Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

Filter by
Sorted by
Tagged with
2
votes
0answers
22 views

Why do Edwards curves protect against side-channel attacks?

From Wikipedia: One of the attractive feature of the Edwards Addition law is that it is strongly unified i.e. it can also be used to double a point, simplifying protection against side-channel ...
2
votes
1answer
169 views

Representations of secret keys on Curve25519

https://tools.ietf.org/html/draft-josefsson-tls-curve25519-06#appendix-A.2 gives the following as a secret key / public key combo: ...
3
votes
1answer
130 views

ECDSA signing process

I am trying to learn how ECDSA works. I do not have a background in maths, but have been following a guide which has built me up from finite fields, elliptic curves. I am unable to figure out how a ...
0
votes
0answers
11 views

How to implement bn254 using libpbc library? [on hold]

all: I'm implementing pairing based cryptography using libpbc. In libpbc, the parameters setting are as follows: ...
1
vote
1answer
73 views

Can the RSA accumulator scheme be converted to Elliptic Curve math?

Is it possible to translate the RSA accumulator scheme directly to EC without requiring bilinear pairings? In RSA we have: $A_{n+1} = A_n^c$ st. $\{c \: \textrm{prime} \: | \: c \in [\...
1
vote
1answer
53 views

Secure Communication

Focus: I have to design a secure keep alive communication protocol and was wondering if it was necessary to sign the ciphertext after the session key has been generated as an attacker will not know ...
0
votes
1answer
104 views

The Secp256k1 curve is used in cryptocurrency. Can someone generate a private key with a different curve?

Many cryptocurrencies use Secp256k1. Every cryptocurrency library comes with its own redundant implementation of Secp256k1, ECDSA, RIPEMD160, and SHA256. So, there can be some inconsistencies across ...
1
vote
1answer
53 views

Computational Complexity: ECC multiplication vs Modular multiplication

How does performing scalar multiplication on an elliptic curve compare to exponentiation in a multiplicative group modulo a prime? I.e. on a given elliptic curve of size $|t|$, what's the complexity ...
6
votes
0answers
191 views

Is it safe to reuse a ECDSA nonce for two signatures if the public keys are different?

We denote the s value of an ECDSA signature $(r, s)$ on a message $m$ as: $s=\frac{H(m)+xr}{k}$ Assume two ECDSA signatures sharing the same nonce $(r, s_1) , (r, s_2)$ on two messages $m_1, m_2$, ...
13
votes
3answers
4k views

How effective is quantum computing against elliptic curve cryptography?

I've been reading the Wikipedia page on Elliptic-Curve Cryptography and I came across the following. in August 2015, the NSA announced that it plans to replace Suite B with a new cipher suite due ...
0
votes
2answers
310 views

How can I send a secure public message using ECC? [closed]

I want to know how to send a secure message protected with elliptic curve private and public keys.
0
votes
0answers
39 views

Difficulty of Reversing Elliptic Curve

In ECC, it is apparently easy to verify the final point given the starting point and the number of hops. But it is difficult to compute the number of hops given just the starting point and the final ...
9
votes
1answer
1k views

Why are co-factors 4 and 8 so popular when co-factor is more than one?

For elliptic curve cryptography, I seem to keep coming across curves with either co-factors of 4 or 8 whenever it is a non-prime order group. Is this a co-incidence? Have we studied ECC for curves ...
1
vote
1answer
28 views

formulas for adding points on curve25519

Curve25519 is a Montgomery curve. https://hyperelliptic.org/EFD/g1p/auto-montgom-xz.html#diffadd-dadd-1987-m-3 gives a set of formulas for adding two points (well, more specifically, the X coordinate ...
2
votes
1answer
45 views

Why does Ed25519 scalar multiplication allow values larger than the subgroup order?

The GeScalarMultBase function is documented like so. From the way it is documented we see that it expects a little-endian value and has a precondition that constrains the range it accepts. ...
3
votes
0answers
66 views

Check validity of generated parameters for SIDH

In section 4.1 of the paper Towards Quantum-Resistant Cryptosystems From Supersingular Elliptic Curve Isogenies by Feo, Jao and Plût it is described how you generate valid parameters for the SIDH ...
2
votes
1answer
71 views

The protocol of provisioning shared key to multiple devices?

