Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

2
votes
2answers
106 views

Why would Diffie-Hellman Group 21 be 521 bits rather than 512?

Diffie-Hellman groups tend to increment in key sizes as you'd expect up until group 21. Any idea why the key size is 521 rather than 512? I haven't been able to find an answer at all.
0
votes
2answers
68 views

The use of Elliptic Curves as part of a blockchain transaction

As I understand it, Elliptic-Curve Cryptography is used in the verification step of a transaction (i.e. when creating a digital signature), but not in the creation and security of a 'block' (when ...
0
votes
1answer
80 views

Issues with Elliptic Curve Point Addition

I'm trying to implement elliptic curve point addition in hardware. I've managed to create a working module using Affine coordinates however I've been reading about how points can be added by using ...
2
votes
1answer
250 views

X25519 - why openssl shows 253 bits?

When using ECDHE with Curve25519 with openssl: Server Temp Key: X25519, 253 bits I thought when we use X25519, it use 256 bit key. Why openssl shows the server temp key as 253 bits?
1
vote
0answers
32 views

How implement doubling point using VHDL language [closed]

I have a problem with my implementation. I want to make a multiplication in finite field. I don't know If my scheme is correct, but I made code on this base. I want to calculate: D= XY D=DX Some ...
5
votes
2answers
107 views

How sensitive to change are elliptic curve formulae In layman's terms?

Take for example a curve from a recent question such as #25519:- $$y^2 = x^3 + 486662x^2 + x$$ It's considered "safe". What are are the implications of amending it very slightly to:- $$y^2 = x^3 + ...
1
vote
0answers
43 views

Preserving location privacy

What are cryptographic techniques that could be used so that if I wanna to enable a server to send message to certain nodes in a network with preserving the privacy location for them ??
2
votes
0answers
113 views

What standards of ECC point compression exist?

The method that I used before to decode EC point from public key led me in a dead end. So I just want to know what yet I could try. I've got a public key that I don't know how to decode and I am ...
4
votes
1answer
212 views

Simple explanation of Miller's algorithm

Could someone explain to me in few lines (even one sentence) what Miller's algorithm computes? Without talking about divisors and all the other concepts, I would like to be able to explain it to ...
0
votes
1answer
274 views

Birthday Attack against Cryptocurrency

One of my friends is creating his own cryptocurrency, just as a fun project, and he made some design choices that I think are insecure, but I personally don't have enough expertise to evaluate. ...
1
vote
1answer
82 views

What are the differences between ephemeral-static ECDH and static-static ECDH?

As I know ECDH can be used with a fixed public key. I read there are two types of static ECDH, ephemeral-static ECDH, and static-static ECDH. What are the differences between these two types?
1
vote
1answer
98 views

Exactly what part of SIDH is proven to be NP-hard?

SIDH is quantum secure, why is it quantum secure? Exactly which part of the algorithm is proven to be NP-hard? Computing the isogeny function?
2
votes
1answer
48 views

How could you find the preimage of an isogeny function?

How do you know if an isogeny is surjective or not, and how do you tell how many points on E maps to E'? Does the answer lie in the degree of the isogeny function?
1
vote
2answers
64 views

powers of g in $GF(256)$

The finite field $GF(256)$ is usually implemented $mod$ 0x11b to keep the numbers inside that field. I understand that 0x11b was ...
1
vote
1answer
311 views

Which one is faster GCM AES-128 or Curve25519?

As I know the symmetric encryption algorithms are faster than asymmetric encryption algorithms. But when I test GCM AES-128 and Curve25519 encryption time. I find Cure25519 are faster then GCM AES-128....
0
votes
1answer
147 views

When do I need to use hybrid cryptography?

