Questions tagged [elliptic-curves]
Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.
1,319
questions
0
votes
1answer
62 views
Order of subgroups formed by Elliptic Curves with a Cofactor
In this question:
Why are the lower 3 bits of curve25519/ed25519 secret keys cleared during creation?
The answer indicates that the order of all points on the curve over the finite field ...
0
votes
1answer
66 views
Choice of finite fields for use in elliptic curves
this is maybe a basic question but I'm trying to better understand elliptic curve cryptography at a fundamental level.
I understand that a finite field is required in order to define a boundary for ...
0
votes
1answer
79 views
Why does curve25519 use a cofactor of 8?
This cofactor (as I understand it) effectively discards valid points that satisfy the curve equation over the finite field.
Why would one wish to reduce the number of possible private keys, it seems ...
0
votes
1answer
59 views
Does the nonce really have to be hashed as part of the challenge in a Schnorr signature?
From this article: https://tlu.tarilabs.com/cryptography/digital_signatures/introduction_schnorr_signatures.html#why-do-we-need-the-nonce
The article states that the challenge ...
0
votes
2answers
67 views
Elliptic curve commitments mod p
As far as I understand secp256k1 is defined over the group p with
p = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F
I don't really ...
0
votes
0answers
39 views
Signing with ECDSA [duplicate]
I am new to ECC. I was reading this post https://andrea.corbellini.name/2015/05/30/elliptic-curve-cryptography-ecdh-and-ecdsa/
I want to know if there is any intuition behind the following formula:
$...
0
votes
1answer
31 views
Is it possible to execute elliptic curve encryption on small sensor-tags CC2650?
I am working on a project wherein ECC needs to be implemented on small devices, namely, CC2650 sensor-tags for authentication. The ECC implementation should be on Contiki OS. I have read some articles ...
0
votes
2answers
91 views
How does this formula work $(aG + bG) = (a + b) G$ in ECDSA?
Please explain how does this formula $(aG + bG) = (a + b) G$ work in ECDSA?
According to the source:
$a$ and $b$ are different private keys
Suppose
$a = 3$
$b = 4$
then the public key is $Q = aG$...
0
votes
1answer
45 views
No way to do ECDH with OpenSSL from the command line?
I've scoured this website and the OpenSSL wiki pages, and done numerous internet searches, and I've come to the seemingly incredible conclusion that one cannot generate an ECDH shared secret key using ...
1
vote
1answer
51 views
Elliptic curve one time signatures
This is kind of an academic question, but I wonder if it's possible to build an intentionally one-time signature scheme with elliptic curves?
I assume you could do it by supplying ECDSA with ...
1
vote
0answers
37 views
Using ECC CDH test vectors with ECDH when h >1
I am writing formal tests for a system with a number of crypto requirements including support for ECDSA, ECDH and HMAC. The system is required to support the following EC's: NIST curves P-224, 384, ...
2
votes
1answer
53 views
Variants of Bilinear Diffie-Hellman Assumption
Could someone point me to the paper/reference where the following variant of q-strong Bilinear Diffie-Hellman assumption was used?
Given $s \in \mathbb{Z}_p^*$ and $g, g^{\frac{1}{s}}, g^{s}, g^{s^2},...
1
vote
0answers
58 views
How to find kernel of isogeny from the dual isogeny
Let $E$ be a supersingular elliptic curve over $\mathbb{F}_{p^2}$, where $p = \ell_A^{e_A} \ell_B^{e_B} f \pm 1$ for some primes $\ell_A, \ell_B$.
Let $R \in E[\ell_A^{e_A}]$ be a point of order $\...
0
votes
1answer
35 views
For discrete elliptic curves, can you find G, if you are given b and B?
I know you cannot find $b$ if you are given $B$ and $G$, where $B = [b]G$,
but can you find $G$ given $b$ and $B$?
0
votes
1answer
55 views
Post-Quantum Public Key Cryptography with EC math properties
Is there any quantum resistant public key cryptography with similar properties of elliptic curves?
Assuming lowercase for scalars and uppercase for points. The properties I'm interested are:
Reusing ...
1
vote
0answers
53 views
Elliptic curve discrete logarithm problem
I'd like to know what is the maximum bits of the finite field that we can solve the ECDLP in a "regular" computer in trivial time. Is there any recent data about this?
2
votes
1answer
52 views
How does the order of Q affect the time it takes to solve ECDLP?