I have a bunch of IoT devices which can do ECDH/ECDSA and AES. They all are connected to some server and know its public key. In turn, server knows each public key of the corresponding device. Devices ...
0
votes
0answers
3 views

ECDH online tool recommendation [migrated]

Does anyone know some good online calculator or tool that can do a ECDH key agreement cross-check? I want to using the same test vector to do cross-check test with my code. I find this on-line tool ...
1
vote
1answer
185 views

Zero-knowledge transfer of value protocol II [closed]

This is an improvement of the protocol described here. The protocol does not require trusted setup and is very efficient (much more efficient than anything else I could find). The protocol allows the ...
-4
votes
0answers
29 views

Which company use RSA, ElGamal, DSA, ECDSA digital signature [closed]

I need a list of companies, for example in my BSc, that use one of those digital signatures: RSA digital signature, ElGamal digital signature, DSA digital signature, ECDSA digital signature.
0
votes
1answer
46 views

Get points of an Elliptic Curve defined over a Finite Field on Twisted Edwards Extended Coordinates

I'm working on a crypto library, and I need to perform some tests for the implementation of: Point Addition. Point Subtraction. Point Doubling. Scalar Mul Point. The operations are performed on ...
6
votes
5answers
1k views

Elliptic curves in Edwards form (or Edwards curve) and addition formulas

In recent studies on elliptic curve cryptography, Edwards curves are remarkable examples on this field. Studies show that this kind of elliptic curves provide faster computation compared to ...
1
vote
1answer
71 views

curve25519 by openSSL

How can i generate ec curve25519 keys using openSSL? When I run openssl ecparam -name curve25519 -genkey -noout -out private.ec.key I have this message ...
1
vote
1answer
34 views

Does any problem arise when the order of an elliptic curve is equal to its prime field modulus? [duplicate]

Regarding cryptographic schemes in elliptic curve cryptography, is there a problem with having the order of an elliptic curve being equal to its prime field modulus? That is, an elliptic curve where $...
0
votes
0answers
24 views

What is the cryptography involved in the initial setup of a cryptocurrency?

I keep hearing that when a cryptocurrency is created it goes through an initial setup phase wherein cryptographic parameters are created that are used by the cryptocurrency network throughout its ...
0
votes
0answers
45 views

Modifying Elliptic Curve Parameters

For context, I was watching this bit of the video: which goes over this source code. The piece is about elliptic curve cryptography and how it works. I want to use some of this knowledge to make my ...
2
votes
1answer
126 views

Testing PRNG quality from ECC public keys?

Having a large set of ECC public keys $P_i = n_iB$ on a fixed curve $E$ over a prime field, is there a way to determine if coefficients $n_i$ were generated using a bad PRNG? In other words, can a ...
0
votes
0answers
32 views

The ECC private key is generated with 0x00 at the beginning.(prefix)

I created a private key using the prime256v1 curve. My purpose is to get a 32 byte private key. However, the private key is preceded by 0x00, resulting in 33 bytes. Why is this happening? The only ...
9
votes
2answers
11k views

How does Diffie–Hellman differ from elliptic curve Diffie–Hellman?

I didn't understand how ECDH actually works. Disclaimer: I know very little about elliptic curves. Here is how DH works: Alice and Bob agree on a prime number $P$ and a generator $G$. (They use one ...
0
votes
0answers
24 views

How to get a random point of a specific EC group with cofactor Not-Equal 1?

We got a EC group generated with point G, and the cofactor of E(G) is with the similar size of the Order. Now we need a random point of E(G) and not revealing the "logarithm" of the random point, so ...
2
votes
1answer
74 views

Are there any security risks in using Elliptic Curves defined over fields $\mathbf{F}_{p^n}$ where $n>1$

I've recently been studying elliptic curves, and I've found that most of the current implementations use fields $\mathbf{Z_p}$ or in some cases $\mathbf{F}_{2^n}$. All the reasons I've seen for not ...
1
vote
1answer
39 views

Replacing elliptic curve diffie-hellman primitive with elliptic curve cofactor diffie-hellman for specifc curves?

From what I've read about elliptic curve Diffie-hellman with and without cofactor (I am pretty new to the whole thing so I am not able to understand everything) is that when the cofactor of the curve $...
0
votes
1answer
329 views

Half of any bitcoin (crypto) public key - (public key half) is possible

I found a topic on bitcointalk Public key x and y == Double(Half of the Public key x and y) half any public key is possible how that possible , in crypto there is subtraction and multiplication ...
0
votes
1answer
57 views

Why does Hasse's theorem sometimes seem to be invalid?

