Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

Filter by
Sorted by
Tagged with
1
vote
0answers
11 views

Double discrete logarithm on elliptic curve

Background: I am attempting to implement the paper Publicly Verifiable Secret Sharing. I managed to get it working using modular groups, but when I want to make it more efficient by transferring to ...
1
vote
0answers
18 views

Protecting Ed448 against DPA and fault attacks

There are some papers (1, 2) describing fault attacks in EdDSA. One suggested countermeasure is to add randomness to the input of the first hash call, which outputs a scalar. This paper describes a ...
0
votes
0answers
18 views

Lifting point to quadratic twisted curve

How to lift point to it’s quadratic twisted curve? I use secp256k1. Is the diiscrete log still same? Thanks before
-3
votes
0answers
32 views

How to compute key size of elliptic curve? [closed]

Please can anyone tell me How compute the length of key K=(1062,1570)? I don't know how to compute it ..
3
votes
0answers
47 views

ECC: Lightweight proof of correct exponentiation

In the context of ECC. There's an EC point $P$ which is supposed to be a known power of another known point $G$ (generator). That is: $P = [k]G$ (in additive notation) This should be verified on an ...
0
votes
0answers
23 views

BIP32 Extended Key to EC Private and Public Key Pair

We are working on an application in Android using Java. In our project, we used to generate EC key pairs (of size 384 bits) using SpongyCastle - an old Android version of Bouncy Castle. The problem ...
-1
votes
0answers
34 views

Generate keys with Edwards25519 - Equivalence to Curve25519

I am trying to generate Ed25519 keys based on a 32-byte seed. According to RFC 8032, in order to create the public key, you have to take the private key, hash it with SHA-512, prune it, and then use ...
-2
votes
0answers
20 views

complexity of ElGamal ECC and Menezes-Vanstone ECC? [closed]

How to compute the complexity of ElGamal ECC and Menezes-Vanstone ECC?
-1
votes
0answers
12 views

ElGamal ECC. and Menezes-vanstone ECC

Can anyone tell me how to measure the security force of ElGamal ECC. and Menezes-vanstone ECC.?
2
votes
1answer
53 views

Checking if point is on EC twist

Given a short Weierstrass elliptic curve $C$ over $F_p$ and a point $(x, y)$, it is easy to verify that $(x, y)$ either satisfies the curve equation (on-curve) or does not (off-curve). In the case ...
0
votes
0answers
19 views

What is the best way to encrypt whole partitions with Ed448-Goldilocks?

I like crypto, but I'm a bioanalytical chemistry person by trade. I like this algorithm and was wondering if I could use it to encrypt partitions like a MBR that prompts a passphrase, like BitLocker.
2
votes
0answers
51 views

Shamir three-pass protocol Elliptic Curve

I want to know how I can implement this protocol. I know how Shamir three pass protocol operates without elliptic curve, but I don't know how I can perform it with elliptic curve. I read about this ...
2
votes
3answers
149 views

Can DNA computing to solve elliptic curve algorithms using this method

The authors of this paper: Fast Parallel Molecular Algorithms for DNA-Based Computation: Solving the Elliptic Curve Discrete Logarithm Problem over $GF(2^n)$ proposed a novel algorithm based on DNA ...
0
votes
1answer
40 views

Division of Point in Elliptic Curve: Getting Back Point

Let $P=(x_p,y_p)$ be a point on elliptic curve $E (a, b) := y^2=x^3+ax+b$, for an integer $n$, there exists a point $Q=(x_q,y_q)=nP$ on $E (a, b)$. If $(x_q,y_q)$ and $n$ are given, what is the ...
0
votes
0answers
36 views

Can knowing the ephemeral key recover the private key in ECDSA

If the attacker - some guy who really, really wants to steal bitcoins - somehow finds the ephemeral key used in an 256-bit ECDSA signature, can he recover the private key? If so, would knowing the ...
1
vote
0answers
43 views

Elliptic Curve (Point Counting)

I am studying elliptic curves in particular point counting. If I have coordinates P and 2P, is there a way to calculate the total points in between P and 2P using either curve parameters or algorithm? ...
2
votes
1answer
61 views

