Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

Filter by
Sorted by
Tagged with
0
votes
0answers
17 views

Is it possible to safely implement the Signal Protocol (X3DH) without using XEdDSA

In the X3DH specification of the Signal Protocol it mentions having a signed pre-key in the key bundle. This pre-key is signed using the identity private-key. Because the identity private-key is in ...
2
votes
1answer
47 views

Why is the point at infinity on Edwards Curve different to Weierstrass curves?

If I understand correctly, the identity point on all elliptic curves is the point at infinity. But on the Edwards curve, this can be written in Affine form? Does this have something to do with the ...
0
votes
0answers
7 views

How to securely design REST API for Password Manager app? [migrated]

I want to create Password Manager where users can create their accounts and store website passwords. For the frontend, it will be a mobile app, but I need REST API as the backend data where the data ...
1
vote
0answers
33 views

Elliptic curve subgroup with $p$ elements in field of characteristic $p$

Are there any elliptic curves defined over a finite field $\mathrm{GF}(p^k)$ with a subgroup of order $p$ where the discrete log (and preferably DDH) problem is hard? Elliptic curve with prime ...
2
votes
1answer
108 views

Curve25519 choice of the prime

In the paper for curve25519 is described how the prime was chosen. But I don't understand why the biggest 255-Bit prime was chosen instead of a 256 Bit prime. Can someone explain this to me?
0
votes
0answers
19 views

How can I create a pem encoded string with a ECDSA secp384 public key? [closed]

I'm trying to create a PEM string using a ECDSA p384 public key. I'm using the crypto library to generate the key. I'm just missing the encoding part. Is there any javascript library to help me ...
1
vote
0answers
43 views

Schoofs Algorithm

I studied Schoofs Algorithm described by Washington. On page 125 he says that we could write $y'/y$ as a function of $x$, which makes sense since earlier on the page he denotes $y'= r_{2,j}(x)y$. But ...
0
votes
1answer
46 views

Message mapping to elliptic curve in BLS signature

In the BLS signature the subgroup $G$ of elliptic curve constructed with point $P$ with prime order $q$ by $G=\langle P\rangle $. The $h(x)$ is a hash function. The point $S$ is map (image) of $h(m)$ ...
1
vote
1answer
40 views

Importance of supersingularity of elliptic curves

I'm struggling to understand the high-level idea of "Verifiable Delay Functions from Supersingular Isogenies and Pairings" (https://eprint.iacr.org/2019/166.pdf) by De Feo et al. I will ...
2
votes
1answer
101 views

Mapping the hash of message to a point of elliptic curve for signature

Let the subgroup $G$ of elliptic curve constructed with point $P$ with prime order $q$ by $G=\langle P\rangle $. The $h(x)$ is a hash function. We want to map the hash of arbitrary message $m$ to a ...
2
votes
1answer
56 views

In q-SDH problem, where are those points $\frac{1}{\beta+x}g$ or $g_1^\frac{1}{x+c}$ on elliptic curve?

For the q-SDH problem, given the generator $g_1$ as a point on the elliptic curve, I can picture the $\beta g_1, \beta^2g_1, ..., \beta^qg_1$ since we can simply do the point adding $g_1$ multiple of $...
1
vote
1answer
511 views

DH Elliptic Curves: Why choose a fixed base point?

I am having a first look at the TLS key exchange using Diffie Hellman and try to understand the Elliptic Curve variant of it. So if a client and a server agree on using ECDH for key exchange and they ...
0
votes
0answers
41 views

Is that proved that breaking ECDSA as hard as solving ECDLP? [duplicate]

Is that proved that breaking ECDSA (Elliptic Curve Digital Signature Algorithm) as hard as solving ECDLP(Elliptic Curve Discrete Logarithm Problem)?
2
votes
0answers
39 views

Security problems if ECDH and ECDSA use the same key [duplicate]

Hy! I want to use an EC key for ECDH and ECDSA too. Using the same key does compromise the security of the key in a cryptographic / mathematical sense? I read a lot in this theme, but I found nothing ...
-1
votes
0answers
31 views

Can a client with an ECC certificate and a server with RSA certificate establish a mTLS connection? [migrated]

Can a client with an ECC certificate and a server with RSA certificate establish a mTLS connection? Can they agree on a cipher suite? Why?
6
votes
0answers
95 views
+100

About a SETUP mechanism on ECDH

I'm following these three articles: Kleptography: Using Cryptography Against Cryptography, Kleptographic Attack on Elliptic Curve Based Cryptographic Protocols and Elliptic Curve Kleptography . In ...
1
vote
1answer
23 views

How to simplify a the signing process in an elliptic curve signature scheme that involves a quadratic verification equation?