I use Sagemath's built-in function discrete_log() to solve ECDLP and according to the documentation it uses Pohling-Hellman algorithm to solve an ECDLP.
This is ...
3
votes
0answers
60 views
Using (EC)DH to generate a signature
Say I have access to a system A that is limited to performing (EC)DH, followed by key derivation to produce a secret key. This secret key is later used to provide integrity protection.
There is a ...
0
votes
0answers
6 views
Have someone replaced Curve25519 in NaCL library? [migrated]
I am using NaCL library and I like it but I wonder if it is possible to replace Curve25519 with different stronger Curve if stronger encryption is needed.
I do understand that new library would be ...
0
votes
1answer
50 views
How to represent the point-at-infinity(Elliptic Curves) in code? [duplicate]
I am writing code for Elliptic Curve Cryptography. I have a class class EllipticCurvePoint.
...
2
votes
2answers
69 views
Is there a key exchange protocol that requires only one message?
Say I want to exchange a secret with someone, but I only get to send one message to the other person, and then we encrypt with that secret. Diffie-Hellman and ECDH require multiple messages to be sent ...
2
votes
0answers
46 views
What are some use cases for white-box digital signatures?
There were 2 papers published in the last year, that describe 2 different white-box identity-based digital signature schemes:
White-Box Implementation of the Identity-Based Signature Scheme in the ...
0
votes
0answers
60 views
Is it possible to distinguish ECC private key from the random values
I have a list of the random values (each 65 bytes long). One of the items is a private key which is used to sign the data:
...
0
votes
0answers
37 views
EC threshold private key's multiplicative inverse and derived-key sharing
I have two devices, and each has a private key xPriv-i. Each device computes the corresponding EC public key xPub-i, shares it, and the linear combination of the keys is the "real" public key xPub. ...
3
votes
0answers
95 views
ECDSA signature verification checks
From Wikipedia:
Check that $Q_a$ is not equal to the identity element $O$, and its
coordinates are otherwise valid.
Check that $Q_a$ lies on the curve.
Check that $n*Q_a = O$
Verify that $r$ and $s$ ...
0
votes
0answers
46 views
Difference in elliptic curve order and finite field size [duplicate]
Must the prime finite field, Fp, an elliptic curve is defined over always have a greater number of elements than the cardinality of an elliptic curve.
For example, If I have ...
1
vote
0answers
47 views
How to know if a point on a discrete elliptic curve be represented uniquely using its y-coordinate?
Let's say we have a point on an elliptic curve $p=(x, y)$ which is not the point-at-infinity.
Can there be some other point $\hat{p} = (\hat{x}, y)$ that is also on the curve and that has the same y-...
1
vote
1answer
42 views
Prevent a Man-In-The-Middle attack whilst transmitting a PSK for first time
I'm developing a network where two parties that want to join both compute ephemeral ECC keys for a key exchange, to create an encrypted connection. I plan to authenticate these keys by signing them ...
0
votes
1answer
84 views
Group in the context of elliptic curve crypto [duplicate]
I understand that the discrete log problem is defined as
$G^y \bmod p = x$
Speaking generally, $G$ here is a generator for the group zp*, where $G$ is able to ...
5
votes
1answer
423 views
Can multiple public keys lead to the same shared secret in X25519?
I have no mathematical knowledge about this, but I just read in RFC 7748 the following:
Designers using these curves should be aware that for each public key,
there are several publicly ...
0
votes
0answers
31 views
ECC order and modulus in EC [duplicate]
This question came from security.stackexchange.com.
I have an error in reasoning regarding to the calculations on elliptic curves. The basic group operations are all calculated mod p. Ok right.
Then ...
1
vote
1answer
42 views
Ensure Data Integrity In An ECDH Key Excange
Been playing around with the inner workings of onion routing and I have a problem. If I wanted to send the 2nd node of a relay network an ephemeral ECC public key, it has to go through node 1, so that ...
0
votes
1answer
35 views
Computing inverse of BN256 G2 point in golang x/crypto/bn256 library
I'm trying to confirm a vulnerability in a signing scheme I'm helping with. To do this I need to simulate a rogue key attack on a BLS aggregate signature using the golang bn256 library https://godoc....
0
votes
1answer
49 views
ECDSA secp256k1 attacks
Are there any known and feasible ECDSA attacks on secp256k1 which can reduce the bit security of the algorithm? For example from 256 bits of security down to 192 bits?
