Questions tagged [elliptic-curves]
Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.
1,771
questions
2
votes
1answer
109 views
Is the STARK Curve a SafeCurve?
SafeCurves defines criterias for choosing safe curves in elliptic-curve cryptography.
STARK Curve defines a Stark-friendly elliptic curve that can be used with ECDSA.
I was wondering: Is the STARK ...
1
vote
1answer
48 views
How to use ECDSA test vectors?
I would like to verify my system by running ECDSA NIST test vectors, but I am not getting expected output. I am able to calculate signature, but it is not right or at least "r" and "s&...
3
votes
1answer
57 views
Is there any "exception-free" coordinates system for Weierstrass curves?
I'm referencing RFC-6090 for an attempt at implementing ECC in my spare-time project.
In the RFC, pseudo-code examples are given to illustrate how to handle points-at-infinity in point arithmetic, and ...
2
votes
1answer
40 views
How to determine whether a point is at infinity in homogenous coordinates?
I'm implementing ECC in my spare time project. I'm referencing RFC-6090 for point arithmetic algorithm over homogeneous coordinates.
In Appendix F subsection 2, there are 5 case labels when ...
2
votes
0answers
43 views
Are the FIPS 186-5 and ANSI X9.142-2020 definitions of ECDSA consistent?
FIPS 186-4 Digital Signature Standard defers to ANSI X9.62-2005 for the specification of ECDSA, with additional requirements set out in Chapter 6 and Appendix D. However, X9.62-2005 has since been ...
1
vote
0answers
30 views
Prove that the message is recoverable in MQV
I have this assignment in which I have to prove that Alice can recover the original plaintext that Bob sent using MQV. The way this goes is:
A trusted party chooses and publishes a (large) prime $p$, ...
1
vote
0answers
31 views
Is it possible to recover the private key if the same message is signed twice with different nonce? [duplicate]
Sorry if this question is misguided, I'm a software developer and not a cryptographer.
Let's say I have a public key, and 2 signed messages.
Signed message 1:
...
0
votes
1answer
49 views
OpenSSL: How to convert ec private key(32byte raw key) to pem type private key?
I have a 32 byte octet string ec private key.
And I want to convert this to pem type private key.
I use the secp256r1 curve.
How can I do that?
Is any command or method for that?
1
vote
2answers
54 views
Is it possible to verify that the output of an executable came from its unaltered control flow?
I suppose an executable could contain a key which signs its output, but that key could be extracted and used to sign other data. Is it possible to verify that the output of an executable is the direct ...
4
votes
1answer
119 views
Why is Montgomery Ladder fast on Montgomery Curves?
When I look at the Montgomery Ladder algorithm, I don't find anything that is specific to the Montgomery curve. We are dealing with the points all the time i.e. we are either adding two points or ...
1
vote
0answers
63 views
how calculate 2g ,3g ,
$y^2=x^3+9x+17$ over $\mathbb{F}_{23}$,
what is the discrete logarithm $k$ of $Q=(4,5)$ to the base $P=(16,5)$?
One (naïve) way to find k is to compute multiples of $P$ until $Q$ is found. The first ...
1
vote
0answers
39 views
Deterministic $σ_i$ when implementing traceable ring signature on Curve25519
Fujisaki & Suzuki's Traceable Ring Signature paper, which allows for a signature by one private key out of a ring of public keys to sign, and for anyone to verify that one member of the ring ...
2
votes
1answer
77 views
Add a non-signer to an already-signed message
This is a follow-up to the first comment of this answer.
A message is signed with the private key of $A$, $s_A$. We know $p_B$, the public key of $B$, but not $s_B$, their private key. Is it possible, ...
7
votes
1answer
266 views
Find Elliptic Curve Parameters, a and b, Given Two Points on the Curve
I am new to Elliptic Curve Cryptography and am working on a CTF challenge that uses Elliptic Curves. Currently, I am trying to find the generator, $G$, and am given the public and private keys, $P$ ...
1
vote
1answer
51 views
Which elliptic curve was used by Thunderbird OpenPGP and which bitlength?
If one looks at Account Settings > End-to-End-Encryption > Add Key and creates a new key then gets the option EC. But you can't choose the bit length nor does ...
3
votes
1answer
98 views
order of elliptic curve subgroup when curve has point (0,0)
I'm a beginner. But I understand that the order of a subgroup is a divisor of the group order.
The curve $y^2=x^3+7$ over $\mathbb{Z}_7$ has eight points (7 points and the point at infinity). The ...
5
votes
2answers
206 views
Cheapest way to prove that two different private keys are known to the same person?
