Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

Filter by
Sorted by
Tagged with
0
votes
1answer
62 views

Order of subgroups formed by Elliptic Curves with a Cofactor

In this question: Why are the lower 3 bits of curve25519/ed25519 secret keys cleared during creation? The answer indicates that the order of all points on the curve over the finite field ...
0
votes
1answer
66 views

Choice of finite fields for use in elliptic curves

this is maybe a basic question but I'm trying to better understand elliptic curve cryptography at a fundamental level. I understand that a finite field is required in order to define a boundary for ...
0
votes
1answer
79 views

Why does curve25519 use a cofactor of 8?

This cofactor (as I understand it) effectively discards valid points that satisfy the curve equation over the finite field. Why would one wish to reduce the number of possible private keys, it seems ...
0
votes
1answer
59 views

Does the nonce really have to be hashed as part of the challenge in a Schnorr signature?

From this article: https://tlu.tarilabs.com/cryptography/digital_signatures/introduction_schnorr_signatures.html#why-do-we-need-the-nonce The article states that the challenge ...
0
votes
2answers
67 views

Elliptic curve commitments mod p

As far as I understand secp256k1 is defined over the group p with p = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F I don't really ...
0
votes
0answers
39 views

Signing with ECDSA [duplicate]

I am new to ECC. I was reading this post https://andrea.corbellini.name/2015/05/30/elliptic-curve-cryptography-ecdh-and-ecdsa/ I want to know if there is any intuition behind the following formula: $...
0
votes
1answer
31 views

Is it possible to execute elliptic curve encryption on small sensor-tags CC2650?

I am working on a project wherein ECC needs to be implemented on small devices, namely, CC2650 sensor-tags for authentication. The ECC implementation should be on Contiki OS. I have read some articles ...
0
votes
2answers
91 views

How does this formula work $(aG + bG) = (a + b) G$ in ECDSA?

Please explain how does this formula $(aG + bG) = (a + b) G$ work in ECDSA? According to the source: $a$ and $b$ are different private keys Suppose $a = 3$ $b = 4$ then the public key is $Q = aG$...
0
votes
1answer
45 views

No way to do ECDH with OpenSSL from the command line?

I've scoured this website and the OpenSSL wiki pages, and done numerous internet searches, and I've come to the seemingly incredible conclusion that one cannot generate an ECDH shared secret key using ...
1
vote
1answer
51 views

Elliptic curve one time signatures

This is kind of an academic question, but I wonder if it's possible to build an intentionally one-time signature scheme with elliptic curves? I assume you could do it by supplying ECDSA with ...
1
vote
0answers
37 views

Using ECC CDH test vectors with ECDH when h >1

I am writing formal tests for a system with a number of crypto requirements including support for ECDSA, ECDH and HMAC. The system is required to support the following EC's: NIST curves P-224, 384, ...
2
votes
1answer
53 views

Variants of Bilinear Diffie-Hellman Assumption

Could someone point me to the paper/reference where the following variant of q-strong Bilinear Diffie-Hellman assumption was used? Given $s \in \mathbb{Z}_p^*$ and $g, g^{\frac{1}{s}}, g^{s}, g^{s^2},...
1
vote
0answers
58 views

How to find kernel of isogeny from the dual isogeny

Let $E$ be a supersingular elliptic curve over $\mathbb{F}_{p^2}$, where $p = \ell_A^{e_A} \ell_B^{e_B} f \pm 1$ for some primes $\ell_A, \ell_B$. Let $R \in E[\ell_A^{e_A}]$ be a point of order $\...
0
votes
1answer
35 views

For discrete elliptic curves, can you find G, if you are given b and B?

I know you cannot find $b$ if you are given $B$ and $G$, where $B = [b]G$, but can you find $G$ given $b$ and $B$?
0
votes
1answer
55 views

Post-Quantum Public Key Cryptography with EC math properties

Is there any quantum resistant public key cryptography with similar properties of elliptic curves? Assuming lowercase for scalars and uppercase for points. The properties I'm interested are: Reusing ...
1
vote
0answers
53 views

Elliptic curve discrete logarithm problem

I'd like to know what is the maximum bits of the finite field that we can solve the ECDLP in a "regular" computer in trivial time. Is there any recent data about this?
2
votes
1answer
52 views

How does the order of Q affect the time it takes to solve ECDLP?

