Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

Filter by
Sorted by
Tagged with
0 votes
1 answer
34 views

How to use smt solvers in order to restrict the possible key search where a portion of the private key and a portion of the public key hash is known?

I’m in the following situation : I’ve a portion/first bytes of a private secp256k1 security key such as it would take minutes to fully recover it through Pollard’s Kangaroo if I had the public key. ...
user2284570's user avatar
2 votes
1 answer
715 views

When incrementing a private key by 1, by how much is the public key Incremented?

If you have a secp256k1 keypair and you increment the private key by 1, then a faster way to compute the new public key is to perform an addition on the previous public key. But by how much? Some ...
user2284570's user avatar
1 vote
1 answer
42 views

Need help with Cryptohack's ProSign 3 ECDSA problem

I'm trying to solve the CTF challenge called ProSign 3 at Cryptohack platform which involves exploiting an ECDSA signing service that allows us to sign a fixed message being padded with the time ... ...
YazeedAllabadi24's user avatar
0 votes
0 answers
28 views

I want to find the Zero Value Points on SECP256R1 curve... Is there an alternative to Chien's method of finding roots over large Finite Fields?

This PDF explains that on certain elliptic curves, there exists ZVP (Zero Value Points) that cause zero value registers during the scalar-to-point multiplication (i.e during the double operation or ...
Cyth's user avatar
  • 1
0 votes
1 answer
58 views

wrting algorithm for torsion group elements

Yesterday,I took an exam. There are two questions I received very low points. I will write the first question in this post. The question says let $E:y^2:x^3+kx+1$ in GF(p) be an elliptic curve where p ...
user avatar
0 votes
0 answers
3 views

Why I need to pass Secure Random when I am loading the key from PKCS8 format [migrated]

I am using Ring lib in Rust to generate ECDSA_P256 and I am passing SystemRandom, and I am getting PKCS8 key pair format. Until ...
Koptan's user avatar
  • 1
1 vote
0 answers
61 views

Curve448 ECC parameters for use with OpenSSL

I need to be able to deterministically generate (and re-generate) private-public ECC key pairs curve448 for ECDH from human-friendly passphrases (not necessarily human-memorable, just easy to type in),...
Logan R. Kearsley's user avatar
0 votes
1 answer
115 views

How to know if an ECC public key is y or -y

I'm a beginner still learning how ecc works... And i think I understand that in secp256k1 public keys there is something called addictive and negative inverse for example private key:- ...
Melwyn's user avatar
  • 1
1 vote
1 answer
42 views

Is there any reference about the half-trace when m is even in F(2^m)

There is a algorithm listed in D.1.6, Algorithm 3, it seems that it is used to solve the quadratic equation when $m$ is even in $F(2^m)$. However, I can not find any reference about this algorithm, as ...
Insecticide's user avatar
4 votes
1 answer
127 views

Changing ECDSA for Shorter Signatures: deterministic k

I am exploring a modification to ECDSA to produce shorter signatures, even though it compromises security (in a controllable way). My rationale behind this change is in this discussion. In my ...
Ehsan's user avatar
  • 51
3 votes
2 answers
470 views

Why is the bilinearity of an elliptic curve pairing shown as multiplicative rather than additive?

In vitalik's post here the below is mentioned, This is the pairing. Mathematicians also sometimes call it a bilinear map; the word “bilinear” here basically means that it satisfies the constraints: $...
Chirag Parmar's user avatar
0 votes
0 answers
35 views

Constraints needed to express a + b + c = d in zkp circuit

I am writing an ECC based zkp circuit and need to express the constraints: a + b + c = d a, b, c, d >= 0 a, b, c, d will be represented by points on the curve so addition can wrap around the ...
gws's user avatar
  • 101
1 vote
1 answer
87 views

