# Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

2,096 questions
Filter by
Sorted by
Tagged with
44 views

### Same message different nonce but similarities in r value of the signatures(r,s)

I'm studying a case where when i sign a same message with the same private key and a different nonce, i sometimes get signatures (r,s) where r values share some similarities (same numbers at the same ...
1 vote
193 views

### PAGE 2: Can I move elements from cyclic subgroup to its cyclic parent group?

We will continue our previous topic here⬇️ for clarity... The following context is based on elliptic curves in short-weierstrass form y^2 = x^3 + b. pls read carefully- I am looking for a function/...
1 vote
171 views

### Can I move elements from cyclic subgroup to its cyclic parent group?

The following context is based on elliptic curves in short-weierstrass form y^2 = x^3 + b. I know that elements of a non-prime order cyclic group G can be moved to its subgroup H by a process called &...
1 vote
66 views

### Zero Knowledge Argument for Elliptic Curve Multiplication/Inverse Multiplication Correctness?

I was reading this post and the accepted answer wrote about a way to “prove that some list of points $[A,B,C,...]$ when multiplied by $x$ produces $[A′,B′,C′,...]$”. However, in their explanation ...
163 views

### Who originally generated the elliptic curve now known as P256/secp256r1

Background: there is a theory going around that claims that P256 was backdoored by the NSA. The theory goes is that the NSA found a weakness that applies to a nontrivial fraction of elliptic curves (...
56 views

### Does BearSSL Library Support ECC Encryption/Decryption Functionality?

I'm researching cryptographic libraries for a project I'm working on, and I'm particularly interested in the BearSSL Library due to its lightweight nature. But I'm not sure if it supports ECC (...
55 views

### Formula for deriving the x-coordinate using the y-coordinate (decompressing a compress public key)

According to my understanding a public key is made up of x and y coordinate and a compress public key is made up of the y-coordinate since it's possible to directly calculate the uncompress public key ...
491 views

### Why do Ed25519 use Twisted Edwards curve but not regular Edwards curve

I'm trying to understand benefits of using Twisted Edwards curve over regular Edwards curve. I'm aware of some properties of Twisted Edwards curve that regular Edwards curve missing like isomorphism ...
15 views

### Use secp384r1 PEM key to sign a Verifiable Credential with Linked Data proofs

Ok, let me preface this by clarifying that I am not a cryptographer by trade, but I've been using cryptographic suites in the context of signing w3c Verifiable Credentials, and I am not sure if this ...
1 vote
117 views

...
106 views

### Statistics-heavy crypto papers

I'm currently taking a course in which we choose a stats-heavy paper and analyse it, summarising our work in the form of a written report and presentation. I have tried to find such a paper in crypto, ...
1 vote
19 views

### Does exist an Elliptic analogue of Benaloh encryption scheme?

The definition of Benaloh encryption scheme can be found here. Does exist an elliptic analogue of this scheme? I want to use this scheme but the length of the key ...
45 views

### Reflecting a point on the Edwards curve

Let's say we have a point $nP = (x,y)$ on a curve $E$ over a prime $p$. The corresponding Edwards curve coordinates are $(u,v)$. I want to construct the point corresponding to $(u,-v)$ on the Edwards ...
1 vote
70 views

### Deriveing y-coordinate

Is there any formula for deriveing the y-coordinate using the x-coordinate and the slope in secp256k1 elliptic curve? Example $Calculate$ $the$ $slope$ ...
1 vote
85 views

### Why are my Curve25519 points so different than standard? [closed]

I'm trying to implement X25519 for a little game I'm working on. I knew nothing about this stuff a week ago so it's been a bit of a learning curve (that was really funny). Most of the resources I ...
53 views

### Determining the order of operations in elliptic curve cryptography: Point doubling vs point addition for obtaining x and y values of a public key

I have a question regarding the operations performed on an elliptic curve, specifically related to point doubling and point addition. I am trying to understand whether it is possible to determine the ...
1 vote
60 views

### In TLS 1.2 and TLS 1.3, does the EC curve used to generate the ephemeral keys be the same on both client and server sides?

In TLS 1.2 and TLS 1.3, does the EC curve used to generate the ephemeral keys at the client side, does it need to be the same as that on the and server sides? For example can I use secp521r1 at the ...
1 vote
50 views

### is it possible to calculate the difference between 2 public keys of secp256k1

I am inquiring about the feasibility of calculating the point difference between two distinct secp256k1 elliptic curve points. Given the nature of secp256k1, which is widely used in cryptographic ...
1 vote
26 views

### Disjunctive ZK Proof of knowledge of discrete log

I want to construct a non-interactive ZK proof that in a set of pairs of group (where the DDH-assumption holds true) elements: $(g_1, Y_1), (g_2, Y_2), ..., (g_n, Y_n)$ , the prover knows at least one ...
122 views

### Equality of ElGamal plaintext & Pedersen commitment message

Let's imagine two entities: Bob and Alice. Bob's public key is $B = bG$. Alice's public key is $A = aG$. Alice encrypts her number $n$ with Bob's public key so Bob could decrypt it ($n$ is small ...
42 views

### Practical deployments of ECC with cofactor of elliptic curves $4$ or $8$?

Are cofactor $4$ and $8$ ECC schemes widely used in practical deployments such as those in cryptocurrencies? Can you name some practical settings where there curves are used and cryptocurrencies where ...
1 vote
33 views

### How are elliptic curves designed for encryption purpose? [closed]

Why can't we use any random elliptic curve? What are the properties that need to be satisfied?
16 views

### How to get equation from given three points(with doubling) on twisted edwards curve over finite field?

I have given three points $P$, $Q$, $R$ on Twisted Edwards Curve over prime finite field $\mathbb{Z}_p$. $$ax^2 + by^2 = dx^2y^2 + 1$$ I know about given points that point $Q$ is doubling ...
533 views

