Questions tagged [elliptic-curves]
Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also ...
2
votes
1answer
26 views
Why ECDSA has its form?
According to Wikipedia, if Alice wants to sign some message, she computes $s = k^{-1} (z + r d_A)$ then sends $(r, s)$ to Bob.
I don't understand why they use this particular formula $s = k^{-1} (z + ...
0
votes
0answers
22 views
How to name a signature algorithm that has no hashed component
I have an API-based service that digitally signs messages with RSA or ECDSA (system decides during runtime). The input is base64 encoded SHA-256 hash and the output is:
signature of this hash
...
2
votes
2answers
82 views
What risks are involved when choosing a curve for an implementation of ECC?
What risks are involved when specific curves are chosen for an ECC implementation?
How should I audit a system that uses ECC with regards to a specific curve?
Bonus: How can I (or a cryptographer) ...
6
votes
0answers
60 views
Why would the use of Curve25519 in Dragonfly leak information?
An answer explaining Dragonfly, a form of key exchange used in WPA3, has an interesting footnote:
One final note: reviewing the Firefly RFC, I see that it would (as written) leak some information ...
0
votes
1answer
30 views
ECDSA Signing and verifying signatures between Python and JS
I create a signature on js, here jsrsasign
Signatures are obtained in the format:
...
0
votes
1answer
36 views
Equivalent RSA modulus for NIST P-192 and P-521 elliptic curves [duplicate]
At www.keylength.com, I found the following table of ECC field size and the corresponding RSA modulus recommended by NIST.
ECC Modulus RSA Prime Size
160 1024
224 2048
...
10
votes
1answer
148 views
How does the process of creating a new secure Elliptic Curve look like?
I'm especially curious about the technique djb would have used to come up with his Curve 25519. Say I have already written down my goals, such as - Twist Secure, Speed, Side Channel resistance, etc. ...
2
votes
3answers
48 views
For elliptic-curve cryptography, does a 256-bit key imply that $x$ and $y$ are each 256-bits or 128-bits?
In the wikipedia article, the claim is made that "256-bit elliptic curve public key should provide comparable security to a 3072-bit RSA public key". Since, in ECC, the public-key consists of a point $...
0
votes
0answers
34 views
Algorithm to compute DLOG for elliptic curve $E(F_p)$ with order p
I was reading about elliptic curves in this pdf. Page 55 of the pdf states that if number of points on elliptic curve #$E(F_p) = p$, then there exists a p-adic logarithmic map that homomorphically ...
2
votes
0answers
45 views
What is frobenius map of an Elliptic Curve?
I was reading about elliptic curves from this PDF. Page 44 defines Frobenius map. It defines the frobenius map as $f(x,y) = (x^p, y^p) \bmod p$. Isn't it just an identity map? What's the use of this ...
0
votes
0answers
32 views
NIST ECC Curves without pairings
NIST FIPS.186-4 has standardized 5 ECC curves on field $\mathbb{F}_p$ (P-192, P-224, P-256, P-384, P-521) and 10 elliptic curves on binary fields. I need to use ECC curves without pairings for my ...
0
votes
1answer
58 views
How do you perform the invert operation of Pm = kP on elliptic curve?
I'm stuck on this, may be due to the fact I'm missing something.
If I'm right, in order to reduce a Message to a point on an elliptic curve the operation is:
$\text{MsgPoint} = \text{msg}\cdot P$ ...
1
vote
1answer
44 views
Problem on Elliptic Curve Point Doubling
Given an elliptical curve e.g. from “Understanding Cryptography” by Parr & Pelzl §9.2 Example 9.5:
$y^2 = x^3 + 2x + 2~~~~ mod~17$
And given a primitive $P = (5, 1)$, the book indicates:
We ...
0
votes
0answers
31 views
Using WebCrypto to generate ECDH key from PBKDF2 [migrated]
I want to take a secret and generate a ECDH public/private key from it.
In the browser, a usual way would be to use PBKDF2 (or other deterministic bytes) to generate an ECDH public/private key pair ...
5
votes
0answers
48 views
Parity of the order of a element
Given an element $g$ in a cyclic group $G$ of known order $m$ its easy to test if $m$ has even or odd order. In other words $\textrm{ord}(g) \pmod 2$ can be computed easily.
In some cases where the ...
0
votes
2answers
87 views
A private key with multiple public keys?
I'm trying to design a wallet, where any number of public keys can be handed out. Say Alice hands out the public keys to receive messages. She doesn't want others to be able to link all of the public ...
