input does not lie on the curve?
I am new to Elliptic Curve Cryptography and I was reading up on it online when I came across this link. It stated the following.
Unfortunately, there is a gap between ECDLP difficulty and ECC ...
0
votes
1answer
32 views
Reasoning about WebCrypto ECDSA choices: P-256/384/521, SHA-1/256/384/512?
When implementing EC signing/verification in Javascript, the only options available via the WebCrypto API are:
Curves: P-256, P-384, or P-521
Hashes: SHA-1, SHA-256, SHA-384, or SHA-512
If I was ...
1
vote
1answer
50 views
Valid private keys on curve25519
Given that valid private keys on curve25519 must be less than the order of the curve which is (as I understand) already smaller than 2^256, AND a valid key must be clamped to be divisible by 8 and ...
3
votes
1answer
46 views
Is inversion always cheap with Twisted Edwards curves?
I'm reading on Jubjub, which is planned for the next upgrade of Zcash. It is based on a Twisted Edwards curve with parameters $a = -1$ and $d = −(10240/10241)$. The reading says Jubjub does not need ...
3
votes
1answer
101 views
What makes lattice-based cryptography quantum-resistant?
As opposed to RSA or elliptic curve cryptography?
1
vote
2answers
57 views
Complexity of number field sieve theorem does not match with security of elliptic curves
Number field sieve algorithm can is used to break discrete logarithm on field $F_{p^n}$. The algorithm has time complexity $\exp((c+o(1))\cdot(\log p^n)^{1/3}\cdot(\log \log p^n)^{2/3}$. Originally ...
0
votes
2answers
49 views
Diffie-Hellman Primitives in SP800-56A
I wonder if someone can give an explain about the different between two Diffie-Hellman Primitives defined in SP800-56A, CH5.7.1
5.7.1.1 Finite Field Cryptography Diffie-Hellman (FFC DH) Primitive
5.7....
0
votes
1answer
42 views
Question regarding of the ECC test vector format
I am trying to find some ECC test vector for using.
I just find some post (like this) and github resource (like this )
They are good reference to my C test code but I'd like to get some more advice... ...
1
vote
2answers
91 views
Invalid curve attack: finding low order points
Background
Here's a description of page 182 of "Guide to Elliptic Curve Cryptography" by Hankerson, Menezes and Vanstone. Here's a quote from that page:
The main observation in invalid-curve ...
-2
votes
1answer
34 views
Given a point $c$ in a field $Z_p$. Can we get another value $c^{'}$ such that $\left(c^{\prime}-c\right)$ is invertible in $Z_p$?
If we have a point in a field $c$. Can we get another value $c^{'}$ such that
$\left(c^{\prime}-c\right)$ is invertible in $Z_p$ ?
0
votes
0answers
21 views
Key Value Based Key Derivation
For a system that is using public key cryptography to authenticate users and their actions I'm trying to solve (ease) UI/UX problem so that users will be able to use login/passwords they're accustomed ...
0
votes
2answers
55 views
SIDH cryptosystem question
I'm trying to understand the SIDH cryptosystem and got confused at this point:
Alice fixes base $\{P_A,Q_A\}$ so that it generates $E_0[l_A^{e_A}]$. Then she chooses secret parameters $m_A,n_A$ and ...
1
vote
1answer
41 views
NIST elliptic curves behaving anamolous in OPENSSL benchmark
I tried to collect some benchmarks on NIST elliptic curves using charm library. The charm library is just a wrapper over OPENSSL. I experimented with prime192v1 (P-192), secp224r1 (P-224), prime256v1 (...
0
votes
1answer
34 views
Naming convention for NIST elliptic curves in OPENSSL
NIST standardized 5 elliptic curves (P-192, P-224, P-256, P-384, P-521) for prime fields. When I looked into openssl, these curves are named as prime192v1, secp224r1, prime256v1, secp384r1, secp521r1. ...
2
votes
1answer
65 views
Is Curve P-384 equal to secp384r1?
I am a bit confused with different notations of elliptic curves.
Specifically, I am comparing the NIST specification with the SECG specification.
More specifically I want to know if the NIST curve $...
1
vote
0answers
77 views
Security of an Elliptic Curve Public Key with a “Small” x-coordinate
Consider an elliptic curve over a finite field $F_p$ with $p$ prime and order $n$. Let $Q$ be a generator for the field. Given a public key point $P = aQ$, suppose we have an algorithm that finds an ...
-1
votes
0answers
65 views
What is the difference between a prime field $F_p$ and binary field $F_{2^m}$ in the elliptic curves? [duplicate]
I am using elliptic curves to encrypt a VOIP application, but I can not understand the difference between using an algorithm based on a binary field or a primary field.
I would like for someone to ...
1
vote
1answer
87 views
Do Weil, Tate, and Ate pairings exist on all elliptic curves?
I don't know much about the math behind elliptic curves.
Do Weil, Tate and Ate pairings exist on all elliptic curves? If the answer is negative, then what pairings do MNT, BN and SS curves have?
...
2
votes
1answer
63 views
What does the number 256 in pairing curve BN256 indicate?
There are many pairing based elliptic curves like MNT curves, BN curves, SS curves etc., When we say BN256 curve, what does the number 256 indicate? Is it some group order or number of bits required ...
