Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

0
votes
0answers
3 views

E2EE for an app, question on protocol implementation

I have fair bit google'd some protocols and learned its not best to implement your own protocol. I am afraid of some backlash but, I have been developing an app which at first is not encrypted. i.e: i ...
2
votes
1answer
42 views

Elliptic curve as a product of 3 cyclic groups possible?

I'm looking for some kind of 3-dimensional Elliptic curve. As far as I know a normal Elliptic curve like $$y^2 = x^3 + ax + b$$ over $F_p$ consists of one or two cyclic groups $Z_m (\times Z_n)$. ...
2
votes
1answer
43 views

Elliptic curves on finite fields

I've been reading: https://github.com/bellaj/Blockchain/blob/6bffb47afae6a2a70903a26d215484cf8ff03859/ecdsa_bitcoin.pdf On page 22 it shows an eliptic curve over F17. I have added the orange lines ...
5
votes
1answer
146 views
+100

Proving that the least significant bit of an elliptic curve discrete logarithm is $0$

Suppose I have a secret value $a$ which maps to a public point on an elliptic curve $A = a \cdot G$, where $G$ is a generator of the elliptic curve of primer order $q$. Can I prove to someone that ...
0
votes
0answers
46 views

Sharing secret content with multiple recipients

I have a sender and N recipients, and am thinking of using the following scheme to send secret content to those recipients. This is similar context to a group chat or email. I am no expert in crypto ...
1
vote
1answer
75 views

What is the difference between subtracting the modulus from a scalar field element and reducing it?

When implementing a Field element, we define the necessary operations on the data structure. One function that I see is a "scalar reduce" function, which effectively reduces a random scalar so that ...
-1
votes
0answers
48 views
2
votes
2answers
96 views

How to model a miniature elliptic curve?

For educational purposes I would need to work on an elliptic curve that has a small field, but holds the safety futures of a real curve. Is that possible to have such a curve!? For example for the ...
0
votes
1answer
56 views

Why only non-prime order fields have small subgroup attacks?

Why don't prime-order curves have small subgroup attacks? It seems that I can choose a Generator such that it has a small order, maybe 2 points, and so an attack could generate all of the points in ...
7
votes
2answers
398 views

Should we use IANA groups 14 (MODP), 25, and 26 (ECP)?

By looking at SonicWall Knowledge Base article Key exchange (DH) Groups Supported - Site to Site VPN: It appears that our firewall supports DH group 25, and 26. Almost everywhere I've seen, they've ...
2
votes
1answer
62 views

Prove I know a value $v$ in a Pedersen Commitment without revealing it

Given a Pedersen Commitment: $P = aG + vH$ Where $G$ and $H$ are points in some group. $a$ is a blinding value/mask and $v$ is the value I wish to commit to. Is there a way to prove I know $v$ ...
-1
votes
1answer
54 views

How does Diffie Hellman protocol work in Bitcoin Blockchain Transactions?

Greetings to all! Please explain how the Diffie-Hellman protocol works in Bitcoin? That is, in Blockchain Transactions, there is also a total number of "K" recipient and sender? "K" the recipient and ...
1
vote
1answer
38 views

What type of curves have co-factors?

I read that non-primes only have co-factors, but Edwards have a co-factor and it is defined over Fp s.t. P = 2^255 -19 which is prime right? How is the co-factor created, some have co-factor 4 and ...
2
votes
1answer
45 views

In ECC scalar multiplication, how do `add(Q, Q)` exceptions occur?

Consider some scalar multiplication algorithm for a prime order (Weierstrass) curve $E$ with order $\ell$. Bernstein and Lange's SafeCurves: Completeness page mentions: The problem is that the ...
1
vote
1answer
40 views

For an elliptic curve, what is the difference between the base field modulus $Q$ and subgroup $r$

What is the difference between the basefield modulus $Q$ and a subgroup of prime order $r$? They are all fields, but what is their relevance to the curve they are defined upon? How does this relate ...
0
votes
0answers
9 views

Are compressed pairings used for Barreto-Naehrig curves in practice?

In 2009 Galbraith and Lin wrote the article "Computing Pairings Using x-Coordinates Only" https://link.springer.com/article/10.1007/s10623-008-9233-3, where they proposed to compute pairings on ...
9
votes
2answers
787 views

Is it safe to reuse ECDH asymmetric keys for authentication?

