# Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

2,226 questions
Filter by
Sorted by
Tagged with
45 views

### Issues with Point Addition to the Identity Element in Elliptic Curve Point Multiplication Over Weierstrass Curve in Projective Coordinates

I am currently implementing Elliptic Curve (EC) point multiplication over a Weierstrass curve using projective coordinates. Specifically, I am trying to add a point $P$ to the identity element (...
90 views

### Recovering Public Key from ECDSA signature- why is it required at all?

I am looking at SEC 1: Elliptic Curve Cryptography 4.1.6 Public Key Recovery Operation Given an ECDSA signature $(r, s)$ and EC domain parameters, it is generally possible to determine the public ...
• 2,220
1 vote
93 views

### Playing safe when shortening up public key hashes

When using subtle crypto (in my case ECDSA/P-384), what exactly guarantees that a subset of the public key hash prefixed/suffixed with any symbol(s) would yield ...
70 views

### What does AZ^4 = -3 (mod p) mean in the context of elliptic curve cryptography?

In the documentation of TeraFire® cryptocore, the following statement is given (page 14): For For elliptic curves of the form y² = x³ + Ax + B, if there exists a solution to AZ^4 = -3 (mod p), then [....
32 views

### Using a public key's points (other than the generator point) to calculate the order of the group (SECP256k1)?

Imagine if we were on a mission to try to calculate the order of the cyclic group $n$ ...
56 views

### Elliptic curve addtion not working in some specific cases

I posted similar question on the StackOverflow (https://stackoverflow.com/questions/78828295/cuda-elliptic-curve-addtion-not-working-in-some-specific-cases) but it might be better suited here. I am ...
1 vote
32 views

### Is it a good idea to create ECDH private keys with HKDF of random data and shared secret?

I'm using ECDH (X25519 or X448) between two parties that already have a shared secret. Because of the shared secret, I don't need any public key signatures to prevent man-in-the-middle attacks, ...
• 1,613
197 views

### Given 3 points on a twisted edward curve, if I know 2 discrete logarithms, is it possible compute the third relation/discrete logarithm?

Simple beginner question : I have 3 non equal elliptic curve points $A,B,G$. I both know that $A=scalar1×G$ and $B=scalar2×G$. Given this relation, is it possible to compute the scalar/discrete ...
• 218
40 views

### How do I compute unified PADD on BLS12-377 using the twisted Edwards curve equations?

I'm learning ZKP these days and trying to write a program to calculate the results of point addition. I chose the BLS12-377 curve and started from the affine system. To make the situation simpler, I ...
• 21
1 vote
73 views

### in elliptic curve over finite field we get two values of y for each x now how can we draw elliptic curve using these points?

as we can see in the image one side elliptic is wrapping around torus in clockwise and other in anticlockwise direction my question is when we find two values of y for each x how can we know which y ...
1 vote
77 views

### Can attacker recover private key if he have history of intermediate elliptic curve point coordinates?

It is known that elliptic curves are used in public-key cryptography. Lets take for example secp256k1. Given private key $k$ and generator point $G$, we can get public key by performing elliptic curve ...
27 views

### Unable to verify ecDSA signature between cryptography libraries. BoncyCastle FIPS C# and System.Security.Cryptography

I've been looking to replace some cryptography services that use the standard .NET implementations to the BouncyCastle FIPS C# library. I've got RSA and PSS working but I'm struggling to understand an ...
• 1
170 views

### Can we use Super-Elliptic or Supersingular Elliptic Curves in Cryptography?

I am reading in literature articles and journals about Super Elliptic Curves and Super Singular Elliptic Curves such as this: https://arxiv.org/pdf/1906.02373 I have 2 questions: Do Super Elliptic ...
• 51
102 views

### Is MOV attack against ECDLP fundamentally impossible?

The main idea of the MOV attack is to map EC additive group of order $n$ to multiplicative group in the finite field extension $p^k$. For this, the groups must have the same order, what fully relies ...
1 vote
40 views

### Given powers of tau ; the veryfying and the proving key, how can I find the point [f] resulting from the trusted setup in Groth16?

