Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

Filter by
Sorted by
Tagged with
0 votes
0 answers
44 views

Same message different nonce but similarities in r value of the signatures(r,s)

I'm studying a case where when i sign a same message with the same private key and a different nonce, i sometimes get signatures (r,s) where r values share some similarities (same numbers at the same ...
PrinceZee's user avatar
  • 101
1 vote
2 answers
193 views

PAGE 2: Can I move elements from cyclic subgroup to its cyclic parent group?

We will continue our previous topic here⬇️ for clarity... The following context is based on elliptic curves in short-weierstrass form y^2 = x^3 + b. pls read carefully- I am looking for a function/...
Josh666's user avatar
  • 21
1 vote
1 answer
171 views

Can I move elements from cyclic subgroup to its cyclic parent group?

The following context is based on elliptic curves in short-weierstrass form y^2 = x^3 + b. I know that elements of a non-prime order cyclic group G can be moved to its subgroup H by a process called &...
Josh666's user avatar
  • 21
1 vote
2 answers
66 views

Zero Knowledge Argument for Elliptic Curve Multiplication/Inverse Multiplication Correctness?

I was reading this post and the accepted answer wrote about a way to “prove that some list of points $[A,B,C,...]$ when multiplied by $x$ produces $[A′,B′,C′,...]$”. However, in their explanation ...
Justice Almanzar's user avatar
6 votes
0 answers
163 views

Who originally generated the elliptic curve now known as P256/secp256r1

Background: there is a theory going around that claims that P256 was backdoored by the NSA. The theory goes is that the NSA found a weakness that applies to a nontrivial fraction of elliptic curves (...
poncho's user avatar
  • 143k
0 votes
1 answer
56 views

Does BearSSL Library Support ECC Encryption/Decryption Functionality?

I'm researching cryptographic libraries for a project I'm working on, and I'm particularly interested in the BearSSL Library due to its lightweight nature. But I'm not sure if it supports ECC (...
IKCekis's user avatar
0 votes
0 answers
55 views

Formula for deriving the x-coordinate using the y-coordinate (decompressing a compress public key)

According to my understanding a public key is made up of x and y coordinate and a compress public key is made up of the y-coordinate since it's possible to directly calculate the uncompress public key ...
Aviril Smith's user avatar
5 votes
1 answer
491 views

Why do Ed25519 use Twisted Edwards curve but not regular Edwards curve

I'm trying to understand benefits of using Twisted Edwards curve over regular Edwards curve. I'm aware of some properties of Twisted Edwards curve that regular Edwards curve missing like isomorphism ...
pacman's user avatar
  • 207
0 votes
0 answers
15 views

Use secp384r1 PEM key to sign a Verifiable Credential with Linked Data proofs

Ok, let me preface this by clarifying that I am not a cryptographer by trade, but I've been using cryptographic suites in the context of signing w3c Verifiable Credentials, and I am not sure if this ...
Moustachiste's user avatar
1 vote
1 answer
117 views

Deriving of the y-coordinate on secp256k1 elliptic curve

...
Aviril Smith's user avatar
2 votes
1 answer
106 views

Statistics-heavy crypto papers

I'm currently taking a course in which we choose a stats-heavy paper and analyse it, summarising our work in the form of a written report and presentation. I have tried to find such a paper in crypto, ...
smoking_huge_doinks's user avatar
1 vote
0 answers
19 views

Does exist an Elliptic analogue of Benaloh encryption scheme?