Alice, Bob, and Carol each generate ECDH keypairs. Alice and Bob establish a communication channel and negotiate an AliceBob secret. The question is: Is it safe for Alice and/or Bob to reuse their ...
0
votes
0answers
22 views

What books should I read as an introduction to elliptic curves? [closed]

Current Knowledge: Studied Set theory in computer science Basic undergraduate mathematics Basic understanding of Fields and Number theory. Goal: To be able to code Elliptic curves from scratch, ...
6
votes
1answer
189 views

Point halving on elliptic curves of even order

I am trying to understand how point halving on elliptic curves of even order works. Specifically: suppose $g$ is an elliptic curve, and $G$ is a generator point on this curve. The order of group ...
0
votes
1answer
71 views

Problem on Elliptic Curve Point Doubling

Given an elliptical curve e.g. from “Understanding Cryptography” by Parr & Pelzl §9.2 Example 9.5: $y^2 = x^3 + 2x + 2~~~~ mod~17$ And given a primitive $P = (5, 1)$, the book indicates: We ...
2
votes
2answers
767 views

Point addition in NaCl/libsodium (Curve25519)

In NaCl and libsodium, the crypto_scalarmult function implements the operation $Q = kP$ (scalar/point multiplication). There doesn't seem to be a function for point ...
1
vote
1answer
57 views

Authentication protocol for communication with Arduino Uno

I am using an ECDH key exchange to establish a shared secret between an Arduino Uno and an Android device. For this purpose I am using this library and more specifically Curve25519. This is the ...
2
votes
1answer
42 views

Embedding POW in an EC public key

I have an application where it would be advantageous for an attacker to have to spend a long time generating public keys. To do this, I require that the hash of the public key be less than a certain ...
2
votes
1answer
97 views

What is the point at infinity on secp256k1 and how to calculate it?

I hear that there should be a point at infinity on secp256k1. I wounder how to calculate it and what does it even mean. I tried to calculate it as $P_{inf}=P+(-P)$ but this gives different results for ...
8
votes
2answers
513 views

Geometric interpretation of an Edwards curve

Addition on an elliptic curve in Weierstrass form (over the rationals) is typically depicted with the following figure: (Image CC SA 3.0 https://en.wikipedia.org/wiki/File:ECClines.svg) To add two ...
2
votes
1answer
57 views

How to compare the order of elements in cyclic groups?

In a cyclic group with randomly looking behavior like the one used in secp256k1, is there any known efficient algorithm to compare the order of two randomly given elements $P_1$ and $P_2$ and find out ...
5
votes
1answer
105 views

Are EC public key values evenly distributed?

At my Day Job(tm) we've encountered a bug wherein if the leading digit of the X or Y value of a public key are zero, "shit happens" (this bug is in our code - I'm not suggesting there's some problem ...
4
votes
1answer
60 views

Does Elliptic Curve Integrated Encryption Scheme (ECIES) provide IND-CCA2 security?

I am looking for a faster alternative to RSA with OAEP as a IND-CCA2 public key scheme. Elliptic Curve Integrated Encryption Scheme might be a candidate, but I am not sure if it provides IND-CCA2 ...
6
votes
1answer
102 views

Why would the use of Curve25519 in Dragonfly leak information?

An answer explaining Dragonfly, a form of key exchange used in WPA3, has an interesting footnote: One final note: reviewing the Firefly RFC, I see that it would (as written) leak some information ...
1
vote
1answer
73 views

Could the reversibility of adding function be considered a weakness to secp256k1?

I have just started studying cryptography and secp256k1. I just wonder that adding two points can be easily reversible when the generator point is publicly known. I mean that if $Q=\operatorname{...
5
votes
4answers
970 views

Elliptic curves in Edwards form (or Edwards curve) and addition formulas

In recent studies on elliptic curve cryptography, Edwards curves are remarkable examples on this field. Studies show that this kind of elliptic curves provide faster computation compared to ...
0
votes
0answers
28 views

What is connection between curve used for ec_keypair generation and ClientHello extension?

Im currently experimenting setting up my first SSL server and don't understand the following scenario: My server has a generated ECC keypair with group identifier $A$ (e.g Brainpool256r1). During TLS ...
2
votes
1answer
57 views

Why SM2 ECC parameters does not specify cofactor h?

