Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also ...
0
votes
1answer
41 views
Time complexity of Weil pairing
I ran and timed an implementation of the Weil pairing on three set of parameters. One with an order of 512 bits, one with 256 bits and the last with 161 bits.
I took the Miller's algorithm to compute ...
0
votes
0answers
28 views
ECDSA signature uniqueness
I've been trying to replicate an ECDSA signing process that a cryptosystem uses (EOS, in this case), and I've been having issues. Namely, testing my c++ code (which uses openSSL) and comparing the ...
0
votes
0answers
31 views
Can anyone explain the mathematics behind Elliptic curve Signature generation and verification(ECDSA)? [on hold]
I know that there are two components r and s in a signature but I am trying to understand what are these values in terms of elliptic curve co-ordinates, the curve equation and also modular arithmetic ...
1
vote
1answer
32 views
Eliptic curve verifiable secret sharing
I am implementing the following the algorithm instructions as shown in 1 (section IV, B).
When trying to verify the share given the commits, $a_jG$ verifier $i$ checks whether $f(i)G=\sum_{j=0}^{t} (...
1
vote
0answers
41 views
What should I change in my implementation to pass from a curve $y^2=x^3+1$ to $y^2=x^3+x$
I tried to change my implementation of pairing in curves $y^2 = x^3 + 1$ to use curves of the type $y^2 = x^3 + x$ but it didn't work.
I thought the only thing I had to change in my code was the ...
2
votes
0answers
31 views
Where to find parameters for particular supersingular curve
In the PBC (Pairing Based Crypto) library, the curve parameters of the type A pairings are constructed on the curve $y = x^3 + x$ of embedding degree $2$.
I implemented a code for curves $y^2 = x^3 + ...
3
votes
1answer
112 views
What form of ECC can we use to make sure our newly invented ECC based crypto-systems are quantum secure?
It seems a lot of crypto-systems that are based on elliptic curves are susceptible to quantum computing attacks.
Hence, what forms of ECC cryptosystems are quantum secure, and how can we prove that?
...
1
vote
1answer
73 views
Hashing based on the discrete logarithm problem
At a first look, one could use the elliptic curve discrete logarithm problem to grant for the onewayness of $H(x)=x*G$ (where $G$ is the generator point of the cyclic subgroup).
Additionally, $H(x)$ ...
2
votes
1answer
63 views
Questions about the Curve25519-donna implementation
I'm trying to understand the implementation of the following function:
Please note questions in comments.
...
1
vote
0answers
32 views
Known risks for publishing ECDSA public keys and signatures
For an implementation of ECDSA, I'm considering the risks of publishing public keys together with multiple signatures.
From what Google tells me, a common pitfall is the use of the same random value ...
0
votes
0answers
17 views
Python implementation of ECDSA public key encryption [closed]
I have an ECDSA private/public key pair saved as PEM files, generated using pyca/cryptography. I would like to do public key encryption using these keys. I have read that it should be possible using ...
0
votes
1answer
37 views
The equivalence of exponentiation and multiplication over elliptic curves
I am trying to convert $(g^a)^{i^2}\mod p$ to an equivalent Elliptic Curve expression.
Let's assume a base point $G$ over an appropriate ECC.
Will $(g^a)^{i^2}\mod p$ be equivalent to $G\cdot a\cdot i^...
2
votes
1answer
86 views
How to solve this ECDLP?
The Problem is as follows:
$E: y^2=x^3+17230x+22699 \pmod{23981} $
$p=23981$ is prime number
point $G$
$G$'s order $109$ : prime number
Alice creates a public key by ...
2
votes
0answers
50 views
Ed25519 key generation
the following rfc describes the key-pair generation mechanism for Ed25519; the first two steps are as follows:
Hash the 32-byte private key using SHA-512, storing the digest in
a 64-octet ...
0
votes
1answer
31 views
C# equivalent of openssl ecparam -name prime256v1 -genkey -noout -out [closed]
I am having some issues generating a proper private key,I need it to be an Elliptic Curve private key suitable for use with NIST P-256 which i than need to convert to Base64-encoded private key in ...
-1
votes
1answer
53 views
Is that right what I understand about MOV attack?
There is an elliptic curve. $y^2 = x^3 +ax+b \pmod p$ ($p$ is prime number)
To solve DLP, need to find $r$ from given points $G$, $rG$. ($G$'s order is $q$ and $q$ is prime number)
The MOV attack ...
