Questions tagged [elliptic-curves]
Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.
1,606
questions
0
votes
1answer
32 views
Generate Keypair with PKCS11 on curve secp256r1 and sign with it
I'm trying to generate an EC-Keypair with PKCS11 on SoftHSM2 with "github.com/miekg/pkcs11"
I got curve-parameters from here:
https://github.com/ANSSI-FR/libecc/blob/master/src/curves/known/...
4
votes
3answers
50 views
Is it secure to compute the exponentiation and the LWE operation?
Suppose Alice and Bob have specified an elliptic curve, for example, secp256k1. Alice has a secret number $s$ (can be seen as secret key), Bob choose a point $g$ on the curve and send it to Alice. ...
0
votes
1answer
102 views
+50
Homomorphic mapping between elliptic curve point and Zq
I'm trying to figure out how to do a mapping between elliptic curve points and Zq without breaking homomorphic properties.
Sorry, I'll write the problem in multiplicative notation because it's easier.
...
1
vote
1answer
40 views
Is prime order group used in ECDSA unique?
In ECDSA, we use a prime order group $\langle G\rangle$ for cryptographical use. Assume $\#\langle G\rangle = p$. Is there another subgroup in the curve used for ECDSA whose order is also $p$?
0
votes
2answers
64 views
Wrong key length for EC public key
I have a problem with EC public key reading from smartcard using pkcs11 library.
With the secp256r1 EC algorithm, I always get 65 or 67-byte length public key with different smartcards. But with the ...
2
votes
3answers
62 views
Can schnorr-signatures be used to ensure public keys are of the correct form (namely $Y= x \cdot G$)?
Assume a Schnorr-signature scheme in an elliptic curve setting with a publicly known generator base point $G$ where the the discrete logarithm is hard. That is, given $x \cdot G$, it is hard to find $...
0
votes
0answers
21 views
elliptic curve scalar addition
say there is an homomorphic cryptosystem on elliptic which allows unlimited addition and only one multiplication.
So in order to same the mult operation for a later functionality, I need to add a ...
1
vote
0answers
47 views
Can the subgroup membership problem still be hard in known order subgroup?
For example: Given an elliptic curve $E$ over $\mathbb{Z}_q$, and $\#E(\mathbb{F}_q) = p^2$, where $p$ is a prime. Now given a subgroup $\langle G \rangle$ of $E$, and the order of the subgroup $\...
3
votes
2answers
246 views
Why isn't f(G) uniform in ECDSA?
In ECDSA, $f(G)=r$, where $r$ is the $x$-coordinate of group element $G$. My question is, how to prove this $f$ is not uniform? In other words, how to prove that, given a random element $G$ with ...
0
votes
0answers
30 views
How to generate a random point on an elliptic curve without knowing it's corresponding scalar private key
Given an elliptic curve with generator $G$, is it possible to generate a random point on the curve $Q = a \cdot G$ without knowing the secret value $a$ that generated it? Note that just using an $a$ ...
2
votes
0answers
27 views
what does small scalar multiplication in ECC means?
I came across this table a lot in many articles, but I didn't understand what's the difference between Scalar multiplication operation in a group based on ECC and a Small scalar point multiplication ...
2
votes
1answer
78 views
How do I multiply two points on an elliptic curve?
Tell me if there is a way to multiply two points on an elliptic curve?
For example, as in secp256k1
...
2
votes
1answer
42 views
In The Ristretto Group, do all points sampled with Elligator have the same order?
Assume the Hash-to-ristretto255 function Elligator as laid out here. Assume a random hash that is then mapped to a point in the <...
0
votes
1answer
34 views
the probability of sampling a group element that falls in the subgroup on elliptic curve
Given an elliptic curve $E$ on $Z_q$. There is a subgroup $<G>$ on $E$, and the order of $<G>$ is $p$, where $p$ is a prime. And the discrete log problem on $<G>$ is hard. Now we ...
-1
votes
1answer
73 views
How to find “k” in system of equations?
This is a $y^2=x^3+7$ elliptic curve points - $Q,G_1,G_2,G_3. k_1,k_2,k$? - secret exponents:
$k_1*G_1( x_1,y_1) = Q(X,Y)$
$k_2*G_2( x_2,y_2) = Q(X,Y)$
$k*G_3( x_3,y_3) = Q(X,Y)$
How to find a $k$?...
1
vote
1answer
71 views
Modified ECIES using EC point ADD with DH key
I have questions about ECIES.
ECIES
Vanillia ECIES
Encryption side (Alice's side)
In "vanilla" ECIES when Alice wants to send Bob an encrypted message:
Alice uses some Elliptic Curve, e.g. <...