1
vote
2answers
90 views
How does ECDSA signature verify work in EOS and ETH/BTC, compare to standard (on text book I mean)
I have been studing ECDSA signature/verify for a while. By my understanding: the standard ECDSA signature/verify process (which we find on text book) are like below:
- A sender combines message and ...
0
votes
1answer
71 views
Why we cannot brute force Elliptic Curve private key? [duplicate]
I am learning ECC, I am confused a bit how it works for now. To my understanding, G is the starting point, k is how many times you apply the dot operation. And <...
0
votes
1answer
43 views
ECDSA public key point uniqueness [duplicate]
I'm new to ECDSA and there is something I still not sure about.
If I have a classic Certificate Authority server that delivers PEM certificates containing public key with ECDSA, I can retrieve the ...
0
votes
1answer
129 views
Using ECDH for encryption and decryption [duplicate]
I'm playing with cryptography and its use with typescript on one side and PHP on the other side. Now I'm looking for routines that can encrypt and decrypt with ecdh's private and shared keys. Any ...
1
vote
1answer
50 views
Efficient calculation of point coordinates with elliptic curves over binary field
I'm trying to find an efficient algorithm to calculate the $y$ coordinate of a an elliptic curve point given its $x$ coordinate, for elliptic curves over fields of the form $2^m$ with polynomial ...
1
vote
1answer
88 views
Calculation of the order of the cosets used in defining the Tate Pairing
I'm working through Pairings for Beginners by Craig Costello, and am trying to understand the preamble to the Tate pairing. (See p. 70 ff., section 5.2 of of the PDF.). I'm having trouble following a ...
-1
votes
1answer
60 views
Points on elliptic curve [closed]
I am making a program using the library cryptopp using curve secp521, in which at the end of that program I get n*Point Because I am writing that program I know that what is the value of 'n'. So, I ...
1
vote
1answer
69 views
What is the possibility of collision of trailing 160 bits of Keccak_256, for any two differing public-keys as pre-images?
Earlier today I was answering a question on the ethereum SE site that analyzed the potential for more than one private key on curve secp256k1 (which maps to a distinct public key) to control the same ...
0
votes
1answer
82 views
RSA vs Elliptic Curves
I am currently reading about how more efficient and ''light'' is ECC compairing to RSA as far as key generation is concerned. My question is simple, why does RSA continue to be used today (ex.SSL) ...
4
votes
1answer
131 views
Hash multiset to point on elliptic curve where $A = 0$
I want to hash a multiset to a point on the elliptic curve $y^2 = x^3 + 3$ over a finite field of some 254-bit prime order, where $P = 3 \pmod 4$. Moreover, I want this hash to be incremental, in that ...
2
votes
1answer
91 views
Elliptic Curve Discrete Log in a Composite Ring
Elliptic curves are usually defined over prime rings (fields), but what if we chose a ring of composite order? Let $n = pq$ for $p,q$ large primes. Say I have elliptic curve $y^2 = x^3 + ax + b$ over ...
0
votes
1answer
74 views
Learning elliptic curve cryptography for specific application
I would like to develop a protocol for specific purpose. This protocol will utilize asymmetric cryptography in which one private key can be paired with numerous public keys: messages encrypted with ...
4
votes
1answer
99 views
secp256k1 point density
I am working on a crypto project using the secp256k1 elliptic curve.
I know that I can select a random point $P = (x, y)$ from the curve by randomly selecting the first coordinate $x \in \mathbb{Z}_p$...
0
votes
1answer
73 views
Elliptic curve with prime subgroup equal to field size
I am aware that when the equation $\#E(\mathbb{Z}_p) = p$ holds for prime $p$, the elliptic curve is called "anomalous" and is insecure do to "Smart's attack".
Consider the similar case that $E(\...
1
vote
2answers
82 views
Using public-key signature instead of having API key
I am designing an application that will need an API key. At first I believed that generating a long, random token would be secure enough (say 32 chars string that includes 0-9, a-z and A-Z), and then ...
1
vote
2answers
72 views
“Dave Check” for a tweakable P-256 ECDH KDF
I have two devices with hardware tokens that contain P-256 private keys, and which allow me to compute ECDH shared secrets with arbitrary public keys. I need to build a tweakable key derivation ...