0
votes
1answer
59 views
Multiplication and squaring the binary polynomials
I have tried to calculate $trace$ of a coordinate $X$ of EC in binary representation. Before that I tried to pre-calculate traces of the various bits of $X$ using formula:
$$Tr(X) = Tr(\sum_{i = 0}^{...
2
votes
0answers
66 views
j-invariant of an elliptic curve
Given an elliptic curve $(E/\mathbb{K})$ where $char(\mathbb{K}) \ne 2,3$ defined by the Weierstrass equation $y^2=x^3+ax+b$. The $j$-invariant is $j=1728 \frac{4a^3}{4a^3+27b^2}$.
I want to ...
1
vote
2answers
38 views
Please explain parameters of RFC5639 Elliptic Curves including brainpoolP160r1
RFC 5639 brainpoolP160r1 has
p = E95E4A5F737059DC60DFC7AD95B3D8139515620F (Wolfram Alpha says prime)
A = 340E7BE2A280EB74E2BE61BADA745D97E8F7C300
B = 1E589A8595423412134FAA2DBDEC95C8D8675E58
x = ...
0
votes
0answers
44 views
Size of group for Elliptic curves vs RSA for equal security
For my research, I would like to compare the efficiency of a scheme when instantiated with Elliptic curves and RSA. So, I would like to know a "latest" comparison (as of 2018) on what group sizes of ...
0
votes
1answer
70 views
How to encrypt plain-text message using Diffie-Hellman algorithm
Let's say bob says Hi and Alice says Hello, With the knowledge of n and ...
1
vote
1answer
36 views
How to calculate end point from private key in elliptic curve cryptography
The drawing of lines on the elliptic curve is repeated n times, where n is your private key, resulting in a point Ω. When calculating Ω, is there a short cut function that lets you skip having to ...
5
votes
1answer
85 views
Intersection of two elliptic curves
Is it possible to find points that are on two elliptic curves, and how?
More precisely, I'm looking for coordinates $(x,y)$ that satisfy the defining equations of two elliptic curves on prime fields $...
-2
votes
0answers
62 views
i can know if any unknown ECDSA point is (odd or even) !! , But
This video show how i can know if the point is odd or even,
https://www.youtube.com/watch?v=iux7to1iNlw
I use same bitcoin curve, but i changed the n mod number,
This is my C# code,
...
1
vote
0answers
35 views
Can I use NaCl's scalar multiplication functions for Diffie Hellman Key Agreement?
I want to create some software that performs diffie hellman group key agreement but I don't want to reinvent the wheel even if I know how it's done. So I came accross the NaCl library, especially the <...
3
votes
3answers
80 views
Choosing asymmetric pairing for Elliptic Curves
I'm trying to implement a Provable Data Posession protocol using elliptic curves, but am stuck at the $\text{KeyGen}$ phase of choosing a subgroup $G_2$. Here's an excerpt of it.
On input $\mathcal{...
1
vote
1answer
42 views
Need help understanding public key format of Barreto-Naehrig signature
I have a 256bit signature and a certificate with a public key to verify it. I had little information about the signature scheme used, but I know now that it's "ECBNwithSHA256". I have never come ...
1
vote
1answer
44 views
Authentication protocol for communication with Arduino Uno
I am using an ECDH key exchange to establish a shared secret between an Arduino Uno and an Android device. For this purpose I am using this library and more specifically Curve25519. This is the ...
5
votes
1answer
120 views
Is ECDSA obsolete/deprecated?
I have been reading about recommendations on the correct use of crypto as a developer and I read at least two references to the obsolescence (so to say) of ECDSA.
https://paragonie.com/blog/2015/08/...
6
votes
2answers
229 views
Curve 25519 (X25519, Ed25519) Convert coordinates between Montgomery curve and twisted Edwards curve
I have some misunderstanding about EdDSA conversion coordinates between Montgomery curve and twisted Edwards curve. In https://tools.ietf.org/html/rfc7748 I see that a base point for Curve25519 is
...
2
votes
1answer
67 views
Decoding a message on elliptic curve
Let's say I have an elliptic curve $E$ $y^2=x^3 + 486662x^2 + x$ over a prime field $GF(2^{255} - 19)$. My algorithm for computing $E(m)$ is as follows:
I take the bits 1 through 32 of the message ...
1
vote
1answer
54 views
mapping point on elliptic curve
good evening guys, let us suppose that elliptic curve is given by the following equation
$y^2=x^3-x+1 \pmod {127}$
on the following table message $9$ is converted to the point on curve
if i ...