I am looking at a proprietary signature scheme used in production. It involves a short Weierstrass curve $E_{\mathcal{W}}:y^2=x^3+ax+b$ in the prime field $\mathbb{F}_p$. The parameters are set up ...
1
vote
1answer
64 views

ECDSA signature with Brainpool curves in TLS possible?

Even the up to date RFC 8446 lists at the page 41 as the options for the ECDSA in e.g. TLS_ECDHE_ECDSA_WITH_... only NIST curves: ...
3
votes
2answers
327 views

Smallest possible certificate for IoT device

I'm developing an IoT system that uses small nodes connected through RF. This allows messages under 250 bytes long. You can check it at https://github.com/gmag11/EnigmaIOT. All messages are encrypted ...
1
vote
0answers
49 views

Difference and relation between ed25519, x25519 and XEd25519 [duplicate]

In my Rust implementation of a messaging system, I'm using currently two cryptographic primitives: ed25519_dalek and x25519_dalek. I use ed25519_dalek for DSA, while x25519_dalek for encryption of the ...
6
votes
1answer
215 views

What information is revealed if we send our points in Projective Coordinates?

Elliptic Curve Cryptosystem has various coordinate systems; like the Affine, Projective, and Jacobian coordinate systems. We prefer not to use the Affine coordinate system during the calculations ...
1
vote
1answer
86 views

ECIES for encrypting ECDH key exchange

I started studying Elliptic Curve Cryptography, and I do not know if I understand the difference between ECDH and ECIES (even with the other posts here on stackexchange). I'm wondering if ECIES can be ...
2
votes
1answer
56 views

Signature Generation Time vs Verification Time

When comparing the RSA-PSS signature algorithm with an elliptic curve based algorithm such as EdDSA, it is clear that signature verification takes less time for RSA than for EdDSA. For signature ...
1
vote
2answers
120 views

How to convert coordinates o a point from y^2=x^3+7 to y^2=x^3+4? [closed]

To moderator, this my question is not off topic !!! Please OPEN MY QUESTION. If for this place elliptic curves was off topic this so world is crazy. ...
2
votes
2answers
245 views

Get the parameters of an elliptic curve's equation

I have a binary signed with ECDSA384 and I need to verify it using a particular cryptography library. The first thing that needs to be done is to initialize the EC ...
1
vote
1answer
50 views

Point Matching Function for Curve 25519

Does anybody know a point-matching function for curve 25519? Or has a straight-forward way how to derive any arbitrary point-matching function? It should be like a reversible mapping from and to a 128+...
0
votes
1answer
67 views

Exponentiation Problem of G2 in MNT curve

I made a simple python program in the Charm framework (https://github.com/JHUISI/charm): ...
1
vote
0answers
42 views

Example for point addition using Jacobi transformation and small integers

This video explanation is great because it shows an example using small numbers, if it wasn't for that example my code would be wrong. Still: the code takes 0.5 seconds to calculate 300 point ...
-3
votes
1answer
131 views

What is the symbolic solution?

Let in ECDSA, $G$ is the base point, $P$ is a pubic key with the corresponding private key $k$. $G_2$ is another base point, $k_2$ is another private key. $P$ and all variables except $k$ are known. ...
13
votes
3answers
2k views

How are points on an elliptic curve discretized?

I'm a working programmer (read: a person without a maths degree) trying to get a better grasp on elliptic curves specifically in the context of elliptic curve cryptography (though to be clear, this is ...
2
votes
1answer
197 views

What is the ChainOfFools/CurveBall Attack on ECDSA on Windows 10 CryptoAPI

What is the ChainOfFools/CurveBall Attack on ECDSA on Windows 10 CryptoAPI (Crypt32.dll) Could someone provide details?
0
votes
1answer
111 views

Why are ed25519 keys not recommended for encryption?

