Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

0
votes
1answer
60 views

How do you perform the invert operation of Pm = kP on elliptic curve?

I'm stuck on this, may be due to the fact I'm missing something. If I'm right, in order to reduce a Message to a point on an elliptic curve the operation is: $\text{MsgPoint} = \text{msg}\cdot P$ ...
0
votes
1answer
71 views

Problem on Elliptic Curve Point Doubling

Given an elliptical curve e.g. from “Understanding Cryptography” by Parr & Pelzl §9.2 Example 9.5: $y^2 = x^3 + 2x + 2~~~~ mod~17$ And given a primitive $P = (5, 1)$, the book indicates: We ...
5
votes
0answers
54 views

Parity of the order of a element

Given an element $g$ in a cyclic group $G$ of known order $m$ its easy to test if $m$ has even or odd order. In other words $\textrm{ord}(g) \pmod 2$ can be computed easily. In some cases where the ...
0
votes
2answers
121 views

A private key with multiple public keys?

I'm trying to design a wallet, where any number of public keys can be handed out. Say Alice hands out the public keys to receive messages. She doesn't want others to be able to link all of the public ...
0
votes
1answer
59 views

Multiplication and squaring the binary polynomials

I have tried to calculate $trace$ of a coordinate $X$ of EC in binary representation. Before that I tried to pre-calculate traces of the various bits of $X$ using formula: $$Tr(X) = Tr(\sum_{i = 0}^{...
2
votes
0answers
76 views

j-invariant of an elliptic curve

Given an elliptic curve $(E/\mathbb{K})$ where $char(\mathbb{K}) \ne 2,3$ defined by the Weierstrass equation $y^2=x^3+ax+b$. The $j$-invariant is $j=1728 \frac{4a^3}{4a^3+27b^2}$. I want to ...
2
votes
2answers
50 views

Please explain parameters of RFC5639 Elliptic Curves including brainpoolP160r1

RFC 5639 brainpoolP160r1 has p = E95E4A5F737059DC60DFC7AD95B3D8139515620F (Wolfram Alpha says prime) ...
0
votes
0answers
61 views

Size of group for Elliptic curves vs RSA for equal security

For my research, I would like to compare the efficiency of a scheme when instantiated with Elliptic curves and RSA. So, I would like to know a "latest" comparison (as of 2018) on what group sizes of ...
1
vote
1answer
91 views

How to encrypt plain-text message using Diffie-Hellman algorithm

Let's say bob says Hi and Alice says Hello, With the knowledge of n and ...
1
vote
1answer
40 views

How to calculate end point from private key in elliptic curve cryptography

The drawing of lines on the elliptic curve is repeated n times, where n is your private key, resulting in a point Ω. When calculating Ω, is there a short cut function that lets you skip having to ...
5
votes
1answer
106 views

Intersection of two elliptic curves

Is it possible to find points that are on two elliptic curves, and how? More precisely, I'm looking for coordinates $(x,y)$ that satisfy the defining equations of two elliptic curves on prime fields $...
1
vote
0answers
39 views

Can I use NaCl's scalar multiplication functions for Diffie Hellman Key Agreement?

I want to create some software that performs diffie hellman group key agreement but I don't want to reinvent the wheel even if I know how it's done. So I came accross the NaCl library, especially the <...
3
votes
3answers
84 views

Choosing asymmetric pairing for Elliptic Curves

I'm trying to implement a Provable Data Posession protocol using elliptic curves, but am stuck at the $\text{KeyGen}$ phase of choosing a subgroup $G_2$. Here's an excerpt of it. On input $\mathcal{...
1
vote
1answer
46 views

Need help understanding public key format of Barreto-Naehrig signature

I have a 256bit signature and a certificate with a public key to verify it. I had little information about the signature scheme used, but I know now that it's "ECBNwithSHA256". I have never come ...
1
vote
1answer
56 views

Authentication protocol for communication with Arduino Uno

I am using an ECDH key exchange to establish a shared secret between an Arduino Uno and an Android device. For this purpose I am using this library and more specifically Curve25519. This is the ...
5
votes
1answer
133 views

Is ECDSA obsolete/deprecated?