1
vote
1answer
45 views
Computations in extended finite field p^2
I would like to construct a distortion map from a point $\in \mathbb{F}_p$ to $\mathbb{F}_{p^2}$.
If I have an elliptic curve $Y^2 = X^3 + 1$ over $\mathbb{F}_p$ and a distortion map $\phi(x,y) \...
1
vote
1answer
39 views
How to handle points in extended finite field
Following the response to my previous question, I would like to know if you could give me some information or give me a link on how to perform arithmetic operations once I changed a point from the ...
0
votes
0answers
46 views
Understanding creation of distortion map
I'm trying to implement a distortion map but I have a problem. I know the basics and I read some questions like this one and asked some questions here.
If I have an elliptic curve $E : y^2 = x^3 + 1$ ...
3
votes
1answer
115 views
How to find a primitive cube root of unity
I would like some help to understand how to compute a distortion map and the result of a pairing.
I know that with this equation :
$E : y^2 = x^3 + 1$ over some $\mathbb{F}_p$ we have a distortion ...
1
vote
1answer
60 views
Encrypt with elliptic curves [closed]
The last days I was looking for a way to encrypt using ECC, without having to make the program myself. I was sure that someone should have done it for everyone by now.
The best approach I had was ...
1
vote
1answer
52 views
I want forgery ECDSA when prime p is form of 2*n+1, n is order of Elliptic curve
I have parameters of an elliptic curve s.t $p=2n+1$ , when $n$ = order of elliptic curve over finite field of order prime p.
If I want to forge any message for such ECDSA, What can I do? Maybe the ...
2
votes
0answers
45 views
Fastest known Elliptic Curve Cryptography “solution” (coordinate systems (multiple?), algorithms, precomputed values etc)?
I am writing an Elliptic Curve Cryptography SDK in pure Swift, and currently I am only using Affine Point and simple Double-and-add. I am soon about to work on a faster solution.
I am asking for help ...
0
votes
0answers
45 views
Pairing in implementation of a simple digital signature
I'm trying to implement in python the 1st scheme from the paper "Efficient Identity Based Signature Schemes Based on Pairings" by Hess to learn elliptic curve cryptography. It's a simple digital ...
1
vote
1answer
45 views
What scalars produce the wrong values with X25519's montgomery ladder?
This question is a consequence of an older one about multiplying a twisted Etwards point in Montgomery space. Turns out that this is unsafe in some circumstances.
The following Montgomery ladder as ...
1
vote
0answers
115 views
ECDSA public key recovery is discovered by whom?
Im looking for the history of the method (ECDSA public key recovery from signature). Where is this implementation first appeared in (is it bitcoin?) and who discovered this method?
0
votes
0answers
34 views
Point multiplication over Fp
I have a decent grasp on how point multiplication works in the context of the regular elliptic curve, however once we limit to whole numbers over a finite field I get confused. How on the world do we ...
2
votes
1answer
86 views
Right way to hash elliptic curve points into finite field
I would like to know how I can implement several hash functions :
$H_1:\{0,1\}^* \rightarrow P $ with $P \in E(\mathbb{F}_q)$
and
$H_2:P \rightarrow \mathbb{Z_q}^*$
And others where the ...
1
vote
1answer
46 views
Can I use Pollard'-Rho even when the order is not a Prime?
I am now solving the ECDL problem.
I want to use [discrete_log_rho] in SageMath, but I can not use it because ORDER is not a prime number.
Can I change it to a decimal number close to ORDER at my ...
1
vote
1answer
38 views
Is it possible to derive the recipient's public key from libsodium's crypto_box?
Libsodium has "crypto_box_seal" which according to the documentation is used to "anonymously send messages to a recipient given its public key.", which hides the sender.
But Is it possible for Eve to ...
1
vote
1answer
75 views
How were the P-256 parameters chosen?
In NIST FIPS 186-4 (page 90), it is said that $c$ is the output of SHA-1 on a seed that was chosen randomly. Then the parameter $b$ of the EC is chosen, according to the formula: $$b^2 \times c \equiv ...
0
votes
1answer
43 views
Schnorr Pubkey Recovery
As per How does recovering the public key from an ECDSA signature work? , it's possible to recover public keys from ECDSA signatures.
Is this possible for EC-Schnorr signatures as well?
I'm looking ...
