Questions tagged [elliptic-curves]
Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.
1,360
questions
1
vote
0answers
11 views
Double discrete logarithm on elliptic curve
Background:
I am attempting to implement the paper Publicly Verifiable Secret Sharing. I managed to get it working using modular groups, but when I want to make it more efficient by transferring to ...
1
vote
0answers
18 views
Protecting Ed448 against DPA and fault attacks
There are some papers (1, 2) describing fault attacks in EdDSA. One suggested countermeasure is to add randomness to the input of the first hash call, which outputs a scalar.
This paper describes a ...
0
votes
0answers
18 views
Lifting point to quadratic twisted curve
How to lift point to it’s quadratic twisted curve? I use secp256k1. Is the diiscrete log still same? Thanks before
-3
votes
0answers
32 views
How to compute key size of elliptic curve? [closed]
Please can anyone tell me How compute the length of key K=(1062,1570)?
I don't know how to compute it ..
3
votes
0answers
47 views
ECC: Lightweight proof of correct exponentiation
In the context of ECC.
There's an EC point $P$ which is supposed to be a known power of another known point $G$ (generator). That is:
$P = [k]G$ (in additive notation)
This should be verified on an ...
0
votes
0answers
23 views
BIP32 Extended Key to EC Private and Public Key Pair
We are working on an application in Android using Java. In our project, we used to generate EC key pairs (of size 384 bits) using SpongyCastle - an old Android version of Bouncy Castle.
The problem ...
-1
votes
0answers
34 views
Generate keys with Edwards25519 - Equivalence to Curve25519
I am trying to generate Ed25519 keys based on a 32-byte seed. According to RFC 8032, in order to create the public key, you have to take the private key, hash it with SHA-512, prune it, and then use ...
-2
votes
0answers
20 views
complexity of ElGamal ECC and Menezes-Vanstone ECC? [closed]
How to compute the complexity of ElGamal ECC and Menezes-Vanstone ECC?
-1
votes
0answers
12 views
ElGamal ECC. and Menezes-vanstone ECC
Can anyone tell me how to measure the security force of ElGamal ECC. and Menezes-vanstone ECC.?
2
votes
1answer
53 views
Checking if point is on EC twist
Given a short Weierstrass elliptic curve $C$ over $F_p$ and a point $(x, y)$, it is easy to verify that $(x, y)$ either satisfies the curve equation (on-curve) or does not (off-curve).
In the case ...
0
votes
0answers
19 views
What is the best way to encrypt whole partitions with Ed448-Goldilocks?
I like crypto, but I'm a bioanalytical chemistry person by trade. I like this algorithm and was wondering if I could use it to encrypt partitions like a MBR that prompts a passphrase, like BitLocker.
2
votes
0answers
51 views
Shamir three-pass protocol Elliptic Curve
I want to know how I can implement this protocol. I know how Shamir three pass protocol operates without elliptic curve, but I don't know how I can perform it with elliptic curve.
I read about this ...
2
votes
3answers
149 views
Can DNA computing to solve elliptic curve algorithms using this method
The authors of this paper: Fast Parallel Molecular Algorithms for DNA-Based Computation: Solving the Elliptic Curve Discrete Logarithm Problem over $GF(2^n)$ proposed a novel algorithm based on DNA ...
0
votes
1answer
40 views
Division of Point in Elliptic Curve: Getting Back Point
Let $P=(x_p,y_p)$ be a point on elliptic curve $E (a, b) := y^2=x^3+ax+b$, for an integer $n$, there exists a point $Q=(x_q,y_q)=nP$ on $E (a, b)$.
If $(x_q,y_q)$ and $n$ are given, what is the ...
0
votes
0answers
36 views
Can knowing the ephemeral key recover the private key in ECDSA
If the attacker - some guy who really, really wants to steal bitcoins - somehow finds the ephemeral key used in an 256-bit ECDSA signature, can he recover the private key?
If so, would knowing the ...
1
vote
0answers
43 views
Elliptic Curve (Point Counting)
I am studying elliptic curves in particular point counting. If I have coordinates P and 2P, is there a way to calculate the total points in between P and 2P using either curve parameters or algorithm? ...
2
votes
1answer
61 views
Finding subgroup in elliptic curve over finite field $ \mathbb{F}_{11}$
For elliptic curve $ y^2 = x^3 +3x+7$ I found the finite group $ E(\mathbb{F}_{11})= \left\{ \mathcal{O}, (1,0),(5,2),(5,9),(8,2),(8,9),(9,2),(9,9),(10,5),(10,6) \right\}$.