1
vote
1answer
63 views
Is there a concept of embedding degree for non-pairing based elliptic curves?
From this post, I learned the concept of embedding degree. Intuitively, if embedding degree of an elliptic curve $E(F_p)$ is $k$, it means there is a way to transform points in $E(F_p)$ to $F_{p^k}$. ...
1
vote
2answers
66 views
EC Key Compression
Using the secp256k1 curve, will the below yield the same result?
Generate private key -> compress private key -> generate public key
Generate private key -> generate public key -> compress public key
...
-1
votes
1answer
46 views
Elliptic curve over prime field with high order roots of unity
Suppose I have an elliptic curve defined over a prime field $\operatorname{GF}(p)$ where $p$ is a large prime (e.g. 256-bit). Suppose also that $p = kn +1$, where $n$ is a relatively large power of $2$...
0
votes
1answer
33 views
Is there a lower limit on message length for signature?
I was working on a tool that signs small messages (~20 bytes) when a question occurred about message size: What would be the risk of using extremely small/restricted input (say, 5 bytes of hexadecimal ...
0
votes
1answer
32 views
Question about using Montgomery form for elliptic curve operations on bls12-381
Since the prime for bls12-381 is not of a form to allow easy modular reduction , is the best approach to use the Montgomery multiplication + reduction algorithm?
...
4
votes
2answers
196 views
In Elliptic Curve, what does the point at infinity look like?
We know that for each point $P$ in curve $E$ there exists a minimum scalar $k$ such that $k*P$ equals the point at infinity. And the book Cryptography Theory and Practice by Douglas R. Stinson only ...
0
votes
1answer
34 views
Is there a way to project one elliptic-curve element to a subgroup with certain size?
For discrete logarithm we can pick a random number $n$ and project it to a subgroup. E.g. given a prime $p$ with
$p-1 = 2\cdot a \cdot b +1$
we can compute
$n^{((p-1)/a)} \equiv n_a \mod p$
after this ...
0
votes
0answers
40 views
ECC with 512bit compatible curves
I understand that given solutions for solving a discrete logarithm problem are on the order of 𝑂(2𝑛/2), ergo, 256bit private keys based on 25519 or secp256k1 have an effective bit strength of ...
2
votes
2answers
300 views
0
votes
0answers
36 views
Why do they use elliptic curve instead of circle or other simpler curves? [duplicate]
I am curious why people use elliptic curve in cryptography. I know the main requirement is DLP, but elliptic curve is not the only curve with such property. Some of curves seem to be even simpler.
As ...
0
votes
1answer
88 views
Why are singular “elliptic” curves bad for crypto?
Consider the algebraic curve given by a short Weierstraß equation $y^2=x^3+ax+b$.
If $4a^3+27b^2=0$, then there are repeated roots of the right-hand side $x^3+ax+b$. How are these repeated roots bad ...
3
votes
0answers
27 views
If curve bn256/bls12 support the isomorphism from $G_2$ to $G_1$?
Is bn256 or bls12 a type-2 pairing-friendly curve?
As Dan Boneh said here
While in many pairing instantiations this ψ exists naturally, in some instantiations it does not.
However I can not find ...
1
vote
1answer
78 views
Are there any NIST curves with pairings?
NIST FIPS.186-4 has standardized 5 ECC curves on field 𝔽𝑝 (P-192, P-224, P-256, P-384, P-521) and 10 elliptic curves on binary fields. None of them seem to have pairings. Are there any standard ...
3
votes
1answer
79 views
Why is the strength of an Elliptic Curve Cryptography (ECC) half the size of the prime field size?
I've looked around and couldn't find a direct answer. As a general rule, I've read from various sources (here here, and here) that the strength of an elliptical curve key is half of the size of the ...
0
votes
3answers
138 views
Is the curve25519 algorithm a special(implementation) one of ECDH?
It's the first time for me to learn about Key Exchange Protocol. And I thought that in both ECDH and DH there is a necessary step to share some public infomation(the common parameters) to each sides ...
1
vote
0answers
29 views
short signature for EC
i'm building a low-power wireless sensor network in which each slave node has a public/private ECC key pair -- generated by the node itself during manufacturing.... the slave node is also provisioned ...
0
votes
1answer
44 views
How to calculate the order of the subgroup?
Given a curve with points over GF(p), a subgroup of prime order q and a co-factor h.
How do I calculate the size of q which is ...
0
votes
1answer
52 views
Security strength EC signature for variable message size
I am implementing a system using some sort of 32bytes OTC (One-Time Code) and signing it with ECDSA to get verification of a public key owner.
The key I'm using is ...
1
vote
1answer
27 views
Cost model for different curve models
Is there a cost model for each curve model and their conversions?
For example:
Take the curve models: Projective, Completed, Extended, Affine.
Is there a table which shows how many multiplications, ...
3
votes
0answers
112 views
How does post quantum key exchange in OpenSSH 8 work?
OpenSSH 8 supports a post quantum KEX, namely sntrup4591761x25519-sha512@tinyssh.org
It says in its description that it is basically NTRU + ECC X25519. However, I have tried but cannot understand how ...