I need to provide confidentiality for a protocol. The protocol message size is between 100 bytes to 500 bytes. Do I need to use asymmetric encryption or hybrid cryptography?
0
votes
1answer
110 views

Time complexity of Weil pairing

I ran and timed an implementation of the Weil pairing on three set of parameters. One with an order of 512 bits, one with 256 bits and the last with 161 bits. I took the Miller's algorithm to compute ...
1
vote
1answer
53 views

Eliptic curve verifiable secret sharing

I am implementing the following the algorithm instructions as shown in 1 (section IV, B). When trying to verify the share given the commits, $a_jG$ verifier $i$ checks whether $f(i)G=\sum_{j=0}^{t} (...
1
vote
0answers
52 views

What should I change in my implementation to pass from a curve $y^2=x^3+1$ to $y^2=x^3+x$

I tried to change my implementation of pairing in curves $y^2 = x^3 + 1$ to use curves of the type $y^2 = x^3 + x$ but it didn't work. I thought the only thing I had to change in my code was the ...
3
votes
1answer
145 views

What form of ECC can we use to make sure our newly invented ECC based crypto-systems are quantum secure?

It seems a lot of crypto-systems that are based on elliptic curves are susceptible to quantum computing attacks. Hence, what forms of ECC cryptosystems are quantum secure, and how can we prove that? ...
1
vote
1answer
143 views

Hashing based on the discrete logarithm problem

At a first look, one could use the elliptic curve discrete logarithm problem to grant for the onewayness of $H(x)=x*G$ (where $G$ is the generator point of the cyclic subgroup). Additionally, $H(x)$ ...
2
votes
1answer
122 views

Questions about the Curve25519-donna implementation

I'm trying to understand the implementation of the following function: Please note questions in comments. ...
1
vote
0answers
43 views

Known risks for publishing ECDSA public keys and signatures

For an implementation of ECDSA, I'm considering the risks of publishing public keys together with multiple signatures. From what Google tells me, a common pitfall is the use of the same random value ...
0
votes
1answer
56 views

The equivalence of exponentiation and multiplication over elliptic curves

I am trying to convert $(g^a)^{i^2}\mod p$ to an equivalent Elliptic Curve expression. Let's assume a base point $G$ over an appropriate ECC. Will $(g^a)^{i^2}\mod p$ be equivalent to $G\cdot a\cdot i^...
2
votes
1answer
400 views

How to solve this ECDLP?

The Problem is as follows: $E: y^2=x^3+17230x+22699 \pmod{23981} $ $p=23981$ is prime number point $G$ $G$'s order $109$ : prime number Alice creates a public key by ...
2
votes
0answers
136 views

Ed25519 key generation

the following rfc describes the key-pair generation mechanism for Ed25519; the first two steps are as follows: Hash the 32-byte private key using SHA-512, storing the digest in a 64-octet ...
0
votes
1answer
95 views

C# equivalent of openssl ecparam -name prime256v1 -genkey -noout -out [closed]

I am having some issues generating a proper private key,I need it to be an Elliptic Curve private key suitable for use with NIST P-256 which i than need to convert to Base64-encoded private key in ...
-1
votes
1answer
81 views

Is that right what I understand about MOV attack?

There is an elliptic curve. $y^2 = x^3 +ax+b \pmod p$ ($p$ is prime number) To solve DLP, need to find $r$ from given points $G$, $rG$. ($G$'s order is $q$ and $q$ is prime number) The MOV attack ...
1
vote
1answer
57 views

Computations in extended finite field p^2

I would like to construct a distortion map from a point $\in \mathbb{F}_p$ to $\mathbb{F}_{p^2}$. If I have an elliptic curve $Y^2 = X^3 + 1$ over $\mathbb{F}_p$ and a distortion map $\phi(x,y) \...
1
vote
1answer
46 views

How to handle points in extended finite field

Following the response to my previous question, I would like to know if you could give me some information or give me a link on how to perform arithmetic operations once I changed a point from the ...
0
votes
0answers
69 views

Understanding creation of distortion map

I'm trying to implement a distortion map but I have a problem. I know the basics and I read some questions like this one and asked some questions here. If I have an elliptic curve $E : y^2 = x^3 + 1$ ...
3
votes
1answer
148 views

How to find a primitive cube root of unity

I would like some help to understand how to compute a distortion map and the result of a pairing. I know that with this equation : $E : y^2 = x^3 + 1$ over some $\mathbb{F}_p$ we have a distortion ...
1
vote
1answer
96 views

Encrypt with elliptic curves [closed]