I have to find a ...
0
votes
0answers
26 views
Pair-friendly elliptic curves vs non friendly
Group law operations on pair-friendly elliptic curves are slower than in non friendly elliptic curves, but how much slower? Can't seem to find a performance comparison between the two for a given ...
0
votes
0answers
36 views
Generalized Schnorr's signature variations
I'm working on an ECC-based system.
There's a Schnorr's signature, by which the prover may prove a knowledge of a preimage (i.e. scalar, private key) of an EC point (i.e. public key).
It can be ...
1
vote
1answer
49 views
Does ECC's cofactor affects ECC's private key selection?
I am doing a project using ECDH with Curve25519. I use mbedtls library, in the implement, I realize that the private key of Curve25519 is clear 3 last bit, or it is divide by 8 and the cofactor of ...
1
vote
1answer
73 views
Elliptic Curve vs RSA key length comparison
I'm new to ECC.
From this website (GlobalSign Elliptic Curve Cryptography) a 256 elliptic curve key pair provides as much security as a 3072 bit RSA key pair.
My question is: how do experts come to ...
4
votes
1answer
142 views
Is double encryption really a bad idea? Are meet-in-the-middle attacks practical at all?
Meet-in-the-middle attacks are used to justify that attacks on ECC and double encryption will have complexity of $O(\sqrt{n})$ for ECC and $O(2^{n+1})$ for double encryption complexity instead of $O(n)...
1
vote
2answers
56 views
How to impelement mapping point Curve25519 to weierstrass point?
I am implementing a ECDH using Curve25519 to communicate two system. One system have library that use for weierstrass curve only, it can define with domain parameter like p, a, b, G_x, G_y. I have ...
1
vote
0answers
55 views
is forward secrecy irrelevant for non-streaming applications?
I asked a question yesterday about the Keybase key model and got no answers, unfortunately. Let me rephrase the question to make it clearer: in the case, if 2 users just want to send each other low-...
1
vote
0answers
40 views
Trying to understand Keybase's key model and replacing PGP with device keys
I am exploring Keybase and I thought it was merely a wrapper for gpg and connecting its public key with social accounts (e.g. github, twitter, etc...). But after reading the very short and unclear ...
-2
votes
1answer
59 views
ECDSA multiplication vs exponentiation
In Elliptic Curve Digital Signature Algorithm (ECDSA) I often see 2 different written equations of it:
Elliptic curve point multiplication by a scalar, $Q_{A}=d_{A}\times G$, source
Modular ...
0
votes
0answers
34 views
Where can I find standardized implementations of lightweight cryptographic ciphers?
I am working on a project that requires encrypting messages with different ciphers. I am looking for the following ciphers:
PRESENT,
CLEFIA,
LEA,
Hill cipher,
Affine cipher,
Elliptic Curve ...
1
vote
1answer
84 views
Assistance with parsing PGP PRIVATE KEY BLOCK's Secret-Key Packet (0x6) and Secret-Subkey Packet (0x7) using command lines and RFC 4880?
The throw away private keys below (master ed25519 & subkey curve 25519) were exported without being password encrypted.
% cat skaht_0523F5B4_Secret.asc
...
1
vote
0answers
47 views
Verifying the ownership of curve25519 public keys
Let's say we have a group of users, authenticated by a server that providers the service, communicating on a secure channel (e.g. over HTTPS/TLS) and each user has a corresponding curve25519 key pair. ...
1
vote
1answer
66 views
Complexity of computing zk-SNARK Proofs
Disclaimer: I have no background in cryptography, and everything I'm asking about is what I've learnt from last couple of days of frantic reading on this topic. Any help is much appreciated.
Q: What ...
0
votes
1answer
47 views
Understanding simplification steps when solving complicated equations in Galois Field
I just encountered a problem when I tried to understand a basepoint conversion from x25519 to ed25519. I can't really wrap my head around how the value of $x$ can be the stated value below? Can ...
6
votes
2answers
433 views
How to create an EC point from a plaintext message for encryption
It seems that ElGamal encryption is also possible for Elliptic Curve cryptography. However, that requires the user to convert the message to a point on the curve. What strategies are there to derive a ...