1
vote
0answers
21 views
what is the probability for an adversary to find the new key after adding new entropy in a group where computational diffie hellman is hard?
Let's say I have an Elliptic curve group $E(\mathbb{F}_q)$ with base Point $G$ and large prime order $n$. Computational Diffie-Hellman is assumed to be hard in that group.
$H: \{0,1\}^*\rightarrow \{...
1
vote
0answers
25 views
Signature algorithm for constrained environment, curve25512 already present for ECDH
I'm working in a very constrained (in code size/memory) microcontroller environment where I'll need public key signature verification. The algorithm to be used can be chosen, and there's no ...
1
vote
0answers
31 views
How hard will it be to solve an equation in elliptic curve group/ cyclic group where Discrete Logarithm is hard?
Given an Elliptic curve group $E(\mathbb{F}_q)$ where the Discrete Logarithm Problem (DLP) is hard and a base point $G \in E(\mathbb{F}_q)$ with large prime order $n$, what will be the advantage of a ...
0
votes
1answer
51 views
Adding curve25519 to tinyec
I am testing a TLS server that uses x25519 for key exchange. I am relying on Scapy-ssl_tls for building the TLS connection. However, this tool uses tinyec as its crypto library, and tinyec does not ...
2
votes
1answer
53 views
Test vectors for Ed25519
My apologies if this is obvious, but the truth is that I am confused about this.
I am looking into RFC 8032 for test vectors for Ed25519, and I have some doubts concerning the information presented in ...
0
votes
0answers
22 views
Getting the EC curve of an EC public key in CNG [closed]
I have a Public key in CNG (BCRYPT_KEY_HANDLE), and I need to know the curve it uses. I tried BCryptGetProperty with BCRYPT_ALGORITHM_NAME parameter, but it only gives ECDH_P256 back, not the exact ...
0
votes
0answers
19 views
EC scheme for one-way encryption
Consider this scenario:
Alice and Bob need to share some secret messages. Alice is the sender and Bob is the receiver. This should be facilitated by Bob giving Alice a public key, such as in a ...
-2
votes
1answer
66 views
Seeking help to understand the arguments of Elliptic Curve Expression in SageMath [closed]
Good Day. I'm sorry for my sage code, without formulas, but I looking your help friend.
...
0
votes
0answers
16 views
Is it safe to use ECCSI-SAKKE as described on RFC6507-6508-6509?
In particular, is it safe to use them with the settings and the algorithms as they appear on the above RFCs?
I am confused in various ways … just an example.
In RFC6508 on page 3, the ‘E’ is defined ...
1
vote
0answers
43 views
Same Ed25519 key for signing and encryption? [duplicate]
I know this has been asked before, but it's still unclear whether this is an OK practice. The advice seems to never do this unless you have to, but I can think of some examples where this could be ...
2
votes
1answer
97 views
How is a generator found for a group, both in case of DH & ECDH?
First step in DH & ECDH is to choose a random prime $p$. Then you choose a generator $g$ for the group $\mathbb Z_p^*$. How do you find a generator? Likewise in ECDH, you would need to find a ...
1
vote
1answer
50 views
Is there any trapdoor that can solve elliptic curve subgroup membership problem?
Given an elliptic curve $E$ over a finite field q(q is a prime), and $<G>$, the cyclic subgroup of $E$, where G is the generator. Is there any trapdoor $T$, that given a random group element $P\...
0
votes
0answers
35 views
Deterministic generation of secure private keys from parent private key
is it possible to generate set of child private keys from one parent private key, generated by ECC for example, securely? So that new private key (and derive public key) could be used for encryption ...
1
vote
0answers
27 views
Schnorr Protocol Implementation - Sometimes Fails on Curve25519
I am implementing the Schnorr Protocol in python and am having reliability issues when using some curves. I am wondering if this is an issue with my logic, or some implementation issue. I am using ...
6
votes
1answer
209 views
Curve25519 Key Validation
According to the original paper of Bernstein, there is no key validation needed when using Curve25519 for Diffie-Hellman Key Exchange. However, where does this property come from?
Is there any proof ...
1
vote
0answers
66 views
Converting a point in a finite field to its real (x, y) coordinate [closed]
Let curve $A: y^2 = x^3 + 7$ and curve $B: y^2 \equiv x^3 + 7 \pmod{p}$
Curve $B$ is secp256k1, assume the usual parameters for that curve.
Let $k$ be any private key, and compute the corresponding ...
0
votes
1answer
30 views
Deterministic Key using a seed for ECNamedCurve
I am trying to generate deterministic keys using EC curve secp521r1 in java. I went through KDF but, couldn't find any references to use it with EC curves. I would appreciate if someone could point me ...