Montgomery Curve Point Multiplication in Projective Coordinates

Is the result of 4G the same when calculated as 3G + 1G or 2G + 2G in projective coordinates? Considering a curve like (y^2 = x^3 + 10x^2 + x (mod 83)) with a Generator point G = (3, 28) in affine ...
Nawras Hussein's user avatar
-2 votes
0 answers
53 views

Understanding secp256k1 elliptic curve subtraction formula

Point doubling formula Calculate the slope $\lambda = (3\times Q_x^2) \times$ pow($2 \times Q_y$, -1, $p$) % $p$ Calculate the new point coordinates $R_x = (λ^2 - 2 \times Q_x)$ % $p$ $R_y = (\lambda \...
Favour's user avatar
  • 37
1 vote
0 answers
35 views

How to know the number of digits in the decimals place in elliptic curve division result?

$p$ - is the order of the finite field $n$ - is the order of the group. Private keys can range from $1$ (the generator point $G$) to $n - 1$. All the private keys ($Priv$) lie in certain ranges of 2. $...
Maltoon Yezi's user avatar
2 votes
1 answer
48 views

Is it possible to generate an elliptic curve (with the hard discrete logarithm problem) by iterating only a finite field, but not its $j$-invariant?

Let me ask one question. Maybe, you know an answer. Thanks in advance for any response. Let's fix an elliptic curve $E$ over the field $\mathbb{Q}$ of rationals without complex multiplication, i.e., ...
Dimitri Koshelev's user avatar
0 votes
1 answer
57 views

Base point in Montgomery curve

in the Montgomery Curve using Affine coordinates, we have points that lie on either the (0,0) coordinate or have a y-coordinate of 0. The question here is: Can we use these points as the Generator ...
Nawras Hussein's user avatar
0 votes
1 answer
82 views

Elliptic Curve Cryptography: Point Multiplication by 3 on secp256k1 Curve

Is there a direct non-iterative formula for point multiplication by 3 in the secp256k1 elliptic curve just like point multiplication by 2 (point doubling)? If such a formula exists, could you explain ...
Favour's user avatar
  • 37
0 votes
0 answers
24 views

EC Keypair Issue: Can't verify a signature with the correct public key [migrated]

I am a new dev dabbling in ECC. I am currently building an Android app in Java/Kotlin and can't get a piece of content that was signed with a private key to be verified using the corresponding public ...
Greg Simon's user avatar
2 votes
1 answer
82 views

Example of CM field discriminant of elliptic curves

From this answer I am able to understand that if CM field discriminant for a particular curve is small then it provide us a fast endomorphism which in turn allow rho method to speed up by $\sqrt{\frac{...
madhurkant's user avatar
3 votes
3 answers
871 views

Why is a modulus used in Elliptic Curve Cryptography?

In the eliptic curve cryptography, we use modulus $y^2 = (x^3 + ax + b) \ \ \text{mod} \ \ p$ So using modulus definitely changes the graph points completely - i.e gives a completely different graph ...
Giorgi Lagidze's user avatar
0 votes
0 answers
46 views

How to calculate Cardinality of an Elliptic curve over $\mathbb Z_{23}$

How to calculate Cardinality of an Elliptic curve over $\mathbb Z_{23}$. $E: y^2 = x^3 + x + 1$ defined over $\mathbb Z_{23}$.
Sanjai Kumar's user avatar
2 votes
1 answer
200 views

Can we use several times the same RSA and ECC keys?

For RSA or elliptic cryptography, can we use the same public/private keys for several exchanges, or is that unsafe? Does it lower the security of the protocol? To me it doesn't matter, as receiving ...
Wheatley's user avatar
  • 147
3 votes
0 answers
67 views

Is it fine to use ECDSA with edwards25519?

The elliptic.js library allows instantiating ECDSA with the edwards25519 curve. I've rarely seen this combination in the wild. ...
mti's user avatar
  • 655
1 vote
1 answer
70 views

Is injective encoding of a message important for Elliptic Curve ElGamal?