I have been reading about recommendations on the correct use of crypto as a developer and I read at least two references to the obsolescence (so to say) of ECDSA. https://paragonie.com/blog/2015/08/...
6
votes
2answers
278 views

Curve 25519 (X25519, Ed25519) Convert coordinates between Montgomery curve and twisted Edwards curve

I have some misunderstanding about EdDSA conversion coordinates between Montgomery curve and twisted Edwards curve. In https://tools.ietf.org/html/rfc7748 I see that a base point for Curve25519 is ...
2
votes
1answer
69 views

Decoding a message on elliptic curve

Let's say I have an elliptic curve $E$ $y^2=x^3 + 486662x^2 + x$ over a prime field $GF(2^{255} - 19)$. My algorithm for computing $E(m)$ is as follows: I take the bits 1 through 32 of the message ...
1
vote
1answer
61 views

mapping point on elliptic curve

good evening guys, let us suppose that elliptic curve is given by the following equation $y^2=x^3-x+1 \pmod {127}$ on the following table message $9$ is converted to the point on curve if i ...
1
vote
0answers
63 views

Security of BLS under additional information on the secret key

Question A Is the BLS signature scheme still secure if an adversary in addition to the public key $ pk = g_2 \, sk \in \mathbb{G}_2 $ also obtains additional information on the private key $ sk $, ...
1
vote
0answers
47 views

HW wallet and multisignaters in ECC

I need to design a system where there is a secure device (a.k.a. HW wallet), with the following functionality: Deterministic key generation for key parameters (speaking simply: key ID). Never expose/...
1
vote
1answer
80 views

How Elliptic-Curve affects the Server Key Exchange parameters

In Finite Field DHE, the server sends the following parameters in the server key exchange message: $p$: prime $g$: group $g^b$: the server's public DH key In DHE_RSA (non anonymous DHE), the server ...
2
votes
1answer
54 views

Usefulness of OAEP with ECC

Does OAEP make sense for use in an ECC ElGamal cryptosystem? The way I see it, OAEP makes questionable sense even for RSA because even though it's a "all or nothing" transformation, many RSA ...
0
votes
1answer
31 views

Given paramaters of an Edward's curve and x, determine a y value if it exists

I'm making a demonstration cryptosystem using ECC ElGamal. I've currently got a working implementation of Edward's Curve operations and a basic ElGamal implementation (Encrypts only points on the ...
3
votes
1answer
113 views

How to securely map messages to points on an elliptic curve

I'm implementing a demonstration hybrid cryptosystem in Python (FinCrypt, I know the name is bad) and I'm migrating over from my Weierstrass curve implementation, which was based off of this, to one ...
-1
votes
1answer
63 views

How to use public/private keys in elliptic curve cryptography to encrypt/decrypt information

I'm reading a bit about elliptical curve cryptography. The basic idea is to define a dot-operator on the points of an elliptic curve. Given a starting point $P$, and applying this dot-operation $n$ ...
1
vote
0answers
57 views

Hashing into a supersingular elliptic curve

Is there any way to hash from a string $\in \{0,1\}^{*}$ into a supersingular elliptic curve $E(F_p)$ such that the hash function behaves(provably) like a random oracle, and is efficient? Using ...
2
votes
1answer
107 views

Restoring a point on an elliptic curve

I received a representation of a point on an elliptic curve $GF(2^m)$ (with curve coefficient A, B) in specific format and some description how to decode it but not all is clear to me. I would be ...
1
vote
2answers
94 views

How to calculate Trace function for a point on an elliptic curve

I encountered trouble with calculating Tr (trace function) for points on an elliptic curve in polynomial basis ( $GF(2^m), m = 431$). Maybe there are any assumptions that can simplify and allow ...
2
votes
1answer
51 views

Are the following asymmetric encryption schemes equivalent?

Consider the scenario where you want a machine to be able to send daily encrypted backups to a storage server. You'd prefer to not use simply a symmetric key for encryption, because if the machine ...
0
votes
1answer
130 views

What math should I learn to get in depth with Elliptic Curve Cryptography research?

My background is computer scientist. I have done applied cryptography research for a while. Currently, I'm working on Elliptic curve cryptography. To understand the idea and how to use Elliptic curve ...
0
votes
2answers
81 views

ecdsa where the group order is larger than the hash size?

According to wikipedia, when generating a signature for ECDSA, you do the following (among other things): Calculate $e=HASH(m)$, where $HASH$ is a cryptographic hash function, such as SHA-2. ...
1
vote
0answers
32 views

How to prove two ECDSA public keys on two different curves are generated from the same private key [duplicate]

I wonder if I provide someone with two public keys from different elliptic curves, is there any way to prove that these two public keys are generated from the same private key without revealing the ...
1
vote
1answer
51 views

what is the order for the brainpool twisted curves?