0
votes
1answer
86 views
ECC public key encryption without symmetric cipher
Imagine the following scenario. A process is running in background and permanently encrypting some data. An adversary has full control of the process, e.g. it can dump the process memory any time and ...
3
votes
2answers
80 views
Size of $E$ over $\mathbb{F}_p$ contains $p+1$ points
I am struggling to prove this claim:
I proved that the map $x\mapsto x^3+1$ is a bijection from $\mathbb{F}_p$ to itself if we have that $p\equiv 2\bmod{3}$. We have to use this fact to prove that ...
0
votes
0answers
24 views
Compute shared public keys
I want to compute, in a distributed way, the following shared public keys on an elliptic curve:
$(xG, x^2G,...,x^nG)$,
being $x$ a secret scalar that no single party knows, $G$ the public ...
2
votes
2answers
233 views
Operation on elliptic curves
Let $Y = xG$ be a point on an elliptic curve, $G$ the generator point and $x$ a scalar. Without knowing $x$, is it possible to calculate $x^nG$, being $n$ a natural number?
2
votes
1answer
146 views
Public Key generation for Ed25519 vs X25519
It is my understanding that EdDSA uses a slight variant of Curve25519 (typically used for ECDH), called Ed25519.
Given the same private key, are the differences between the two algorithms enough to ...
1
vote
2answers
61 views
Understanding Montgomery's parameterization of elliptic curves
I'm having a bit of trouble understanding the translation of affine coordinates to projective coordinates in Montgomery curve ECM. Would be very thankful if someone could explain it by expanding the ...
0
votes
1answer
77 views
Can we retrieve his private key using his public key in ECC?
A paper wallet is the name given to an obsolete and unsafe method of storing bitcoin which was popular between 2011 and 2016. It works by having a single private key and bitcoin address, being printed ...
4
votes
0answers
68 views
Regarding the need to hash the shared secret in X25519 with the public keys
I was looking at the LibSodium documentation where it says
[...] and to mitigate subtle attacks due to the fact many $(p, n)$ [public key - secret scalar] pairs produce the same result, using the ...
1
vote
0answers
38 views
Need help understanding SPAKE2 setup values
I am trying to write a simulation of the SPAKE2 protocol in python (just so I can get a better understanding of the protocol altogether). I am reading through the ietf draft here: Datatracker.
There'...
0
votes
1answer
374 views
“Probability” of an ECDSA signature
The article Elliptic Curve Digital Signature Algorithm in Bitcoin's wiki talks about signatures having probabilities (as in ...
0
votes
1answer
63 views
Is this the right way to implement ElGamal scheme over Elliptic Curves over prime field? [duplicate]
I'm fairly new to Cryptography, especially elliptic curves in general. I learned to do Point Multiplication, Scalar Multiplication and also programmatically implemented them. But I was trying to do ...
0
votes
1answer
74 views
Key clamping in curve25519 not evident in generated key's binary representation
I understand with curve25519 that the private key for secret.box is clamped...
I understand that this clamping process to clear ...
0
votes
1answer
82 views
Order of subgroups formed by Elliptic Curves with a Cofactor
In this question:
Why are the lower 3 bits of curve25519/ed25519 secret keys cleared during creation?
The answer indicates that the order of all points on the curve over the finite field ...
0
votes
1answer
85 views
Choice of finite fields for use in elliptic curves
this is maybe a basic question but I'm trying to better understand elliptic curve cryptography at a fundamental level.
I understand that a finite field is required in order to define a boundary for ...
1
vote
1answer
113 views
Why does curve25519 use a cofactor of 8?
This cofactor (as I understand it) effectively discards valid points that satisfy the curve equation over the finite field.
Why would one wish to reduce the number of possible private keys, it seems ...
0
votes
1answer
70 views
Does the nonce really have to be hashed as part of the challenge in a Schnorr signature?
From this article: https://tlu.tarilabs.com/cryptography/digital_signatures/introduction_schnorr_signatures.html#why-do-we-need-the-nonce
The article states that the challenge ...
0
votes
2answers
89 views
Elliptic curve commitments mod p
As far as I understand secp256k1 is defined over the group p with
p = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F
I don't really ...
0
votes
0answers
39 views
Signing with ECDSA [duplicate]
I am new to ECC. I was reading this post https://andrea.corbellini.name/2015/05/30/elliptic-curve-cryptography-ecdh-and-ecdsa/
I want to know if there is any intuition behind the following formula:
$...