1
vote
1answer
66 views
Can ECDSA signature signing and verification process replaces password hashed based login system?
ECDSA or DSA in general was to sign a message or data using private key and verify it using public key, if the attacker/imposter doesn't have the private key then they couldn't sign the message ...
6
votes
3answers
122 views
Which Diffie-Hellman Groups does TLS 1.3 support? And should we use TLS 1.3 as a guide?
This is a two part question - and I'm asking as someone moving into a security role, who'll need to standardize practices going forward.
(1) I'm curious whether the following 10 different DH Groups ...
3
votes
1answer
59 views
Corner cases of addition on short Weierstrass elliptic curves
I am trying to implement arithmetic over points on a short Weierstrass elliptic curve and I have trouble with corner cases of the points addition operation. Let me specify the parameters of the curve ...
1
vote
2answers
70 views
Can $y^2=x^3-x+1$ elliptic curve with $GF(3^m)$ where $m=97$ be used for Diffie Hellman key exchange?
I am new to ECC. I have just read about the elliptic curve $y^2=x^3-x+1$. I am copying the exact line
The elliptic curve is super-singular $E:y^2=x^3-x+1$ in affine coordinates defined over a Galois ...
5
votes
2answers
269 views
Must a line hitting two points on the elliptic curve over a finite field hit another point by continuation?
The Arstechnica article title as "A (relatively easy to understand) primer on elliptic curve cryptography" claims this;
In fact, you can still play the billiards game on this curve and dot ...
0
votes
1answer
56 views
Calculating ECDSA m or k (k or d) when s1 = s2
I recently began to look into some information about obtaining the private key $k$ when two signatures have been produced using the same $m$ and $k$.
I've been using the well-publicised information ...
0
votes
1answer
77 views
Calculating the point on the curve during ECDSA signature verification
I'm confused as to how he got (62, 44) as an answer within this article: https://www.coindesk.com/math-behind-bitcoin
1
vote
1answer
87 views
Are different elliptic curves compatible?
Regarding SubtleCrypto and curves P-256, P-384 and P-521.
Can I mix two different curves for key derivation?
For example performing key derivation between P-256 and P-521.
EDIT:
Can I mix two ...
0
votes
1answer
80 views
CSIDH Squaring Fixing the Base Curve
Consider the following variants of the CSIDH squaring problem.
P1. Given $sE, E$ where $s$ is a random ideal class and $E$ is a random curve (reachable from initial $E_0$), find $s^2E$
P2. Given $sE_0$...
2
votes
1answer
91 views
Problem with the signature of message using ECDSA over GF(2^m)
I'm trying to set up an ECDSA with Elliptic Curves over $\operatorname{GF}(2^m)$ with an example of toy with the following values:
Using the Weierstrass equation on binary finite fields. $$E: y^2 + x*...
4
votes
2answers
114 views
Doubt on elliptic curve over a finite field and binary representation
I'm a programmer, i.e. agnostic to the mathemathics behind most of cryptographic scheme, but I'm trying to remediate. I'm writing this premise for any possible error or imprecision that I probably put ...
1
vote
1answer
88 views
Research Guidance on Elliptic Curve Cryptography [closed]
I am a freshman who want to research elliptic curve cryptography.
There are a few questions I have:
Firstly, I am not sure about how I should narrow down the topic. Where should I focus on? Can I ...
0
votes
0answers
29 views
Which signature is considered more secure and has less communication cost?
This article uses Elliptic Curve Cryptography, but when it comes to signing and verifying messages it is not using the ECDSA signature algorithm. In the article, they mentioned that the communication ...
1
vote
0answers
42 views
Is this good way of Elliptical curve point mapping
Mapping a bit string $L$ to elliptical curve point in say prime field $\mathbb Z_p$. A simple way would be to use an integer mapping function that maps $L$ to a number $\{1, q\}$ where $q$ is the ...
1
vote
0answers
46 views
How does one go about implementing a range proof?
I've attempted to find a solution to this problem, but for the life of me I am unable to. I am attempting to solve whether a point an elliptic curve of prime order is between 2 points, given a ...
0
votes
0answers
74 views
A card game (for mental poker or any other card game)
I thought of a way to produce trustless card game in a flexible way. One feature that I want is it should be flexible (It should work for any type of card game, though I indeed started it as a ...
0
votes
0answers
32 views
How to construct Hash function in python3? [duplicate]
In many cryptographic protocols design like this one, I have seen the statement 'Choose a Hash function for example:
\begin{align}
h&: \{0,1\}^*\times\mathbb G\to\mathbb Z_q^*\\
h_2&: \{0,1\}...
