Questions tagged [elliptic-curves]
Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.
1
vote
1answer
10 views
Cost model for different curve models
Is there a cost model for each curve model and their conversions?
For example:
Take the curve models: Projective, Completed, Extended, Affine.
Is there a table which shows how many multiplications, ...
2
votes
0answers
35 views
How does post quantum key exchange in OpenSSH 8 work?
OpenSSH 8 supports a post quantum KEX, namely sntrup4591761x25519-sha512@tinyssh.org
It says in its description that it is basically NTRU + ECC X25519. However, I have tried but cannot understand how ...
0
votes
0answers
25 views
How to exchange a common key to a group of person using Elliptic-curve Diffie–Hellman (ECDH)? [duplicate]
In ECDH, when two persons want to share private keys, they first select a point $G$ on the elliptic curve and after that, each of them picks a random integer $a$ and $b$, respectively, and multiply ...
-1
votes
2answers
46 views
How to find at least one private key from a large list of compressed public keys secp256k1
Not long ago I saw a discussion on the Bitcoin Talk forum:
https://bitcointalk.org/index.php?topic=5060735.msg50736695#msg50736695
Please give advice and working methods? Is it possible to find at ...
1
vote
1answer
42 views
Check if two ed25519 points are equivalent
How to check if two points are equivalent given their projective coordinates (XYTZ)?
For example if I do unproject() of a point to pass from XYTZ to XY coordinates and then I come back to XYTZ ...
0
votes
1answer
22 views
montgomery reduction multiplicative identity
How do you figure out the multiplicative and additive identity with respects to R?
I pick some R such that gcd(R, N) = 1 where N is the size of the group.
Given some field element x in the group, I ...
0
votes
1answer
41 views
Computing a sextic twist
Let $(x,y) \in E'_{\mathbb{F}_{p^2}}$ be a point of the sextic twist.
I am currently trying to compute:
$\psi : (x, y) \leftarrow (\mu^2x,\mu^3y)$ with $\mu \in \mathbb{F}_{p^{12}}$ the root of $(Y^...
3
votes
0answers
62 views
Doubt in computing $g^\frac{1}{\delta+x}$ where $x \in \mathbb{Z}$
I was going through Zero Knowledge Set Membership and came across the following:
Given $x \in \mathbb{Z}$ and $g$ is the generator of a multiplicative group $\mathbb{G}$ how do we compute $g^\frac{1}{...
0
votes
0answers
25 views
Regarding the isogeny path problem
Given two elliptic curves, it is hard to calculate an isogeny of large degree between them. Does this only apply to supersingular isogenies or to ordinary ones as well? Additionally, is the mapping ...
0
votes
0answers
47 views
Decrypting using ECC [closed]
Alice and Bob are again exchanging messages using ECC. I have all my curve parameters $A,B,p$ and $g$ as well as Alice's private key $k_a$ and Bob's private key $k_b$. I also have what i think is the ...
1
vote
1answer
30 views
ECDSA over $\mathbb{F}_{p^n}$ for $n>1$. How to calculate $r$ and $s$
I'm having some trouble understanding how to calculate $r$ and $s$ as specified in the wikipedia page for ECDSA (https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm)
We can see ...
1
vote
1answer
59 views
Simple math ECDSA example
I'm trying to setup an ECDSA math example using just integer math and multiply (no EC). The purpose is just to help people understand why this works with out the added complication of understanding ...
2
votes
0answers
23 views
Security strength of JPBC Type A curve compared to SecP curve
I recently encountered some problems when learning about the JPBC library.
Does the curve generated by (J)PBC using the method typeAcurvegenerator(160,512) and the ...
2
votes
1answer
46 views
Share secret non-interactively in a verifiable way
In an application, I need to share a secret (random number) with a Group of known receivers over a public channel (a Blockchain) but each receiver needs to be able to check that the others received ...
1
vote
0answers
86 views
How do pairings behave on G2/twist points off the prime order subgroup?
$\newcommand{\F}{\mathbb{F}}$
Consider the ate pairing defined on a curve $G_1 = E(\F_q)$ and $G_2 = E'(\F_{q^r})$ where $E'$ is a twist of $E$ with the twisting isomorphism defined over $\F_{q^r}$. ...
-1
votes
0answers
35 views
What are the properties of Elliptical Curve Groups? [duplicate]
What is the difference between the $Z^{*}_{p}$ group and the elliptical curve group?