Per What is the difference between regular and "twisted" ECC curves? I guess the brainpool twisted curves and the brainpool regular curves use the same point addition and point doubling ...
0
votes
2answers
68 views

Do I need to know the curve for ECIES decryption?

Let's assume that I have key pair generated using the following curves: brainpoolP256r1, brainpoolP320r1, brainpoolP384r1 or brainpoolP512r1. Do I need information which curve was used to decrypt ...
1
vote
0answers
40 views

What does the absence of Abelian group actions on supersingular isogenies implicate?

There are no Abelian group actions on supersingular isogenies. Why does this make them secure? - motivated by De Feo's Paper on mathematics of IBS
3
votes
1answer
142 views

How are isogeny graphs made and how are they helpful to crypto?

I don't understand how the shapes of isogeny graphs are determined. While Alice and Bob do walk on it and don't backtrack, are they actually relevant to crypto? Also, I was told that supersingular ...
2
votes
0answers
41 views

Is my way safe to remove SSL CA Cert by DHT and PoW NodeID for a decentralized system?

To implement a decentralized system, I wrote a TLS like P2P net stack. The main idea is removing CA Cert from the whole system by using a DHT for Naming and Key Exchange. I am not a crypto expert, so ...
2
votes
0answers
43 views

Creating ECC Signature - Is “R” necessary in calculating “S”

After going through the mathematical proof in confirming ECDSA, it doesn't seem apparent to me that "R" is necessary in calculating "S" for the signature. In other words, what's the problem with ...
4
votes
1answer
104 views

questions about modular reduction algorithm over $F_{2^m}$

So I'm trying to understand algorithm 2.40 (arbitrary reduction polynomials) from the Guide to Elliptic Curve Cryptography and have some questions. The very first sentence of this section says this: ...
2
votes
1answer
84 views

Discrete logarithm on Montgomery curve twist

So for some context I've been playing with some crypto challenges, and ran into this interesting problem. There's Montgomery curve C, point ...
4
votes
1answer
307 views

Understanding BLS12-381 Curve

I have some basic understanding of ECC - but pretty far from advanced concepts. I've been reading about BLS12-381 curve here and here, but I can't seem to fully understand it. The things that I think ...
1
vote
2answers
100 views

Using the same private key to generate Schnorr and BLS signatures

I am wondering if it is possible or if there are any limitations to using the same private key to generate Schnorr and BLS signatures. Specifically, assuming I have a private key $x$, I want to use it ...
2
votes
1answer
43 views

choices for k in binary finite field modular reduction algorithm

In the Guide to Elliptic Curve Cryptography there's this algorithm: My question is... what is $k$? Is it just some random value we pick? If so are some numbers better than others?
-1
votes
1answer
334 views

Signing with RSA-SHA256 algorithm using EC keys

Is it practical to sign a data using RSA-SHA256 algorithm with EC keys? I used a small NodeJS script and crypto module (uses openSSL internally) to test this and I could successfully sign the data ...
1
vote
2answers
93 views

Multiparty key exchange for end-to-end encryption

I need to make end-to-end encrypted messaging between 2 and more parties without trusting a server. Each party has it's secret and private keys. The obvious solution is to make ECDH between all of ...
0
votes
1answer
284 views

ECDSA signing and verification between Python and JS [closed]

I'm trying to have Python (2.7) and JS solutions for ECDSA signing (with secp256k1 curve) where ideally signatures generated by one side can be verified by the other. For the python side, I'm using ...
-1
votes
1answer
46 views

Question About ECC Primitives (GnuPG)

In version 2.1, GnuPG featured primitives that use elliptic curves. For encryption, one option was ECDH, which confused me. I thought ECDH was for key agreement, not public key encryption. How does ...
2
votes
2answers
105 views

Why would Diffie-Hellman Group 21 be 521 bits rather than 512?

Diffie-Hellman groups tend to increment in key sizes as you'd expect up until group 21. Any idea why the key size is 521 rather than 512? I haven't been able to find an answer at all.
0
votes
2answers
68 views

The use of Elliptic Curves as part of a blockchain transaction

As I understand it, Elliptic-Curve Cryptography is used in the verification step of a transaction (i.e. when creating a digital signature), but not in the creation and security of a 'block' (when ...