I use Sagemath's built-in function discrete_log() to solve ECDLP and according to the documentation it uses Pohling-Hellman algorithm to solve an ECDLP. This is ...
3
votes
0answers
60 views

Using (EC)DH to generate a signature

Say I have access to a system A that is limited to performing (EC)DH, followed by key derivation to produce a secret key. This secret key is later used to provide integrity protection. There is a ...
0
votes
0answers
6 views

Have someone replaced Curve25519 in NaCL library? [migrated]

I am using NaCL library and I like it but I wonder if it is possible to replace Curve25519 with different stronger Curve if stronger encryption is needed. I do understand that new library would be ...
0
votes
1answer
50 views

How to represent the point-at-infinity(Elliptic Curves) in code? [duplicate]

I am writing code for Elliptic Curve Cryptography. I have a class class EllipticCurvePoint. ...
2
votes
2answers
69 views

Is there a key exchange protocol that requires only one message?

Say I want to exchange a secret with someone, but I only get to send one message to the other person, and then we encrypt with that secret. Diffie-Hellman and ECDH require multiple messages to be sent ...
2
votes
0answers
46 views

What are some use cases for white-box digital signatures?

There were 2 papers published in the last year, that describe 2 different white-box identity-based digital signature schemes: White-Box Implementation of the Identity-Based Signature Scheme in the ...
0
votes
0answers
60 views

Is it possible to distinguish ECC private key from the random values

I have a list of the random values (each 65 bytes long). One of the items is a private key which is used to sign the data: ...
0
votes
0answers
37 views

EC threshold private key's multiplicative inverse and derived-key sharing

I have two devices, and each has a private key xPriv-i. Each device computes the corresponding EC public key xPub-i, shares it, and the linear combination of the keys is the "real" public key xPub. ...
3
votes
0answers
95 views

ECDSA signature verification checks

From Wikipedia: Check that $Q_a$ is not equal to the identity element $O$, and its coordinates are otherwise valid. Check that $Q_a$ lies on the curve. Check that $n*Q_a = O$ Verify that $r$ and $s$ ...
0
votes
0answers
46 views

Difference in elliptic curve order and finite field size [duplicate]

Must the prime finite field, Fp, an elliptic curve is defined over always have a greater number of elements than the cardinality of an elliptic curve. For example, If I have ...
1
vote
0answers
47 views

How to know if a point on a discrete elliptic curve be represented uniquely using its y-coordinate?

Let's say we have a point on an elliptic curve $p=(x, y)$ which is not the point-at-infinity. Can there be some other point $\hat{p} = (\hat{x}, y)$ that is also on the curve and that has the same y-...
1
vote
1answer
42 views

Prevent a Man-In-The-Middle attack whilst transmitting a PSK for first time

I'm developing a network where two parties that want to join both compute ephemeral ECC keys for a key exchange, to create an encrypted connection. I plan to authenticate these keys by signing them ...
0
votes
1answer
84 views

Group in the context of elliptic curve crypto [duplicate]

I understand that the discrete log problem is defined as $G^y \bmod p = x$ Speaking generally, $G$ here is a generator for the group zp*, where $G$ is able to ...
5
votes
1answer
423 views

Can multiple public keys lead to the same shared secret in X25519?

I have no mathematical knowledge about this, but I just read in RFC 7748 the following: Designers using these curves should be aware that for each public key, there are several publicly ...
0
votes
0answers
31 views

ECC order and modulus in EC [duplicate]

This question came from security.stackexchange.com. I have an error in reasoning regarding to the calculations on elliptic curves. The basic group operations are all calculated mod p. Ok right. Then ...
1
vote
1answer
42 views

Ensure Data Integrity In An ECDH Key Excange

Been playing around with the inner workings of onion routing and I have a problem. If I wanted to send the 2nd node of a relay network an ephemeral ECC public key, it has to go through node 1, so that ...
0
votes
1answer
35 views

Computing inverse of BN256 G2 point in golang x/crypto/bn256 library

I'm trying to confirm a vulnerability in a signing scheme I'm helping with. To do this I need to simulate a rogue key attack on a BLS aggregate signature using the golang bn256 library https://godoc....
0
votes
1answer
49 views