Finding subgroup in elliptic curve over finite field $ \mathbb{F}_{11}$

For elliptic curve $ y^2 = x^3 +3x+7$ I found the finite group $ E(\mathbb{F}_{11})= \left\{ \mathcal{O}, (1,0),(5,2),(5,9),(8,2),(8,9),(9,2),(9,9),(10,5),(10,6) \right\}$. I have to find a ...
0
votes
0answers
26 views

Pair-friendly elliptic curves vs non friendly

Group law operations on pair-friendly elliptic curves are slower than in non friendly elliptic curves, but how much slower? Can't seem to find a performance comparison between the two for a given ...
0
votes
0answers
36 views

Generalized Schnorr's signature variations

I'm working on an ECC-based system. There's a Schnorr's signature, by which the prover may prove a knowledge of a preimage (i.e. scalar, private key) of an EC point (i.e. public key). It can be ...
1
vote
1answer
49 views

Does ECC's cofactor affects ECC's private key selection?

I am doing a project using ECDH with Curve25519. I use mbedtls library, in the implement, I realize that the private key of Curve25519 is clear 3 last bit, or it is divide by 8 and the cofactor of ...
1
vote
1answer
73 views

Elliptic Curve vs RSA key length comparison

I'm new to ECC. From this website (GlobalSign Elliptic Curve Cryptography) a 256 elliptic curve key pair provides as much security as a 3072 bit RSA key pair. My question is: how do experts come to ...
4
votes
1answer
142 views

Is double encryption really a bad idea? Are meet-in-the-middle attacks practical at all?

Meet-in-the-middle attacks are used to justify that attacks on ECC and double encryption will have complexity of $O(\sqrt{n})$ for ECC and $O(2^{n+1})$ for double encryption complexity instead of $O(n)...
1
vote
2answers
56 views

How to impelement mapping point Curve25519 to weierstrass point?

I am implementing a ECDH using Curve25519 to communicate two system. One system have library that use for weierstrass curve only, it can define with domain parameter like p, a, b, G_x, G_y. I have ...
1
vote
0answers
55 views

is forward secrecy irrelevant for non-streaming applications?

I asked a question yesterday about the Keybase key model and got no answers, unfortunately. Let me rephrase the question to make it clearer: in the case, if 2 users just want to send each other low-...
1
vote
0answers
40 views

Trying to understand Keybase's key model and replacing PGP with device keys

I am exploring Keybase and I thought it was merely a wrapper for gpg and connecting its public key with social accounts (e.g. github, twitter, etc...). But after reading the very short and unclear ...
-2
votes
1answer
59 views

ECDSA multiplication vs exponentiation

In Elliptic Curve Digital Signature Algorithm (ECDSA) I often see 2 different written equations of it: Elliptic curve point multiplication by a scalar, $Q_{A}=d_{A}\times G$, source Modular ...
0
votes
0answers
34 views

Where can I find standardized implementations of lightweight cryptographic ciphers?

I am working on a project that requires encrypting messages with different ciphers. I am looking for the following ciphers: PRESENT, CLEFIA, LEA, Hill cipher, Affine cipher, Elliptic Curve ...
1
vote
1answer
84 views

Assistance with parsing PGP PRIVATE KEY BLOCK's Secret-Key Packet (0x6) and Secret-Subkey Packet (0x7) using command lines and RFC 4880?

The throw away private keys below (master ed25519 & subkey curve 25519) were exported without being password encrypted. % cat skaht_0523F5B4_Secret.asc ...
1
vote
0answers
47 views

Verifying the ownership of curve25519 public keys

Let's say we have a group of users, authenticated by a server that providers the service, communicating on a secure channel (e.g. over HTTPS/TLS) and each user has a corresponding curve25519 key pair. ...
1
vote
1answer
66 views

Complexity of computing zk-SNARK Proofs

Disclaimer: I have no background in cryptography, and everything I'm asking about is what I've learnt from last couple of days of frantic reading on this topic. Any help is much appreciated. Q: What ...
0
votes
1answer
47 views

Understanding simplification steps when solving complicated equations in Galois Field

I just encountered a problem when I tried to understand a basepoint conversion from x25519 to ed25519. I can't really wrap my head around how the value of $x$ can be the stated value below? Can ...
6
votes
2answers
433 views

How to create an EC point from a plaintext message for encryption

It seems that ElGamal encryption is also possible for Elliptic Curve cryptography. However, that requires the user to convert the message to a point on the curve. What strategies are there to derive a ...
0
votes
1answer
86 views