Was wondering why there is no straightforward way of using ed25519 keys for encryption. Then I found this: https://github.com/indutny/elliptic/issues/108 There it is stated that it's unlike RSA not ...
6
votes
1answer
186 views

Iterations of pollards kangaroo attack on elliptic curves

I want to understand the Pollard kangaroo attack on elliptic curves. I found this Pollard's kangaroo attack on Elliptic Curve Groups Q/A pretty helpful, but not complete. The posts provides a pretty ...
2
votes
0answers
76 views

MOV-attack on ecc: Time complexity and example

There already is this pretty big post about the MOV-attack. It states, that the discrete logarithm problem on elliptic curves can be transformed to a discrete logarithm problem over a finite field. ...
2
votes
0answers
56 views

What is a formula of a twist?

With the curve secp256k1, the order of the twist is 3×197×1559×96769×146849×2587814237219×375925338294461779×101009178936527559588563023359 But I can't understand what is formula of this twist(twist ...
4
votes
1answer
138 views

ECC: application of multiple multiplicative inverses

I've recently read about "Montgomery trick" on Application of Montgomery's Trick to Scalar Multiplication by Pradeep Kumar Mishra and Palash Sarkar which provides a way to compute several ...
1
vote
0answers
61 views

Quantum computers and elliptic curves

I know, that quantum computers can theoretically break the discrete logarithm problem using the shor algorithm. The problem with quantum computers is not the time, but the space ( the needed qubits ). ...
2
votes
1answer
124 views

Calculate a base point on the twist of secp192k1 with maximal order

I want to calculate a base point on the twist of secp192k1 with maximal order. ...
1
vote
1answer
111 views

How to divide 2 coordinates on elliptic curve? [closed]

On the elliptic curves, there is no divide function, and I need divide coordinates - X/Y, o I need not divide but make (X minus or multiply to "modified" Y). How to modify Y?
0
votes
1answer
46 views

Choosing UWP encryption algorithms

I've just come across the large variety of encryption ciphers available in the UWP WinRT API, both symmetric and asymmetric. I'm trying to figure out which are commonly seen as the most favourable ...
0
votes
0answers
27 views

Where can I find references to the theory behind PBC library?

I don't know if this is the right place to ask this type of question. Anyway, I'm using PBC library for a project, but I'm a very newbie for what concerns pairing based cryptography. Then I ask some ...
0
votes
0answers
178 views

Fast Extended Euclidean Algorithm in Harley's elliptic curves point counting method

Could you help me with Harley's norm computation algorithm that is based on the Fast Extended Euclidean Algorithm that was suggested by Harley in an email to NMBRTHRY list in 2002 and that described ...
1
vote
1answer
130 views

Smart's attack for secp256k1 does not work

This is the Sage code that I use, and the results I get: ...
4
votes
1answer
160 views

Curve25519/Montgomery curves points with order 8

I found this post about Curve25519. It states, that there are only 5 points with a very low order. With this paper I was able to understand, how the points with order 2 and 4 were computed. My ...
0
votes
1answer
61 views

Using xor encryption in the following use case

I use an encryption scheme based on a symmetric cipher, with the corresponding symmetric key encrypted with RSA/OAEP using the public RSA key of the recipient. I now want to use ECC crypto in ...
1
vote
1answer
71 views

Find Consecutive X-Coordinate algorithm

The question is as follows: Is there an algorithm to calculate a $(x,y)$ pair which is consecutive to an existing $x$-Coordinate on an elliptic curve? Background Information for the curve: Known ...
4
votes
1answer
148 views

Diffie-Hellman: difficulty of computing $g^{x^2}$ given $g^x$?

Hoepfuly a simple question. Given a group where the CDH problem is hard, if the adversary sees a public key $g^x$, is it easy or hard for the adversary to compute $g^{x^2}$? My intuition says it ...
0
votes
0answers
40 views

Elliptic curve group inverse addition in OpenSSL

I am using group P-256 on OpenSSL with C++. My understanding was that, if you have a point $xP$ and then calculate (xP)^(-1) with EC_POINT_invert(group, xP_inv, ctx), then when I calculate: xP + (xP)^(...
1
vote
2answers
150 views

With RSA or ECC, if I encrypt my private key with my public key, is there a way to recover my private key?

Is there an algorithmic, mathematical, technical or implementation "hack" to recover the private key or is it definitively encrypted without any particular mathematical property, like any ...
1
vote
1answer
115 views

Is it possible to compute the y-coordinate of a point on SECP256K1, given only the x-coordinate

Given an x-coordiante of a point on the SECP256K1 curve, is it possible to calculate the corresponding y-coorindate? (Assuming the point is a verifying public key that complies with the Bitcoin ...

1
2 3 4 5
31