1
vote
1answer
75 views
Converting EdDSA Keys to EC-KCDSA keys
I'm trying to create BIP32 like key derivation for EKCDSA by riding over a BIP32-EdDSA derivation
Can anyone tell me if there is a glaring problem with my conversion technique?
...
0
votes
1answer
35 views
Question on using endomorphism on secp256k1 and negative results
I have read section 3.5 (algorithm 3.7) in "Guide to Elliptic Curve Cryptography", and have been trying to implement endomorphism on secpt256k1 to speed up calculating $kP$ by changing it into 2 point ...
2
votes
1answer
34 views
Lenstra's ECM Algorithm - field requirement
In Lenstra's ECM algorithm, $\#E(\mathbb{F}_{p})$ is required to have small prime factors. Why is this so?
I understand that the p-1 method is efficient for factoring N with small factors. The ECM ...
1
vote
1answer
54 views
Generating a random point on an elliptic curve over a finite field
I have coded an implementation of elliptic curves in order to apply some of the ECC algorithms. However, in most of them, Alice needs to choose a point P on a given curve. What is the general ...
2
votes
1answer
141 views
Can you tell me why doing scalar multiplication of a point on a Elliptic curve over a finite field gets to a point at infinity?
I am reading Programming Bitcoin. The author said:
Another property of scalar multiplication is that at a certain multiple, we get to the point at infinity (remember, the point at infinity is the ...
1
vote
1answer
109 views
Why is encryption slower than decryption in elliptic curve cryptography (ECC)?
While performing encryption using public key and decryption using the private key, I am always finding that encryption takes more time than decryption in elliptic curve cryptography (ECC). It's the ...
0
votes
1answer
38 views
Book request about elliptic curves, RSA and DSA
I understand that this question can be hardly downvoted, but so be it if someone gives me really useful references :)
I wanna learn difference (deeply) between RSA, DSA, and ECC, especially I am ...
-1
votes
1answer
76 views
What are the inverse operations in elliptic curve cryptography?
Public-private key cryptography is based on inverse operations that use separate input. In elliptic curve cryptography, what are those inverse operations?
0
votes
0answers
34 views
Explanation of Gallant-Lambert-Vanstone method / Endomorphism speedups [duplicate]
Can someone explain how the Gallant-Lambert-Vanstone method works (or which literature explains it)?
It is also unclear to me how the Frobenius endomorphism can be used in some cases for a speedup.
...
0
votes
0answers
5 views
Load key “ec256.pem”: invalid format is thrown on trying to generate public key from private key [migrated]
I am trying to generate public/private key pair using ECDSA curve secp256k1
On generating public key from ec256.pem (private key) the following error is thrown
"Load key "ec256.pem": invalid format"
...
-1
votes
0answers
35 views
Speed of Elliptic Curve multiplication
Say we have an elliptic curve, as I am studying around bitcoin we will say it is their standard secp256k1, with our generator point $P$, and I want to calculate $Q=kP$.
Using the double-and-add ...
1
vote
1answer
67 views
Are there shortcuts for computing ECC Point multiplication?
I'm trying to learn about elliptic curve cryptography.
Let's say you have point $P$ and 256 bit number $n$ and you want to compute $nP$. It sounds like computing additions one at a time is not ...
0
votes
1answer
32 views
How to multiply two Public Keys in Elliptic Curve in Go
I am working on a messaging client similar to Signal. I am stuck on
implementing Tripartite Diffie-Hellman handshake in which three DH exchanges are combined to authenticate both parties and produce ...
3
votes
2answers
149 views
Does secp256k1 have any known weaknesses?
I am wondering whether there are any properties of the curve which would technically make it easier to attack than any other curves of 256 bits in size.
I have heard that being a Koblitz curve, it ...
0
votes
1answer
39 views
Why public key has two parts in my secure messaging client similar to signal
I am working on a Golang code similar to Signal protocol. I need to modify it. I am confused on tripartite Diffie-Hellman handshake part of code, i.e. why public key has two separate parts as compared ...
2
votes
1answer
62 views
ECDSA signing process
I am trying to learn how ECDSA works. I do not have a background in maths, but have been following a guide which has built me up from finite fields, elliptic curves.
I am unable to figure out how a ...
0
votes
1answer
47 views
Why is it better to add and double points on an elliptic curve using projective space?
I have been given a textbook which defines the addition of two points on an elliptic curve and the doubling of a point on an elliptic curve. This textbook explains elliptic curves in projective space ...
0
votes
1answer
67 views
Convert affine to projective coordinates and vice versa in ECC?
