# Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

1,859 questions
Filter by
Sorted by
Tagged with
1 vote
50 views

### ECC Range proof

In ECC, the proof showing that given $G$, $x$ and $y$ is in the range $[-z,z]$ is known as the range proof. Related to: Proving that two points on elliptic curve are within range So, if: $$H=xG−yG$$ ...
1 vote
52 views

### How to expand elliptic curve public key from compressed form?

Following this page https://en.bitcoin.it/wiki/Secp256k1, secp256k1 curve's equation is $$y^2=x^3+7$$ Does this mean that I can substitute $G_x$ in the equation to get $G_y$? I think yes and that's ...
1 vote
84 views

1 vote
55 views

1 vote
73 views

### Test vectors (points) for Ed25519

I am trying to verify an Ed25519 implementation, but I can't find any test vectors for the curve points. All test vectors focus directly on signature constructions (EdDSA). I tried to use https://...
308 views

### Is it theoretically possible to delegate public key generation?

Imagine the following scenario: In a given cryptocurrency, privacy should be as high as possible. For this purpose, a new account with a new address is created for every incoming transaction (the ...
1 vote
28 views

### Developing a Simmetric Key Distribution protocol to use with rfc6238

I'm trying to develop a Key Distribution Protocol to share symmetric keys in RFC 6238 (OTP). I started with RFC 6063, but this protocol is developed over old and known insecure algorithms like PBKDF ...
3k views

### EC Public key encryption scheme where Alice does not know Bob's public key

I've found ECDH and ECIES, but those both require Alice to know Bob's public key and Bob to know Alice's public key in order to derive a shared secret. Now assume Bob knows Alice's public key $A$, but ...
1 vote
64 views

### Order of point on elliptic curve vs order of base field

I'm looking at the FIPS-186 standard. On page 88, it gives a table recommending the size of the base field for the elliptic curve versus the order $n$ of a point on the curve. The numbers don't seem ...
94 views

### Whats the reason for using elliptic curves of order |E| = fr

To be more precise, in the books I sometimes see that they just require you that the order of your elliptic curve is $|E| = fr$, where $f$ is some small integer with possible factors, but $r$ is a ...
130 views

### Generating and validating a signature with ED25519 expanded private key

I am building a encrypted messaging app over tor network and currently I'm struggling on using tor generated ed25519 private key to sign and verify any message. Below piece of code works with a 32 ...
1 vote
31 views

### Verifiable Base Point generation via NIST SP 800-186 method

I'm looking at D.3.2 Verifiably Random Base Points of NIST SP 800-186. Looks like step 5 is there to ensure that $hashlen > bitLen(q)+1$ and (potentially) discard big $e$, so $t$ is distributed ...
1 vote
88 views

### P256 seed problem

I'm reading up on elliptic curves and their history and it seems that people don't trust P256 seed which is defined in FIPS 186-3 on page 89 to be SEED = c49d3608 86e70493 6a6678e1 139d26b7 819f7e90 ...
1 vote
270 views

### What is the order of the generator point G=9 in curve25519?

In Curve25519 we typically have this generator point or base point: ...
322 views

### Can I generate two similar ECDSA public keys?

I am using a system that relies on base64 encoded ECDSA public keys. I have managed to brute-force a public key that when encoded starts with a word I like. Is it possible for me, given the private ...
70 views

### EC ElGamal multiplicatively Homomorphic

Can we make EC ElGamal have multiplicative homomorphic property?
46 views

### ECDSA adaptor signing and decryption

I am trying to understand this article. Can someone explain to me how the ECDSA adaptor signing is work? From the article: 1. ECDSA adaptor signing $$s' = (H(m) + R t p)r^{-1}$$ As I understand this ...
27 views

### EC cardinality $P^3+c$ with 3 gen $G$, $F = P\cdot G,H=P^2\cdot G$ and 2 random members $M_1+iG+jF+kH=M_2$. How long would it take to find $i,j,k$?

Given a EC with cardinality $C=P^3+c$ with $P$ a prime $P \approx \sqrt{C}$ and $c>0$. Out of a given generator $G$ we generate two additional generator $F,H$ with $$F = P \cdot G$$ H = P^2 \...
57 views

### Practical check the point is on the Curve [duplicate]

The curve I am using is secp256r1. Its formulae is $y^2 == x^3 + a\cdot x + b$ $a$ = 0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc (...
37 views

### Random Generation a Valid Scalar on the Chosen Curve

My implementation requires me to generate randomly a valid scalar on the curve. As far as I understand it is not a random number generation but more complicated thing. I have to generate such scalars ...
42 views

### Elliptic Curve Encryption [duplicate]

I know about ECDH when you need 2 pairs of public/private keys. But I wonder what is a simplest way to encrypt with just single public key? Should I select a second random pair of public/private keys ...
1 vote
53 views

### Embedding degree of curves of characteristic 2 and ECDLP transfer

It is known that we can transfer an ECDLP instance on a curve $E$ defined over $\mathbb{F}_p$ for prime $p$, to a discrete-log instance in $\mathbb{F}_{p^k}$ for some $k$. It is referred to as the ...
41 views

### EC NIST P-256 FIPS-186-4 B.5.1 Per-Message Secret Number Generation Using Extra Random Bits operation

I need to implement following operation: w = (z mod (n-1)) + 1 where z: 40-byte array n: the order n of base point defined for NIST P-256. I assume that resulted 'w' could be a point on the curve. Any ...
1 vote
85 views

### Invalid point attack yields wrong results for low order points

I've recently tried to replicate the results of the question Ruggero asked and which Samuel Neves answered here: Understanding Twist Security with respect to short Weierstrass curves In my attempt to ...
1 vote
Assume elliptic curve in Weierstrass form. $y^2 = x^3 + a x + b$ where $x,y,a,b \in F$ I noticed the point addition formula does not involve parameters $a,b$. Furthermore, one can always solve for \$a,...