The definition of Benaloh encryption scheme can be found here. Does exist an elliptic analogue of this scheme? I want to use this scheme but the length of the key ...
Galois group's user avatar
2 votes
1 answer
45 views

Reflecting a point on the Edwards curve

Let's say we have a point $nP = (x,y)$ on a curve $E$ over a prime $p$. The corresponding Edwards curve coordinates are $(u,v)$. I want to construct the point corresponding to $(u,-v)$ on the Edwards ...
mtheorylord's user avatar
1 vote
2 answers
70 views

Deriveing y-coordinate

Is there any formula for deriveing the y-coordinate using the x-coordinate and the slope in secp256k1 elliptic curve? Example $Calculate$ $the$ $slope$ ...
Aviril Smith's user avatar
1 vote
0 answers
85 views

Why are my Curve25519 points so different than standard? [closed]

I'm trying to implement X25519 for a little game I'm working on. I knew nothing about this stuff a week ago so it's been a bit of a learning curve (that was really funny). Most of the resources I ...
Justice Almanzar's user avatar
0 votes
2 answers
53 views

Determining the order of operations in elliptic curve cryptography: Point doubling vs point addition for obtaining x and y values of a public key

I have a question regarding the operations performed on an elliptic curve, specifically related to point doubling and point addition. I am trying to understand whether it is possible to determine the ...
Aviril Smith's user avatar
1 vote
1 answer
60 views

In TLS 1.2 and TLS 1.3, does the EC curve used to generate the ephemeral keys be the same on both client and server sides?

In TLS 1.2 and TLS 1.3, does the EC curve used to generate the ephemeral keys at the client side, does it need to be the same as that on the and server sides? For example can I use secp521r1 at the ...
warren's user avatar
  • 33
1 vote
1 answer
50 views

is it possible to calculate the difference between 2 public keys of secp256k1

I am inquiring about the feasibility of calculating the point difference between two distinct secp256k1 elliptic curve points. Given the nature of secp256k1, which is widely used in cryptographic ...
Melwyn's user avatar
  • 11
1 vote
0 answers
26 views

Disjunctive ZK Proof of knowledge of discrete log

I want to construct a non-interactive ZK proof that in a set of pairs of group (where the DDH-assumption holds true) elements: $(g_1, Y_1), (g_2, Y_2), ..., (g_n, Y_n)$ , the prover knows at least one ...
drydrydesert's user avatar
2 votes
0 answers
122 views

Equality of ElGamal plaintext & Pedersen commitment message

Let's imagine two entities: Bob and Alice. Bob's public key is $B = bG$. Alice's public key is $A = aG$. Alice encrypts her number $n$ with Bob's public key so Bob could decrypt it ($n$ is small ...
Seed Barret's user avatar
0 votes
0 answers
42 views

Practical deployments of ECC with cofactor of elliptic curves $4$ or $8$?

Are cofactor $4$ and $8$ ECC schemes widely used in practical deployments such as those in cryptocurrencies? Can you name some practical settings where there curves are used and cryptocurrencies where ...
Turbo's user avatar
  • 908
1 vote
0 answers
33 views

How are elliptic curves designed for encryption purpose? [closed]

Why can't we use any random elliptic curve? What are the properties that need to be satisfied?
tend0pain's user avatar
0 votes
0 answers
16 views

How to get equation from given three points(with doubling) on twisted edwards curve over finite field?

I have given three points $ P $, $ Q $, $ R $ on Twisted Edwards Curve over prime finite field $ \mathbb{Z}_p $. $$ ax^2 + by^2 = dx^2y^2 + 1 $$ I know about given points that point $ Q $ is doubling ...
B.W.'s user avatar
  • 1
3 votes
1 answer
533 views

How brittle is the current public key encryption infrastructure

Edit: One half of the answer to this question also applies to a recently asked and now deleted question regarding the impact of an algorithm which breaks DLP over integers but has no impact on ...
kodlu's user avatar
  • 21k
0 votes
1 answer
83 views

Elliptic curve signature scheme without a nonce

ECDSA and EdDSA both require the generation of a single-use value. Are there any elliptic curve signature schemes in existence which don't require nonce and maintain the usual security strength equal ...
Melab's user avatar
  • 3,605
1 vote
1 answer
46 views

Are (0,0) the coordinates of the "point at infinity"?