ECDSA secp256k1 attacks

Are there any known and feasible ECDSA attacks on secp256k1 which can reduce the bit security of the algorithm? For example from 256 bits of security down to 192 bits?
1
vote
2answers
90 views

How does ECDSA signature verify work in EOS and ETH/BTC, compare to standard (on text book I mean)

I have been studing ECDSA signature/verify for a while. By my understanding: the standard ECDSA signature/verify process (which we find on text book) are like below: - A sender combines message and ...
0
votes
1answer
71 views

Why we cannot brute force Elliptic Curve private key? [duplicate]

I am learning ECC, I am confused a bit how it works for now. To my understanding, G is the starting point, k is how many times you apply the dot operation. And <...
0
votes
1answer
43 views

ECDSA public key point uniqueness [duplicate]

I'm new to ECDSA and there is something I still not sure about. If I have a classic Certificate Authority server that delivers PEM certificates containing public key with ECDSA, I can retrieve the ...
0
votes
1answer
129 views

Using ECDH for encryption and decryption [duplicate]

I'm playing with cryptography and its use with typescript on one side and PHP on the other side. Now I'm looking for routines that can encrypt and decrypt with ecdh's private and shared keys. Any ...
1
vote
1answer
50 views

Efficient calculation of point coordinates with elliptic curves over binary field

I'm trying to find an efficient algorithm to calculate the $y$ coordinate of a an elliptic curve point given its $x$ coordinate, for elliptic curves over fields of the form $2^m$ with polynomial ...
1
vote
1answer
88 views

Calculation of the order of the cosets used in defining the Tate Pairing

I'm working through Pairings for Beginners by Craig Costello, and am trying to understand the preamble to the Tate pairing. (See p. 70 ff., section 5.2 of of the PDF.). I'm having trouble following a ...
-1
votes
1answer
60 views

Points on elliptic curve [closed]

I am making a program using the library cryptopp using curve secp521, in which at the end of that program I get n*Point Because I am writing that program I know that what is the value of 'n'. So, I ...
1
vote
1answer
69 views

What is the possibility of collision of trailing 160 bits of Keccak_256, for any two differing public-keys as pre-images?

Earlier today I was answering a question on the ethereum SE site that analyzed the potential for more than one private key on curve secp256k1 (which maps to a distinct public key) to control the same ...
0
votes
1answer
82 views

RSA vs Elliptic Curves

I am currently reading about how more efficient and ''light'' is ECC compairing to RSA as far as key generation is concerned. My question is simple, why does RSA continue to be used today (ex.SSL) ...
4
votes
1answer
131 views

Hash multiset to point on elliptic curve where $A = 0$

I want to hash a multiset to a point on the elliptic curve $y^2 = x^3 + 3$ over a finite field of some 254-bit prime order, where $P = 3 \pmod 4$. Moreover, I want this hash to be incremental, in that ...
2
votes
1answer
91 views

Elliptic Curve Discrete Log in a Composite Ring

Elliptic curves are usually defined over prime rings (fields), but what if we chose a ring of composite order? Let $n = pq$ for $p,q$ large primes. Say I have elliptic curve $y^2 = x^3 + ax + b$ over ...
0
votes
1answer
74 views

Learning elliptic curve cryptography for specific application

I would like to develop a protocol for specific purpose. This protocol will utilize asymmetric cryptography in which one private key can be paired with numerous public keys: messages encrypted with ...
4
votes
1answer
99 views

secp256k1 point density

I am working on a crypto project using the secp256k1 elliptic curve. I know that I can select a random point $P = (x, y)$ from the curve by randomly selecting the first coordinate $x \in \mathbb{Z}_p$...
0
votes
1answer
73 views

Elliptic curve with prime subgroup equal to field size

I am aware that when the equation $\#E(\mathbb{Z}_p) = p$ holds for prime $p$, the elliptic curve is called "anomalous" and is insecure do to "Smart's attack". Consider the similar case that $E(\...
1
vote
2answers
82 views

Using public-key signature instead of having API key

I am designing an application that will need an API key. At first I believed that generating a long, random token would be secure enough (say 32 chars string that includes 0-9, a-z and A-Z), and then ...
1
vote
2answers
72 views

“Dave Check” for a tweakable P-256 ECDH KDF

I have two devices with hardware tokens that contain P-256 private keys, and which allow me to compute ECDH shared secrets with arbitrary public keys. I need to build a tweakable key derivation ...