### How brittle is the current public key encryption infrastructure

Edit: One half of the answer to this question also applies to a recently asked and now deleted question regarding the impact of an algorithm which breaks DLP over integers but has no impact on ...
83 views

### Elliptic curve signature scheme without a nonce

ECDSA and EdDSA both require the generation of a single-use value. Are there any elliptic curve signature schemes in existence which don't require nonce and maintain the usual security strength equal ...
1 vote
46 views

### Are (0,0) the coordinates of the "point at infinity"?

Christel Bach's elliptic curve calculator has the coordinates for the "point at infinity" be $(0,0)$. Is that just a stand-in?
17 views

### Fixed-base exponentation with preprocessing [duplicate]

Is anyone aware of an in-depth study of algorithms using preprocessing to compute fixed-base exponentiations? Assuming I am willing to do arbitrary computation in the preprocessing phase (but not ...
1 vote
38 views

### How to calculate ECDSA compressed public key in HEX? [closed]

I am given the ECDSA public key x and y coordinates below, calculate the compressed public key in HEX: PubKey.X : 61702053028733271054209908027052318932346644879827564097906752978487519734153 PubKey....
51 views

### Multiplicative inversion of a generated point?

Let's say I have a public generator $G$, an unknown, private $p$ and a public point $pG$ on an elliptic curve. Given $pG$ it's easy to construct $-pG$ by just taking the negative. But can you ...
28 views

### Transportation Key (KEK)

I was studying about how to transport keys from one HSM environment to another and it came to me that I would need some sort of transportation key so the HSM keys would be double encrypted. How would ...
24 views

### Is it wrong that in a JWK, if the "d" value is **omitted**, that JWK represents a private key?

This is not a programming question. This is to confirm whether a crypto documentation is incorrect. I am using Rust's p384 crate. I am creating a private key from a JWK string. In the source code, at ...
79 views

40 views

### Using plaintext + ciphertext combination as substitute for authentication/signature in elliptic curve cryptography

I'm working on a system where I need to sign some data using an ECC private key and share the data and signature over a BLE ADV packet. Since an ADV packet is limited in space, I can't use a full ...
1 vote
62 views

### Is it possible to get the negative point with −x in that version of the Pedersen hash over the BaybyJubJub curve?

The Pedersen hash is a low constraints friendly hash for Zk-Snarks. Unlike many algorithms, the Pedersen hash returns a point P = (x,y) on a curve as a hash. ...
1 vote
61 views

### Can anyone explain the algorithm that OpenSSL uses to add two points on an elliptic curve?

I am trying to understand how OpenSSL adds points on an elliptic curve. I have understood from here that ossl_ec_GFp_simple_add() is where the addition op works. Can anyone explain the algorithm used ...
102 views

### Given a safe elliptic curve with generator $g_1$. Is there a function $f:(g_1^a,g_1,a)\leftrightarrow g_2$? For random $g_3,g_4$ -> $a$ unknown

In use-case we have a (random) generator $g_1$ and perform operations $g_1^{a}$ for known $a$ inside a safe elliptic curve modulo $p$. Is there any function $f$ which gives us a new (most likely ...
45 views

### Create PKCS12 file from EC Private and Public key pair

I have a file with an EC Public Private Key Pair and curve parameters: ...
51 views

### Hybrid encryption parameters when using elliptic curve keys

I wrote a command line application for encrypting/decrypting files to your local machine. The idea is you have an asymmetric key pair where the private key is stored encrypted and the public key is ...
1 vote
149 views

### On the bit security of elliptic curves

My understanding is that an elliptic curve $E$ over a finite field $\mathbf{F}_q$ has a bit security of $\sqrt{q}$ assuming Pollard rho or Baby-step giant-step. In this thread, it is explained that ...
80 views

### Which encryption/decryption to use with ECC?

I'm using ECDH for generating shared key for STM32 MCU. Which encryption/decryption algorithm should I use? I looked at RSA and AES project samples provided by STM32 but where do I provide shared key ...
121 views

### Encryption within the groups of BLS12-381

I have been investigating libraries that implement operations and protocols involving BLS12-381 curves. I have noticed an absence of libraries that support encryption over (either of) the groups G1 ...
1 vote
201 views

### Pedersen Hash : when truncating the hash to keep only the X coordinate, is it possible to compute a collision when the Babyjubjub curve is used?

The Pedersen hash is a low constraints friendly hash for Zk-Snarks. Unlike many algorithms, the Pedersen hash returns a point P = (x,y) on a curve as a hash. ...
1 vote
61 views

### How to redistribute shares for Distributed Shamir Secret Sharing?

I'm working on a Distributed Key Generation protocol. The idea is similar to this. TLDR: Aggregated Shamir Secret Sharing, each participant acts as a dealer & distributed the secret shares of its ...
1 vote
1k views

### Is there a way to get time from signature? Or is it possible to ensure the message was signed at the time that it says it was signed?

Suppose my server receives a message, the public key, and the signature. The message contains a time stamp. Is there a way to get the time stamp from the signature to match it with the message time ...
1 vote
94 views

### modular reduction using solinas prime

I want to perform a modular reduction using Solinas prime value as q = 2^383-2^33+1. How can I efficiently compute it taking advantage of q being Solinas prime?
1 vote
60 views

### What is the reverse formula from Coords on E11 to Coords on E1 [closed]

U= 115792089237316195423570985008687907852598652813156864395638497411212089444244 a = 20412485227 E1 = EllipticCurve(GF(p), [0,1]) with order U E11 = EllipticCurve(GF(p), [0,1]) with order a ...
1 vote