Christel Bach's elliptic curve calculator has the coordinates for the "point at infinity" be $(0,0)$. Is that just a stand-in?
Melab's user avatar
  • 3,605
0 votes
0 answers
17 views

Fixed-base exponentation with preprocessing [duplicate]

Is anyone aware of an in-depth study of algorithms using preprocessing to compute fixed-base exponentiations? Assuming I am willing to do arbitrary computation in the preprocessing phase (but not ...
user432944's user avatar
1 vote
0 answers
38 views

How to calculate ECDSA compressed public key in HEX? [closed]

I am given the ECDSA public key x and y coordinates below, calculate the compressed public key in HEX: PubKey.X : 61702053028733271054209908027052318932346644879827564097906752978487519734153 PubKey....
ah_'s user avatar
  • 11
0 votes
1 answer
51 views

Multiplicative inversion of a generated point?

Let's say I have a public generator $G$, an unknown, private $p$ and a public point $pG$ on an elliptic curve. Given $pG$ it's easy to construct $-pG$ by just taking the negative. But can you ...
mtheorylord's user avatar
0 votes
0 answers
28 views

Transportation Key (KEK)

I was studying about how to transport keys from one HSM environment to another and it came to me that I would need some sort of transportation key so the HSM keys would be double encrypted. How would ...
Allan Romanato's user avatar
0 votes
1 answer
24 views

Is it wrong that in a JWK, if the "d" value is **omitted**, that JWK represents a private key?

This is not a programming question. This is to confirm whether a crypto documentation is incorrect. I am using Rust's p384 crate. I am creating a private key from a JWK string. In the source code, at ...
sudoExclaimationExclaimation's user avatar
0 votes
1 answer
79 views

Given pedersen commitments of some elements, how to prove that the sum of only one subset of these elements is equal to the given element θ?

Assume that Prover have $n$ pedersen commitments ($V_{a_1},V_{a_2},\cdots,V_{a_n}$ where $V_{a_i}=G \cdot a_i + H \cdot r_{a_i}$) of $n$ elements $a_1,a_2,\cdots,a_n$. The Prover have another element $...
user105684's user avatar
0 votes
0 answers
59 views

Trouble detecting cyclic group order crossovers in SECP256K1

There's a problem in detecting whether the sum of public key addition has crossed the cyclic group order boundary For this example, think of public keys $Pub$ as private keys $Priv$, (private scalars),...
Maltoon Yezi's user avatar
1 vote
2 answers
124 views

How to prove that a Pedersen commitment has the same value as at least one of a set of other Pedersen commitments, without revealing which

A prover has two pedersen commitments, $V_{a}=G\cdot a+H\cdot r_a$ and $V_{b}=G\cdot b+H\cdot r_b$, which commit the values $a$ and $b$ respectively. The prover has another commitment $S_{\sigma}=G\...
user105684's user avatar
0 votes
1 answer
40 views

Using plaintext + ciphertext combination as substitute for authentication/signature in elliptic curve cryptography

I'm working on a system where I need to sign some data using an ECC private key and share the data and signature over a BLE ADV packet. Since an ADV packet is limited in space, I can't use a full ...
gabe_torres's user avatar
1 vote
0 answers
62 views

Is it possible to get the negative point with −x in that version of the Pedersen hash over the BaybyJubJub curve?

The Pedersen hash is a low constraints friendly hash for Zk-Snarks. Unlike many algorithms, the Pedersen hash returns a point P = (x,y) on a curve as a hash. ...
user2284570's user avatar
1 vote
1 answer
61 views

Can anyone explain the algorithm that OpenSSL uses to add two points on an elliptic curve?