For each circuits, Groth16 requires to compute a point $f$ such as $f=s×G$. While revealing the scalar $s$ used for computing $f$ would allow to produce fake proofs, $f$ can be exposed to the public. ...
• 218
1 vote
57 views

### Do Curve448 shared secret need to be hashed?

I am planning to implement key agreement in an application, and Curve25519 offers the right properties for 128-bit security (AES-128). In a question I previously asked (Can Curve25519 shared secret be ...
• 1,613
865 views

### Can Curve25519 shared secret be safely truncated to half its size?

I am planning to use a key agreement mechanism in an application needing ephemeral keys, and Curve25519 looks promising, specifically because it offers 128 bits of security, just fine for AES-128 ...
• 1,613
1 vote
131 views

### How to Generate Low-Order Generator Points on Elliptic Curves

How can one generate a 'Generator Point' on an elliptic curve that has an extremely low order. Take this Elliptic Curve from HTB Cyber Apocalypse 2024. The order of G is 11. How can one replicate this ...
1 vote
48 views

### How to modify a positive scalar in scalar multiplication in order to get the additive inverse on twisted Edwards curves?

I know this is something possible because of Pedersen Hash : when truncating the hash to keep only the X coordinate, is it possible to compute a collision when the Babyjubjub curve is used? ...
• 218
124 views

• 218
48 views

### Edwards curve example

I am looking to deepen my understanding of Edwards elliptic curves, specifically focusing on addition operations. Could anyone recommend books or websites that provide detailed examples with numerical ...
167 views

### Is it possible to abstract an ElGamal encryption for EC and Discrete Log by using a Group Law?

ElGamal encryption for Discrete Log is defined as: Bob side does: $Y\ =\ (g^x)\ mod\ P$, where $g$ - generator, $x$ - random value among the group elements and $P$ - prime number, typically ultra ...
• 77
1 vote
163 views

### DH Encrypt by XOR

I'm working in the Curve25519 domain (EC curve, 256-bit key size). I have a peer pubkey, and need to send it an encrypted message. For starters we create a "nonce" (ephemeral key), and use ...
• 359
182 views

### Given a random point on a curve defined over a prime field, is it possible to compute 2 different scalar that will lead to the same result?

Simple question : given a randomly selected point $P$ belonging on a given Edwards curve defined on a prime field, does 2 scalars $S1$ $S2$ exist such as : $packed(S1\cdot P)= packed(S2\cdot P$) (...
• 218
151 views

...
• 21
1 vote
80 views

### ECC multiplicative inverse problems while performing point division (multiplication with inverse multiplier of 2 )

I have been trying to understand the mathematics behind point multiplication. what i understand with ECC is that there is no division on ECC but multiplication, addition and negation. i recently ...
• 31
51 views

### Subtraction of inverse points in secp256k1

In pure math given: k = 10 l = -10 k + l = 0 k - l = 20 Now in secp256k1 $K = k*G$ $L = l*G$ $K+L = O$ $K-L = O$ Why do we get identity point on subtraction since: ...
• 13
1 vote
65 views

### Trusted code to test that a Bitcoin address corresponds to a certain private key

I apologise for asking a possibly trivial question. I am not much of a programmer and that's my problem. In an answer to another question about obtaining the Bitcoin address from a private key the ...
• 23.1k
1 vote
106 views

### Secp256k1 giving y-value for inverse of point

Given a secp256k1 point $P$ with scalar 3 where: $P = 3*G$ You get a point with co-ordinates: ...
• 13
17 views

### Safety per bit DHKA and ECDH

I have a project where I compare the classical Diffie Hellman key agreement with its implementation with elliptic curves. Therefore I need a list with the safety per bit. Does anyone know where I can ...
1 vote
102 views

### Is generating random blake256 hashes until packed points is on the curve, a safe algorithm to avoid the discrete log between the generated points?