1
vote
0answers
70 views
ECC Curve25519: How to generate this kind of private key? / Strange key exchange mechanism
I'm currently reverse engineering a program that uses Curve25519 key exchange in network communication. I have only a basic understanding of ECC, so maybe this thing just seems strange to me.
The ...
2
votes
1answer
66 views
The compression of the eliptic curve point coordinates
Some time ago I faced the problem of the unexpected format compression of the points on elliptic curve. I used ECDH procedure with a third party service on the base of the $\mathbb({F}_{2^m})$ curve ...
0
votes
0answers
100 views
Signal double ratchet vs. future breaks in ECC?
I made a feature request on the Signal forum:
https://community.signalusers.org/t/3469
And now I have a cryptographic question about Signal's "double ratchet".
Assume the symmetric algorithm (...
0
votes
2answers
125 views
Using two elliptic curves to do a range proof
Suppose Alice holds a secret value $a$ to which she has publicly committed to using two elliptic curves of distinct order. The curves are $g$ and $g'$ of orders $q$ and $q'$ (with $q < q'$) and ...
4
votes
1answer
109 views
Generating new Koblitz curves
is there the way how to generate new Koblitz curves (over F2n and Fp as well)? I found that "The recommended parameters associated with a Koblitz curve were chosen by repeatedly selecting parameters ...
1
vote
0answers
91 views
Implementing key mapping across different elliptic curves
From this answer I understood how to prove key equivalence across two elliptic curves. Now, I'm trying to figure out some more practical aspects of implementing this. Before jumping into questions, ...
-1
votes
1answer
55 views
Secure communication channel recommendations
I'm working on a cryptography-related project, which uses ECC (elliptic curve cryptography). And one of the things that I need is a "secure" communication channel for two entities.
I need someone to ...
0
votes
1answer
41 views
Using Microsoft SIDH library for messages signing
SIDH library looks good but lacks documentation and samples.
The only signature-related code was found at http://github.com/yhyoo93/isogenysignature/blob/master/tests/kex_tests.c appeared not able to ...
1
vote
1answer
108 views
Zero-knowledge transfer of value protocol II
This is an improvement of the protocol described here. The protocol does not require trusted setup and is very efficient (much more efficient than anything else I could find). The protocol allows the ...
0
votes
1answer
52 views
Differences between ECIES and DHIES
I'm studying the Integrated Encryption Scheme and I did't understand which are the main differences between ECIES and DHIES. Can someone help me ?
Thank you in advance.
0
votes
0answers
55 views
NIST Elliptic Curve Algorithm
I am wondering which algorithms are used to compute ec_mult and ec_twin_mult in the following implementation guidance document.
...
-1
votes
1answer
80 views
ECDH over secp256k1 implementation
I'm using ECDH over secp256k1 in multiple languages, and I saw something a little weird in the rust library I use.
After the point multiplication it changes y to <...
3
votes
1answer
82 views
ECIES: ECDSA with Kmac and without MAC
I have couple of questions about ECIES. I understand how ECIES work and what I must do if I want to have ECIES with ECDSA for authentication (I understand that for full authentication I have to have ...
2
votes
2answers
133 views
ECIES with ECDSA
I understand how ECIES work. I have a structure of message
[alice`s ephemeral public key, MAC tag, ciphertext]
I do not understand what I shoud do if I want to ...
0
votes
0answers
27 views
Can I share a secret among more than two keys in ECC? [duplicate]
Sharing a secret in ECC is easy. Alice calculates $S = aB$ and Bob calculates $S=bA$. They will both arrive at the same secret because $aB=bA=abG$.
This does not seem to be easily generalizable to ...
7
votes
1answer
108 views
What does the special form of the base point of secp256k1 allow?
The popular ECC parameters secp256k1 are documented in SEC2 as using curve $y^2\equiv x^3+a\cdot x+b\pmod p$ with $a=0$, $b=7$, $p=2^{256}-2^{32}-\mathtt{3d1_h}$, base point $G$ with the apparently ...
1
vote
0answers
28 views
Problem with brainpool? [duplicate]
In the GnuPG 2.1 release notes, there is this phrase:
For many people the NIST and also the Brainpool curves have an doubtful origin
I've read elsewhere that people have doubts about the NIST ...
1
vote
1answer
203 views
Choice of ECC curve on USB token
I would like to get a USB token to secure my keys. My use case is protection of 3 GnuPG keys that I will be using 10 times per day at least. I plan to create a new key ring from scratch. Because ECC ...