I am trying to understand how OpenSSL adds points on an elliptic curve. I have understood from here that ossl_ec_GFp_simple_add() is where the addition op works. Can anyone explain the algorithm used ...
Knm's user avatar
  • 11
0 votes
1 answer
102 views

Given a safe elliptic curve with generator $g_1$. Is there a function $f:(g_1^a,g_1,a)\leftrightarrow g_2$? For random $g_3,g_4$ -> $a$ unknown

In use-case we have a (random) generator $g_1$ and perform operations $g_1^{a}$ for known $a$ inside a safe elliptic curve modulo $p$. Is there any function $f$ which gives us a new (most likely ...
J. Doe's user avatar
  • 571
0 votes
1 answer
45 views

Create PKCS12 file from EC Private and Public key pair

I have a file with an EC Public Private Key Pair and curve parameters: ...
tzippy's user avatar
  • 143
0 votes
0 answers
51 views

Hybrid encryption parameters when using elliptic curve keys

I wrote a command line application for encrypting/decrypting files to your local machine. The idea is you have an asymmetric key pair where the private key is stored encrypted and the public key is ...
Samuel Amantea-Collins's user avatar
1 vote
1 answer
149 views

On the bit security of elliptic curves

My understanding is that an elliptic curve $E$ over a finite field $\mathbf{F}_q$ has a bit security of $\sqrt{q}$ assuming Pollard rho or Baby-step giant-step. In this thread, it is explained that ...
bobby's user avatar
  • 13
0 votes
0 answers
80 views

Which encryption/decryption to use with ECC?

I'm using ECDH for generating shared key for STM32 MCU. Which encryption/decryption algorithm should I use? I looked at RSA and AES project samples provided by STM32 but where do I provide shared key ...
minion's user avatar
  • 1
2 votes
1 answer
121 views

Encryption within the groups of BLS12-381

I have been investigating libraries that implement operations and protocols involving BLS12-381 curves. I have noticed an absence of libraries that support encryption over (either of) the groups G1 ...
884d88baaa's user avatar
1 vote
1 answer
201 views

Pedersen Hash : when truncating the hash to keep only the X coordinate, is it possible to compute a collision when the Babyjubjub curve is used?

The Pedersen hash is a low constraints friendly hash for Zk-Snarks. Unlike many algorithms, the Pedersen hash returns a point P = (x,y) on a curve as a hash. ...
user2284570's user avatar
1 vote
2 answers
61 views

How to redistribute shares for Distributed Shamir Secret Sharing?

I'm working on a Distributed Key Generation protocol. The idea is similar to this. TLDR: Aggregated Shamir Secret Sharing, each participant acts as a dealer & distributed the secret shares of its ...
user106458's user avatar
1 vote
2 answers
1k views

Is there a way to get time from signature? Or is it possible to ensure the message was signed at the time that it says it was signed?

Suppose my server receives a message, the public key, and the signature. The message contains a time stamp. Is there a way to get the time stamp from the signature to match it with the message time ...
sudoExclaimationExclaimation's user avatar
1 vote
1 answer
94 views

modular reduction using solinas prime

I want to perform a modular reduction using Solinas prime value as q = 2^383-2^33+1. How can I efficiently compute it taking advantage of q being Solinas prime?
Ayush's user avatar
  • 11
1 vote
1 answer
60 views

What is the reverse formula from Coords on E11 to Coords on E1 [closed]

U= 115792089237316195423570985008687907852598652813156864395638497411212089444244 a = 20412485227 E1 = EllipticCurve(GF(p), [0,1]) with order U E11 = EllipticCurve(GF(p), [0,1]) with order a ...
bnsage123's user avatar
1 vote
0 answers
30 views

Ethereum signature as xml-dsig11

This question was originally posted in https://ethereum.stackexchange.com/questions/151471/ethereum-signature-as-xml . I post it here aswell because I rarely get any response there. I am seeking to ...
lash's user avatar
  • 111
1 vote
0 answers
145 views

Edwards curve ed25519 puzzle

Recently a friend of mine showed me a "puzzle" he created with edwards curve ed25519 It is based on adding and multiplying points on the curve You supply four arguments to the program The '...
deneth0r9's user avatar

1
2 3 4 5
42