I'm trying to understand if using non-injective encodings for Elliptic Curve ElGamal encryption is dangerous. A standard probabilistic encoding defined by Koblitz for elliptic curves over $\mathbb{F}...
pintor's user avatar
  • 558
2 votes
1 answer
147 views

Generating pseudorandom numbers using Dual_EC_DRBG

I am currently learning about the Dual_EC_DRBG protocol and I am stuck at the calculation of the initial state with the point P. For context, I am using the secp256k1 curve with a = 0 and b = 7. I ...
Nosticlov's user avatar
0 votes
0 answers
29 views

P256 signature verification was succeed with 2 public key [duplicate]

I tried to recover public key from P256 signature. With 2 recovery id ( 0, 1 ), signature makes 2 public key. And I tried to verify signature with public key and verification was succeed all of 2 keys....
박해성's user avatar
2 votes
1 answer
107 views

Not understanding elliptic curve scalar multiplication to produce Ethereum address

This is the equation Public key = Private key * G Here, ...
Asif Iqbal's user avatar
1 vote
1 answer
142 views

How to calculate Legendre Symbol in secp256k1 Elliptic Curve

In this answer by fkraiem he proves a property that: $a^{(p-1)/2} = 1$ if and only if $x$ is even But this doesn't seem to work in my test with the secp256k1 Elliptic Curve. Here is my Python 2 ...
Devanshu Linux's user avatar
4 votes
1 answer
253 views

Distinguishing EC Public Key from random

I recently read the post Distinguishing x25519 public keys from random? and found myself wondering why, for a randomly chosen x, the result of the function $$x^3+ax^2+x$$ is a square in 50% of cases ...
Safari1811's user avatar
0 votes
1 answer
104 views

In multiplicative subgroup Fp* of an elliptic curve does multiplying an element make it leave the subgroup?

In the case of an Elliptic curve over a GF(p) which has order n and multiplicative group of n-1 elements, does multiplication of an element of a subgroup of order q where q is a divisor of n-1 with a ...
immigrantswede's user avatar
3 votes
1 answer
131 views

Standard Montgomery curves over prime field

Is there some source of standard, vetted, efficient Montgomery elliptic curves over prime field? I'm looking for curves $B\,y^2\equiv x^3+A\,x^2+x\pmod p$ engineered for efficient computation of ...
fgrieu's user avatar
  • 141k
0 votes
0 answers
47 views

Secure key exchange for custom USB device

I'm learning various cryptography protocols and use cases and since I'm developing a USB device and PC application, it would be nice to use encrypted communication. I studied TLS 1.2 key exchange but ...
unalignedmemoryaccess's user avatar
0 votes
0 answers
47 views

ECC, Montgomery Curve cofactor bigger than 1

I read that in elliptical curve cryptography, the order of the Montgomery Curve is a multiple of 8, this mean that we can't have cofactor one curves which can be problematic in some corner cases ...
Nawras Hussein's user avatar
3 votes
1 answer
104 views

BLS curve with a smaller modulus?

To achieve approximately 128 bits of security, curve BLS12-381 uses 381 bits to encode the X coordinate. This means the size of a group element needs at least 48B to store/transmit. I am in a ...
Chunchi Liu's user avatar
1 vote
0 answers
119 views

ECDSA: Can we use the private key for a different curve? [closed]

ECDSA can be instantiated with a variety of different elliptic curve groups. Two example curves are secp256k1 and edwards25519. ...
mti's user avatar
  • 655
0 votes
0 answers
65 views

ed25519: Scalar multiplication guaranteed to land in prime order subgroup?

ed25519 is defined over curve edwards25519 which has a large prime order subgroup and a small subgroup of order 8. During key generation, bit clamping is used to ...
mti's user avatar
  • 655
0 votes
1 answer
71 views

Threshold ed25519: How to export keys?