Say that there are two unrelated ECC keypairs ($Pub_1$, $Priv_1$) and ($Pub_2$, $Priv_2$). Alice claims that she knows both $Priv_1$ and $Priv_2$, but Bob doesn't trust her, and thinks that $Priv_2$ ...
0
votes
0answers
45 views
How to get public key and bitcoin compressed address from the coordinates (x,y) generated by ECDSA?
I have my x (0xca668a8b5f71e8724aada4b5343c28702a481787855cc42228b8fff97fe94d6a) and y (0x19dd3a603a55b3d8c5f62cbe177b9b63693fb8c91d76845bafc843a7aa19ea55) coordinates generated by ecdsa with a ...
3
votes
1answer
82 views
Is it possible to calculate multiplication inverse of a point on elliptic curve?
The title must be confusing. Imagine we have this curve:
$y^2 = x^3 + 9x + 17$ over $\mathbb F_{23}$
And we know
[4]P = (19 , 20)
[8]P = (12 , 17)
If we only have the value of $[8]P$, Is it ...
1
vote
1answer
128 views
How can I understand the math behind crypto, especially that used in blockchains / distributed ledgers?
A bit of a background about me; Computer Engineer but during my studies I didn't dive too deep into the maths, especially the crypto maths that is used to make the blockchain and cryptography work.
I'...
0
votes
0answers
11 views
How to sign CAM/DENM messages using mbed LTS libray with ECDSA (EEE Std 1609.2)
I have read ETSI TS 103 097 and EEE Std 1609.2 which gives me the security data structure defined in ASN.1 notation. I want to use mbed LTS to calculate the ECDSA signature. I understand that I should ...
1
vote
1answer
232 views
What is a function on a Line or a Curve?
I am reading up on Pairings using Elliptic curves & all the texts talk about functions on a Curve.
I am finding it difficult to even figure out what they mean by "function on a curve" or ...
1
vote
1answer
48 views
AWS IoT - Unique Keys per each device - Data encryption
(Probably not the right board to ask. But here goes)
I'm designing an IoT Solution with RPi as client and AWS as the server. On the client hardware, I have an Security Chip that can securely generate ...
1
vote
1answer
37 views
computation time of pairing operations and their securities
Suppose G1 is an elliptic group and G2 be a multiplicative group and they are of same prime order p and e is a bilinear pairing, e: G1 X G1 -> G2. The operations e(p,q)r and e(pr,q) gives equal ...
2
votes
0answers
55 views
Short Nonces in ECDSA signature generation
Recently I noticed that my device generates short-sized Nonces.
Approximately $2 ^ {243} - 2^{244}$.
Could it turn out that there will be a small leak of ...
1
vote
1answer
82 views
Convert secp256k1 private key to sr25519 private key
Is it possible to convert secp256k1 private key to valid sr25519 key?
4
votes
1answer
96 views
Would being able of factoring integers efficiently have some consequences over Elliptic Curve Cryptography?
Let's assume you can factor integers in a very efficient manner. Would that endanger the security of e.g. elliptic curve cryptography, or is there no link between the two ? You can often read that ...
0
votes
3answers
128 views
Two Elliptic Curve Points having the Same X coordinate
Suppose in a elliptic curve (say the curve equation is: $y^2 = x^3 -17$) with prime order $q$, we have $(x,y_1) = nP$, where $P$ is a generator and $n<\lceil{q/2}\rceil$. Can we claim that there ...
1
vote
0answers
41 views
Birational transformation from Edwards curve with not square d to Edwards curve with square d
How can I transform a complete twisted Edwards curve $ax^2+y^2 = 1+dx^2y^2$ with not square $d$ and square $a$ into an isomorphic Edwards curve $X^2+Y^2 = 1+DX^2Y^2$ with a square $-D$ i.e. $D = -r^2$?...
0
votes
0answers
36 views
Is it possible (and if so how) to make one proof for multiple private keys in ECDSA
Lets say I have a message that needs to be signed by two keys that were generated using ECDSA
Is it possible to make a signature that accounts for both keys, meaning I can verify with both and see ...
2
votes
0answers
68 views
ElGamal with elliptic curves and semantic security
To encrypt a group element $P$ with public key $K$ and randomness $r$ using ElGamal on elliptic curves with base point $G$ we do the following $(c_1, c_2) = (r\cdot G; P+r\cdot K)$.
When we want to ...
1
vote
1answer
86 views
Are there any public keys for which the private key can be easily derived (ECDSA)?
I know that generally it's infeasible to find the private for any given public key. But I also came across the question "Find ECDSA PrivKey to PubKey = 0", in which it was explained that the ...