In order to generate secure elliptic curves, this answer recommends to Calculate the cardinal $|E(\mathbb{F}_p)|$ Check this cardinal is in the hasse interval (with $p$ prime) and to ...
4
votes
1answer
99 views

Elliptic Curve Cryptography insecure when input does not lie on the curve?

I am new to Elliptic Curve Cryptography and I was reading up on it online when I came across this link. It stated the following. Unfortunately, there is a gap between ECDLP difficulty and ECC ...
0
votes
1answer
34 views

Reasoning about WebCrypto ECDSA choices: P-256/384/521, SHA-1/256/384/512?

When implementing EC signing/verification in Javascript, the only options available via the WebCrypto API are: Curves: P-256, P-384, or P-521 Hashes: SHA-1, SHA-256, SHA-384, or SHA-512 If I was ...
0
votes
1answer
47 views

Question regarding of the ECC test vector format

I am trying to find some ECC test vector for using. I just find some post (like this) and github resource (like this ) They are good reference to my C test code but I'd like to get some more advice... ...
3
votes
1answer
539 views

How are Elliptic Curve private and public keys actually used to encrypt or sign data?

I've read article after article about curve parameters, generator points, the dot operation, and how you dot the generator point priv times to get the ...
0
votes
2answers
50 views

Diffie-Hellman Primitives in SP800-56A

I wonder if someone can give an explain about the different between two Diffie-Hellman Primitives defined in SP800-56A, CH5.7.1 5.7.1.1 Finite Field Cryptography Diffie-Hellman (FFC DH) Primitive 5.7....
1
vote
1answer
51 views

Valid private keys on curve25519

Given that valid private keys on curve25519 must be less than the order of the curve which is (as I understand) already smaller than 2^256, AND a valid key must be clamped to be divisible by 8 and ...
7
votes
4answers
2k views

Is Elliptic Curve Diffie-Hellman (ECDH) still secure if I use the public key more than one time?

Elliptic Curve Diffie-Hellman (ECDH) with Public parameters: Ep (a,b) and G = (x, y) Private Keys: ...
3
votes
1answer
50 views

Is inversion always cheap with Twisted Edwards curves?

I'm reading on Jubjub, which is planned for the next upgrade of Zcash. It is based on a Twisted Edwards curve with parameters $a = -1$ and $d = −(10240/10241)$. The reading says Jubjub does not need ...
3
votes
1answer
106 views

What makes lattice-based cryptography quantum-resistant?

As opposed to RSA or elliptic curve cryptography?
1
vote
2answers
58 views

Complexity of number field sieve theorem does not match with security of elliptic curves

Number field sieve algorithm can is used to break discrete logarithm on field $F_{p^n}$. The algorithm has time complexity $\exp((c+o(1))\cdot(\log p^n)^{1/3}\cdot(\log \log p^n)^{2/3}$. Originally ...
1
vote
2answers
107 views

Invalid curve attack: finding low order points

Background Here's a description of page 182 of "Guide to Elliptic Curve Cryptography" by Hankerson, Menezes and Vanstone. Here's a quote from that page: The main observation in invalid-curve ...
6
votes
1answer
2k views

Complete Set of Test-Vectors for ECDSA secp256k1

Although there are several implementations of ECDSA secp256k1 public available over the internet (the most popular being OpenSSL), it seems that there are no complete set of test-vectors available. ...
9
votes
2answers
5k views

Are there any Secp256k1 ECDSA test examples available?

Are there any available test cases for testing elliptic curves like secp256k1 (Korblitz curves from http://www.secg.org/collateral/sec2_final.pdf)? For curves like P192 there are for example those ...
-2
votes
1answer
35 views

Given a point $c$ in a field $Z_p$. Can we get another value $c^{'}$ such that $\left(c^{\prime}-c\right)$ is invertible in $Z_p$?

If we have a point in a field $c$. Can we get another value $c^{'}$ such that $\left(c^{\prime}-c\right)$ is invertible in $Z_p$ ?
0
votes
1answer
1k views

Understanding elliptic curve point addition over a finite field

I am new to elliptic curve cryptography as well as finite field theory. I am trying to understand point addition in affine coordinates. I understand, that for an elliptic curve $ y^{2}=x^{3}+ax+b $ ...
0
votes
0answers
23 views

Key Value Based Key Derivation

For a system that is using public key cryptography to authenticate users and their actions I'm trying to solve (ease) UI/UX problem so that users will be able to use login/passwords they're accustomed ...