Consider ed25519 signing (RFC 8032). There, the private key is a 32-byte random value, and for signature generation, the 32-byte private key is first hashed and then the secret scalar and nonce are ...
mti's user avatar
  • 655
3 votes
1 answer
135 views

Problem with efficiency of projective coordinates in Elliptic Curve arithmetic

Ok sort of long post incoming. Will go slow to make it as clear as possible I'm trying to build a C library for Elliptic Curve Arithmetic. Since the idea is to learn from the process, I decided to ...
popeye's user avatar
  • 95
1 vote
1 answer
78 views

Convert XZ Montgomery Curve Points to Twisted Edwards Curve Points (Inversion-Free)

This question covers how to convert a projective point $(X_E, Y_E, Z_E)$ on a twisted Edwards curve to a projective point $(X_M, Y_M, Z_M)$ on a Montgomery Curve. Using XZ coordinates, there is no ...
rndm_me's user avatar
  • 76
1 vote
1 answer
169 views

Cheating in a Pedersen-based auction

Imagine a simple auction made with Pedersen commitments rather than sealed envelopes. Participant 1 commits their bid, $b_1$, choosing a blinding factor $x_1$ and using publicly known G and H ...
A. Darwin's user avatar
  • 486
3 votes
1 answer
128 views

EdDSA signing modification

I've got a question regarding the signing algorithm on elliptic curves (EdDSA). In ed25519 signature scheme there is no nonce $k$, instead every message has its own different hash. From what I know ...
ThomasJady's user avatar
3 votes
0 answers
116 views

How do you securely implement a finite field?

I'm not sure if this question belongs here or to StackOverflow. Please flag it if not. I'm trying to implement a standalone library for finite field arithmetic of prime and prime power order as a way ...
tur11ng's user avatar
  • 962
4 votes
1 answer
223 views

Split a private key into shares and sign successively or separately

Assume I have a private key, priv_k, a public key pub_key and a message, msg, along with its ...
Ryan's user avatar
  • 141
1 vote
1 answer
110 views

Why we need z-coordinate in Montgomery Curve?

In Montgomery Curve $By^2=x^3+Ax^2+x$, B $\neq$ 0, A $\neq$ +2 or -2. First case: If $x_{1}$=$x_{2}$ and $y_{1}$=$y_{2}$$\neq$0: then s=($3(x_{1})^2$+$2Ax_{1}$)/(2B$v_{1}$). If $x_{1}$$\neq$$x_{2}$: ...
Nawras Hussein's user avatar
3 votes
1 answer
635 views

Why is the constant in Montgomery Curve code 121665 instead of 486662 in the formula?

In the Montgomery Curve $y^2=x^3+486662x^2+x$, $A=486662$. So, why when applying its code in Python or another programming language, $A=121665$? ...
Nawras Hussein's user avatar
2 votes
1 answer
135 views

Loop back or cyclic nature of secp256k1 curve

I am working with point addition and scalar multiplication on the secp256k1 curve for points $(x,y)$ or public keys to derive the next public key scalar k times further from it. Actually when I use a ...
Aflatoon's user avatar
1 vote
1 answer
124 views

How can we derive G from P and N?

I would like to find the fastest way to derive G for secp256k1 and secq256k1 curves, does anyone know the method, equation? Edit: I'm interested to know how can this happen, when we use n/2 of ...
Aggregator's user avatar
1 vote
1 answer
78 views

Hashing to the target group of bilinear pairing

Assuming we have fixed pairing friendly elliptic curve groups $G_1$, $G_2$ and $G_T$ where for $a \in G_1$ and $b \in G_T$ it holds $e(a,b) \in G_T$. Let's put some more context and we are working in ...
curious's user avatar
  • 6,160
1 vote
1 answer
99 views

Mapping two different elliptic curve on same finite field

There exist two such question but I have noticed my question is fundamentally different as it asks for mapping between two different curves, rather two different prime field like this. Given a finite ...
madhurkant's user avatar

1
2 3 4 5
44