0
votes
1answer
165 views
Can I know from a Bitcoin public key if the private key is odd or even?
Can I know just from a Bitcoin public key if the private key is odd or even?
[moderator note] That is, can we find parity of the private key from a secp256k1 public key?For the original dump of ...
1
vote
0answers
20 views
running Project Wycheproof against crypto implementations in languages other than Java
So I guess https://github.com/google/wycheproof "tests crypto libraries against known attacks". It appears to mainly be intended for Java crypto providers but can it easily be adapted to be ...
3
votes
1answer
69 views
What is/was SEC#1 ECC public key leading octet 0x01 for?
In the SEC#1 elliptic curve cryptography standard, the encoding of the public key involve a leading octet:
00h: The public key is the point at infinity.
02h, 03h: The public key is the compressed ...
0
votes
0answers
39 views
Why does ECDSA produce a pair of values in its' signature (r,s)?
I was wondering why ecdsa generates a signature in form of a pair (r and s) and why it can't be only one value.
1
vote
2answers
923 views
What is the difference between "Elliptic Curve Function" and "Hash Functions" like SHA256?
I am reading about bitcoin and I am a little confused about "elliptic curve function" and "SHA256".
Do they have the same properties? Can both be used to generate private and ...
1
vote
1answer
79 views
Multiuser encryption, singleuser decryption [duplicate]
I have an hybrid encryption (RSA, AES) for a file sharing project I am working on, where I use a single public key for encryption on the sender side and corresponding private key for decryption on the ...
1
vote
1answer
67 views
ECDSA - generating a new private key each time we sign?
So, I kinda get the mathematics behind the ECDSA, but I can't seem to find precise information about private key generation. In other words, do we have to generate private key, each time we generate a ...
1
vote
1answer
112 views
Size of group elements in a bilinear context
In a asymetric pairing context, which size (in bits) should have the elements of $\mathbb{G}_1,\mathbb{G}_2$ and $\mathbb{G}_T$ if we consider the most efficient elliptic curves?
1
vote
2answers
109 views
What is the meaning of $F_{p^k}$ and the elliptic curve over it, $E(F_{p^k})$?
In pairing based cryptography, there will be the finite field $F_{p^k}$ where $p$ is prime number and $k$ is an integer. The elliptic curve is constructed on that finite field as $E(F_{p^k})$.
For ...
1
vote
1answer
58 views
Isomorphic mapping of BLS12-381 G2 points to G1
I'm attempting to reproduce ring signatures as described in Section 5 of https://crypto.stanford.edu/~dabo/pubs/papers/aggreg.pdf but applied to the BLS12-381 system.
One of the assumptions in their ...
2
votes
1answer
75 views
kleptography SETUP attack in ecdsa
I'm trying to implement kleptography SETUP attack of ecdsa with python.
Just a simply script to verify the algorithm. However i can't get the right output as the paper said. Where is the problem? Can ...
0
votes
2answers
109 views
Is it possible to give a definition for point multiplication on elliptic curve?
As we know that at least in cryptography, the group operation on elliptic curve is just the point addition(https://en.wikipedia.org/wiki/Elliptic_curve_point_multiplication), which is defined on $E:y^{...
1
vote
1answer
244 views
Why does point addition work on EC curves?
This may be more of a math question but I cannot find an intuitive answer.
On an EC curve why is 2P+2P equal to P+P+P+P?
The addition operation seems to a layman as some arbitrary sequence of steps. ...
0
votes
1answer
99 views
Notation question: Dividing 2 Elliptic Curve Points producing a third point
I'm working my way through some papers and ran across what seems to be division of two points that produce a third point. I'm new to ECC and am having a terrible time trying to figure out what this ...
5
votes
3answers
562 views
How to decide if a point on a elliptic curve belongs to a group generated by a generator g?
In the elliptic curve encryption scheme, there is a cyclic group generated by a base point $G$ on the elliptic curve.
Given a random point on the elliptic curve, is there a way to decide if the random ...
0
votes
0answers
41 views
How to decompose a public key into subgroups EC?
Is it possible to decompose the public key into its own subgroups?
Suppose we know the order P with which the public key was generated ...
2
votes
1answer
63 views
What is the quadratic character of the field over which elliptic curve is defined?
I'm trying to understand the injective encoding of a message to an elliptic curve point (from this paper).
However, I'm not sure what do they mean by the quadratic character of the field. Do you know ...
0
votes
0answers
61 views
How to get a common coordinate from two different coordinates on Elliptic Curves? [duplicate]
I am trying to write a SageMath script that multiplies two coordinates on Elliptic Curves into one common coordinate.
SageMath Elliptic curves over finite fields ...