I am working on a small project. An elliptic curve equation with y^2=x^3-3x+27 mod 43, a point $Q=(1,38)$, using point doubling method https://en.wikipedia.org/wiki/Elliptic_curve_point_multiplication#...
3
votes
1answer
205 views
Curve25519 over Ed25519 for key exchange? Why?
I've been reading up on the Signal Protocol (in this PDF) and it seems to be using Curve25519 for ECDH and EdDSA (with Ed25519) for signatures.
My question is why not use only Ed25519?
This ...
0
votes
2answers
81 views
How is EC key encoded in PKCS#8?
I just started working with certificates and signatures. For an application I write I need a key pair for ECDSA signatures, using the elliptic curve secp384r1 (aka NIST P-384).
I produced such a key ...
3
votes
1answer
67 views
How can I exploit the structure of the secp256k1 prime for fast arithmetic?
I'm implementing logic on an FPGA (programmable chip) that does the key verification part of ECDSA on the curve secpk256k1, in which all operations are mod p where $p = 2^{256} - 2^{32} - 2^9 - 2^8 - ...
4
votes
1answer
66 views
Curve25519's Y coordinate of Basepoint origin
The paper High-speed high-security signatures by Bernstein et al. introduces the Edwards curve Ed25519.
Concerning the base point $B$, it says that
$B$ is the unique point $(x,4/5)∈E$ for which $x$...
0
votes
0answers
44 views
Isogeny of elliptic curve
If we have two elliptic curves $E$ and $E'$ and the points of both elliptic curves are same. Then all the points of $E$ map to all the points of another elliptic curve $E'$.
For example $E$ has ...
0
votes
0answers
24 views
How does the order of a group, it's torsion subgroup and the co-factor link?
Given an elliptic curve that defines some group of non-prime order, with co-factor h.
Would it then have a h-torsion subgroup?
What are the implications for ECC ...
0
votes
0answers
51 views
Deterministic generation of RSA keys for IPFS / OrbitDB [duplicate]
I am in the process of working on a decentralized application using IPFS and OrbitDB. IPFS uses 2048 bit RSA keys for the Node runtime peer-id and secp256k1 for read/write access in OrbitDB. For ...
5
votes
2answers
284 views
Difference on montgomery curve equation between EFD and RFC7748
There is a subtle difference between the 2 implementations for a Montgomery curve defined from the 2 following links
https://hyperelliptic.org/EFD/g1p/auto-montgom-xz.html
A = X2+Z2
AA = ...
-1
votes
1answer
130 views
Can Shamir’s Trick crack the cryptographic strength of ECDSA?
Recently stumbled upon a discussion in the forum "MyMathForum"
What is Shamir’s Trick used for?
Are there any such examples?
0
votes
2answers
43 views
Elliptic curves - operations in larger groups - performance
According to my measurements and to this work, it seems that operations, for example scalar multiplication, are more expensive in larger groups. If I have, for example, an 80-bit elliptic curve and an ...
0
votes
2answers
77 views
Why doesn't the formula work when checking two ECDSA signatures?
There are two generated ECDSA signatures
X - Private key
S = ((Z + (X * R)) / K) mod n
S` = ((Z` + (X * R`)) / K`) mod n
G - Base point, of order n;
...
3
votes
2answers
112 views
Which hash is used when providing signature algorithm ED25519 or ED448?
From TLS 1.3 there are two signature algorithms using edDSA:
/* EdDSA algorithms */
ed25519(0x0807),
ed448(0x0808),
All the other signature-...
1
vote
0answers
59 views
ECDSA - why is the first part of the signature used in the second?
Using the terminology of https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm
Why is the second part of the ECDSA signature defined as:
$s = k^{-1}(z+rd_A)\text{ mod n}$
...
1
vote
0answers
31 views
Why doesn't the JOSE suite/JWA include ECIES?
The JOSE suite specifics use of RSA-OAEP (for when one party has an RSA key) and ECDH (for when two parties have EC keys) in JWA.
Why doesn't it include ECIES? It seems like a way to derive a key ...
2
votes
2answers
59 views
ECC How do the Curve, its number of bits of security and key size affect the maximum size of ciphertext?
First of all, excuse me if this question is too noobish.
I'm trying to understand how these things are relate: Curve type, its 'number of bits of security', size of the key and the maximum ciphertext ...
2
votes
1answer
67 views
Secure multi-party computation for digital signature
Is there any practical algorithm that will allow to use public key cryptography (RSA or ECC) in the following way
There are N parties. Up to M are malicious adversaries (were trusted, but got taken ...