Recently I've been studying the ECC with the Chinese SM2 standard. One question is on standard part 5, parameters definition, it only defines $p, a, b, n, XG,$ and $YG$, but not cofactor $h$. I found ...
2
votes
0answers
61 views

Proving that a point on elliptic curve is smaller than half of group's order

Let's say I have an elliptic curve where generator $G_1$ has prime order $q$. Let's also say I have committed to a point $A_1 = a \cdot G_1$. Could I use the scheme below to prove that $a < \frac{q}...
1
vote
0answers
44 views

Is it necessary to transmit two or three points of an elliptic curve?

Are there cryptographic protocols, where a party should transmit by communication channel simultaneously two or three $\mathbb{F}_q$-points of an elliptic curve over a finite field $\mathbb{F}_q$? ...
2
votes
1answer
87 views

Proving that two points on elliptic curve are within range

Is it possible to prove that a point on an elliptic curve falls within a given range of another point, without revealing the distance between them. For example: Let's say $X$ and $Y$ are two points ...
2
votes
2answers
50 views

Please explain parameters of RFC5639 Elliptic Curves including brainpoolP160r1

RFC 5639 brainpoolP160r1 has p = E95E4A5F737059DC60DFC7AD95B3D8139515620F (Wolfram Alpha says prime) ...
0
votes
2answers
68 views

Does this pairing-based signature scheme work?

Suppose $g$ is a pairing-friendly elliptic curve with subgroup generators $G_1$ and $G_2$. Suppose also that $M$ is the message I want to sign. Setup Compute $A = a \cdot G_1$ and $P = p \cdot G_2$, ...
0
votes
1answer
155 views

How to send a secure public message using elliptic curve?

With ECDSA signature anyone can be sure if I own the private key or not without revealing it... But if I have a website, and the users want to send me a secret message with this website using the ...
0
votes
0answers
49 views

Password recovery on Block-chain ( Hyperledger sawtooth in this case)

I am using bip39 specifications for 24-word mnemonic, Whenever user registers with his/her password, A Scrypt key is generated from this password and used to encrypt this mnemonic, The admin of the ...
2
votes
0answers
44 views

Proving key equivalence across different elliptic curves

We can use the technique described in this answer to prove key equivalence across two elliptic curves of different order. I'm wondering if modifying the technique as described below would compromise ...
1
vote
1answer
82 views

What is the recommended minimum key length for ECDSA signature

I want to identify the proportion of certificates that use unrecommend ECDSA key length for TLS certificates based on some data I collected. By looking at a standard like NIST for example, I find ...
2
votes
1answer
61 views

Does this simple signature scheme work?

Let's say my public key is defined as $P = p \cdot G$, where $p$ is my private key and $G$ is a generator point of an elliptic curve. If I wanted to sign a message $m$, could I do the following? Hash ...
1
vote
1answer
316 views

What is customizable in ECDSA signature and verification?

Let's say I make a signing and verification ECDSA modules. Signing module receives plain message and outputs signed message. Verification module takes signed message and checks consistency. ...
2
votes
2answers
58 views

Rational exponents on group generators

In elementary concepts, mostly scalar exponents shows up in group operations: $g^x$ As one may encounter in more advanced papers, there are rational exponents over generators. Simply seems like: $g^...
1
vote
1answer
44 views

Can a TLS certificate using ECC secp384r1 as PK algorithm uses RSA for signature

If a TLS certificate public-key algorithm is ECC secp384r1 or ECC prime256v1, is it possible to have RSA as a signature ...
2
votes
1answer
65 views

Can we use PHE or SWHE instead of bilinear pairings in ZK-SNARKS?

In ZK Snarks bilinear pairings are used to do "encrypted computation". I was wondering if we can use Partial Homomorphic Encryption or Somewhat Homomorphic Encryption instead of bilinear pairings. Can ...
3
votes
1answer
114 views

Do I need to provide entropy to secp256k1_ecdsa_sign() ?

using secp256k1_ecdsa_sign() I noticed the same data signed multiple times, coming back with the same signature. I always thought that signatures are different because random data is somehow involved....
2
votes
2answers
83 views

Is it secure to encrypt a 1 GB data file with AES-CTR by ECIES?

I have a file system with share resources over the network (like a shared FTP) Is it possible to use the client's ECC public key to encrypt the AES key, and then use the AES in CRT mode for the file ...
5
votes
1answer
1k views

inverse problem about scalar multiplication on elliptic curve

Let $E$ be an elliptic curve over a finite field $F_p$. Given $n$ be a positive integer and $Q$ be a point on $E$, assume that $Q=nP$, how can we find this $P$? We can assume that $n|p-1$. If $n$ is "...