ECC public key encryption without symmetric cipher

Imagine the following scenario. A process is running in background and permanently encrypting some data. An adversary has full control of the process, e.g. it can dump the process memory any time and ...
3
votes
2answers
80 views

Size of $E$ over $\mathbb{F}_p$ contains $p+1$ points

I am struggling to prove this claim: I proved that the map $x\mapsto x^3+1$ is a bijection from $\mathbb{F}_p$ to itself if we have that $p\equiv 2\bmod{3}$. We have to use this fact to prove that ...
0
votes
0answers
24 views

Compute shared public keys

I want to compute, in a distributed way, the following shared public keys on an elliptic curve: $(xG, x^2G,...,x^nG)$, being $x$ a secret scalar that no single party knows, $G$ the public ...
2
votes
2answers
233 views

Operation on elliptic curves

Let $Y = xG$ be a point on an elliptic curve, $G$ the generator point and $x$ a scalar. Without knowing $x$, is it possible to calculate $x^nG$, being $n$ a natural number?
2
votes
1answer
146 views

Public Key generation for Ed25519 vs X25519

It is my understanding that EdDSA uses a slight variant of Curve25519 (typically used for ECDH), called Ed25519. Given the same private key, are the differences between the two algorithms enough to ...
1
vote
2answers
61 views

Understanding Montgomery's parameterization of elliptic curves

I'm having a bit of trouble understanding the translation of affine coordinates to projective coordinates in Montgomery curve ECM. Would be very thankful if someone could explain it by expanding the ...
0
votes
1answer
77 views

Can we retrieve his private key using his public key in ECC?

A paper wallet is the name given to an obsolete and unsafe method of storing bitcoin which was popular between 2011 and 2016. It works by having a single private key and bitcoin address, being printed ...
4
votes
0answers
68 views

Regarding the need to hash the shared secret in X25519 with the public keys

I was looking at the LibSodium documentation where it says [...] and to mitigate subtle attacks due to the fact many $(p, n)$ [public key - secret scalar] pairs produce the same result, using the ...
1
vote
0answers
38 views

Need help understanding SPAKE2 setup values

I am trying to write a simulation of the SPAKE2 protocol in python (just so I can get a better understanding of the protocol altogether). I am reading through the ietf draft here: Datatracker. There'...
0
votes
1answer
374 views

“Probability” of an ECDSA signature

The article Elliptic Curve Digital Signature Algorithm in Bitcoin's wiki talks about signatures having probabilities (as in ...
0
votes
1answer
63 views

Is this the right way to implement ElGamal scheme over Elliptic Curves over prime field? [duplicate]

I'm fairly new to Cryptography, especially elliptic curves in general. I learned to do Point Multiplication, Scalar Multiplication and also programmatically implemented them. But I was trying to do ...
0
votes
1answer
74 views

Key clamping in curve25519 not evident in generated key's binary representation

I understand with curve25519 that the private key for secret.box is clamped... I understand that this clamping process to clear ...
0
votes
1answer
82 views

Order of subgroups formed by Elliptic Curves with a Cofactor

In this question: Why are the lower 3 bits of curve25519/ed25519 secret keys cleared during creation? The answer indicates that the order of all points on the curve over the finite field ...
0
votes
1answer
85 views

Choice of finite fields for use in elliptic curves

this is maybe a basic question but I'm trying to better understand elliptic curve cryptography at a fundamental level. I understand that a finite field is required in order to define a boundary for ...
1
vote
1answer
113 views

Why does curve25519 use a cofactor of 8?

This cofactor (as I understand it) effectively discards valid points that satisfy the curve equation over the finite field. Why would one wish to reduce the number of possible private keys, it seems ...
0
votes
1answer
70 views

Does the nonce really have to be hashed as part of the challenge in a Schnorr signature?

From this article: https://tlu.tarilabs.com/cryptography/digital_signatures/introduction_schnorr_signatures.html#why-do-we-need-the-nonce The article states that the challenge ...
0
votes
2answers
89 views

Elliptic curve commitments mod p

As far as I understand secp256k1 is defined over the group p with p = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F I don't really ...
0
votes
0answers
39 views

Signing with ECDSA [duplicate]

I am new to ECC. I was reading this post https://andrea.corbellini.name/2015/05/30/elliptic-curve-cryptography-ecdh-and-ecdsa/ I want to know if there is any intuition behind the following formula: $...