1
vote
0answers
60 views
Security of BLS under additional information on the secret key
Question A
Is the BLS signature scheme still secure if an adversary in addition to the public key $ pk = g_2 \, sk \in \mathbb{G}_2 $ also obtains additional information on the private key $ sk $, ...
0
votes
0answers
30 views
Sampling a random scalar and its multiplicative inverse in EC
I have a scheme where I need to select many non-zero scalars via random Oracle model, and their inverses. There is an effective algorithm to calculate the inverse (the group order is prime), but it ...
0
votes
0answers
55 views
Public-only KDF
I need a variant of KDF (key deviation function) capable of generating public keys only.
The use-case is the following: there's a master KDF, initialized by some secret data, which can generate ...
1
vote
0answers
44 views
HW wallet and multisignaters in ECC
I need to design a system where there is a secure device (a.k.a. HW wallet), with the following functionality:
Deterministic key generation for key parameters (speaking simply: key ID).
Never expose/...
1
vote
1answer
77 views
How Elliptic-Curve affects the Server Key Exchange parameters
In Finite Field DHE, the server sends the following parameters in the server key exchange message:
$p$: prime
$g$: group
$g^b$: the server's public DH key
In DHE_RSA (non anonymous DHE), the server ...
2
votes
1answer
52 views
Usefulness of OAEP with ECC
Does OAEP make sense for use in an ECC ElGamal cryptosystem? The way I see it, OAEP makes questionable sense even for RSA because even though it's a "all or nothing" transformation, many RSA ...
0
votes
1answer
31 views
Given paramaters of an Edward's curve and x, determine a y value if it exists
I'm making a demonstration cryptosystem using ECC ElGamal. I've currently got a working implementation of Edward's Curve operations and a basic ElGamal implementation (Encrypts only points on the ...
3
votes
1answer
89 views
How to securely map messages to points on an elliptic curve
I'm implementing a demonstration hybrid cryptosystem in Python (FinCrypt, I know the name is bad) and I'm migrating over from my Weierstrass curve implementation, which was based off of this, to one ...
-1
votes
1answer
57 views
How to use public/private keys in elliptic curve cryptography to encrypt/decrypt information
I'm reading a bit about elliptical curve cryptography. The basic idea is to define a dot-operator on the points of an elliptic curve. Given a starting point $P$, and applying this dot-operation $n$ ...
1
vote
0answers
51 views
Hashing into a supersingular elliptic curve
Is there any way to hash from a string
$\in \{0,1\}^{*}$ into a supersingular elliptic curve $E(F_p)$ such that the hash function behaves(provably) like a random oracle, and is efficient?
Using ...
2
votes
1answer
97 views
Restoring a point on an elliptic curve
I received a representation of a point on an elliptic curve $GF(2^m)$ (with curve coefficient A, B) in specific format and some description how to decode it but not all is clear to me. I would be ...
1
vote
2answers
89 views
How to calculate Trace function for a point on an elliptic curve
I encountered trouble with calculating Tr (trace function) for points on an elliptic curve in polynomial basis ( $GF(2^m), m = 431$). Maybe there are any assumptions that can simplify and allow ...
2
votes
1answer
51 views
Are the following asymmetric encryption schemes equivalent?
Consider the scenario where you want a machine to be able to send daily encrypted backups to a storage server.
You'd prefer to not use simply a symmetric key for encryption, because if the machine ...
0
votes
1answer
119 views
What math should I learn to get in depth with Elliptic Curve Cryptography research?
My background is computer scientist. I have done applied cryptography research for a while. Currently, I'm working on Elliptic curve cryptography.
To understand the idea and how to use Elliptic curve ...
0
votes
2answers
67 views
ecdsa where the group order is larger than the hash size?
According to wikipedia, when generating a signature for ECDSA, you do the following (among other things):
Calculate $e=HASH(m)$, where $HASH$ is a cryptographic hash function, such as SHA-2.
...
1
vote
0answers
31 views
How to prove two ECDSA public keys on two different curves are generated from the same private key [duplicate]
I wonder if I provide someone with two public keys from different elliptic curves, is there any way to prove that these two public keys are generated from the same private key without revealing the ...
1
vote
1answer
49 views
what is the order for the brainpool twisted curves?
Per What is the difference between regular and "twisted" ECC curves? I guess the brainpool twisted curves and the brainpool regular curves use the same point addition and point doubling ...
0
votes
2answers
63 views
Do I need to know the curve for ECIES decryption?
Let's assume that I have key pair generated using the following curves: brainpoolP256r1, brainpoolP320r1, brainpoolP384r1 or brainpoolP512r1.
Do I need information which curve was used to decrypt ...