I know there’re many questions that ask how to safely HashToCurve, but I want to know if the method I found in an actual implementation is secured against the ...
• 218
1 vote
87 views

### Scalars that are both Additive and Multiplicative inverses on secp256k1

I believe I have found two scalars (a) and (b) that are both additive and multiplicative inverses on the secp256k1 elliptic curve. So scalars (a) and (b) meet the following criteria: [𝑎+𝑏≡0 (mod 𝑛)]...
272 views

### Why we use specifically Jacobian Groups for HECC?

The following is stated in this answer on "What is so special about elliptic curves?": But for these curves, an excellent geometric rule does not exist to add points, like in conics and ...
• 51
1 vote
44 views

### Montgomery Powering Ladder for long weierstrass equations

My question is the following: I know that for elliptic curves in short weierstrass form, I have the following "one-coordinate addition" formula: Let $P = (x_p,y_p), Q = (x_q, y_q)$. If I am ...
• 111
73 views

### Getting the slope of a public key given its x and y coordinates

Is it possible to get the slope of a public key given its $x$ and $y$ coordinates? Since all the ECC calculations come from geometry, I thought this calculation might be possible.
67 views

### diffie hellman key exchange compared with ECDH [closed]

I have to write a paper about the Diffie Hellman key agreement. I want to focus on the implementation with elliptic curves and comparing the safety for selected attacks such as Pollards Rho and ...
1 vote
170 views

### Example of elliptic curves endomorphism construction

I've started learning about complex multiplication (CM) on elliptic curves. For clarity (and intuition), I want to make some basic example of elliptic curves endomorphism construction for a concrete ...
129 views

### Is the D = D1 + D2 of HECC the equivalent of the P + Q tangent-and-chord method as occurs in ECC?

I am reading about Hyper Elliptic Curve Cryptography here: https://en.wikipedia.org/wiki/Imaginary_hyperelliptic_curve#The_divisor_and_the_Jacobian In Elliptic Curve Cryptography we have the tangent-...
• 51
187 views

### Finite Fields and security level in HECC (Hyper Elliptic Curve Cryptography)

How to calculate the security level for HECC (Hyper Elliptic Curve Cryptography) genus = 2, 3, for a Finite Field of 128-bits or 256-bits or 512-bits, by following the below rationale of the ECC here: ...
• 51
1 vote
159 views

### What’s the fastest known Koblitz curve addition law for FPGA that maximizes the per-LUT throughput?

The addition or multiplication laws used by large mainstream libraries achieve faster speed by using many many more operations in order to avoid larger numbers. And my problem is here: faster speeds ...
• 218
42 views

### SDLog - looking for papers

Reading trough SEC 1 V2.0 in txe appendices there is a mention of a elliptic curve semi logarithm (ECSLP) being used to forge ECDSA signatures. I am looking for papers on that problem and have been ...
1 vote
121 views

### Is it safe to reuse the same scalar when doing direct scalar multiplication on Koblitz curves?

Let $s$ be a private key and $k=intAsScalar(s)$. Finding $s$ from $P_k=[k]G$ involves solving the Elliptic curves discrete logarithm problem. But what if the same $k$ is also used for performing 1 or ...
• 218
185 views

### Questions related to Hyper Elliptic Curve Cryptography

I have read the wikipedia section related to HECC (Hyper Elliptic Curve Cryptography) and various questions opened in the current Cryptography Stackexchange site. But I need some help on the following ...
• 51
184 views

### can we modify the prime field by increasing it in secp256k1?

If in ECDSA secp256k1 we have the prime field p=2256 - 232 - 29 - 28 - 27 - 26 - 24 - 1, can we increase it to p=2256, if we keep the double and add operations the same, the curve equation the same ...
849 views

### CVE-2024-31497, nonces and random numbers: Can someone explain, please?

Regarding CVE-2024-31497 a German article "Nur NIST P-521 betroffen: PuTTY-Lücke kompromittiert private SSH-Schlüssel" wrote something about a vulnerability in PuTTY. The issue was claimed ...
• 229
1 vote