The last days I was looking for a way to encrypt using ECC, without having to make the program myself. I was sure that someone should have done it for everyone by now. The best approach I had was ...
1
vote
1answer
64 views

I want forgery ECDSA when prime p is form of 2*n+1, n is order of Elliptic curve

I have parameters of an elliptic curve s.t $p=2n+1$ , when $n$ = order of elliptic curve over finite field of order prime p. If I want to forge any message for such ECDSA, What can I do? Maybe the ...
2
votes
0answers
134 views

Fastest known Elliptic Curve Cryptography “solution” (coordinate systems (multiple?), algorithms, precomputed values etc)?

I am writing an Elliptic Curve Cryptography SDK in pure Swift, and currently I am only using Affine Point and simple Double-and-add. I am soon about to work on a faster solution. I am asking for help ...
0
votes
0answers
91 views

Pairing in implementation of a simple digital signature

I'm trying to implement in python the 1st scheme from the paper "Efficient Identity Based Signature Schemes Based on Pairings" by Hess to learn elliptic curve cryptography. It's a simple digital ...
1
vote
1answer
54 views

What scalars produce the wrong values with X25519's montgomery ladder?

This question is a consequence of an older one about multiplying a twisted Etwards point in Montgomery space. Turns out that this is unsafe in some circumstances. The following Montgomery ladder as ...
2
votes
0answers
224 views

ECDSA public key recovery is discovered by whom?

Im looking for the history of the method (ECDSA public key recovery from signature). Where is this implementation first appeared in (is it bitcoin?) and who discovered this method?
0
votes
0answers
43 views

Point multiplication over Fp

I have a decent grasp on how point multiplication works in the context of the regular elliptic curve, however once we limit to whole numbers over a finite field I get confused. How on the world do we ...
2
votes
1answer
151 views

Right way to hash elliptic curve points into finite field

I would like to know how I can implement several hash functions : $H_1:\{0,1\}^* \rightarrow P $ with $P \in E(\mathbb{F}_q)$ and $H_2:P \rightarrow \mathbb{Z_q}^*$ And others where the ...
1
vote
1answer
60 views

Can I use Pollard'-Rho even when the order is not a Prime?

I am now solving the ECDL problem. I want to use [discrete_log_rho] in SageMath, but I can not use it because ORDER is not a prime number. Can I change it to a decimal number close to ORDER at my ...
1
vote
1answer
44 views

Is it possible to derive the recipient's public key from libsodium's crypto_box?

Libsodium has "crypto_box_seal" which according to the documentation is used to "anonymously send messages to a recipient given its public key.", which hides the sender. But Is it possible for Eve to ...
1
vote
1answer
168 views

How were the P-256 parameters chosen?

In NIST FIPS 186-4 (page 90), it is said that $c$ is the output of SHA-1 on a seed that was chosen randomly. Then the parameter $b$ of the EC is chosen, according to the formula: $$b^2 \times c \equiv ...
1
vote
1answer
118 views

Schnorr Pubkey Recovery

As per How does recovering the public key from an ECDSA signature work? , it's possible to recover public keys from ECDSA signatures. Is this possible for EC-Schnorr signatures as well? I'm looking ...
1
vote
0answers
141 views

ECC Curve25519: How to generate this kind of private key? / Strange key exchange mechanism

I'm currently reverse engineering a program that uses Curve25519 key exchange in network communication. I have only a basic understanding of ECC, so maybe this thing just seems strange to me. The ...
2
votes
1answer
127 views

The compression of the eliptic curve point coordinates

Some time ago I faced the problem of the unexpected format compression of the points on elliptic curve. I used ECDH procedure with a third party service on the base of the $\mathbb({F}_{2^m})$ curve ...
0
votes
0answers
130 views

Signal double ratchet vs. future breaks in ECC?

I made a feature request on the Signal forum: https://community.signalusers.org/t/3469 And now I have a cryptographic question about Signal's "double ratchet". Assume the symmetric algorithm (...
1
vote
2answers
189 views

Using two elliptic curves to do a range proof

Suppose Alice holds a secret value $a$ to which she has publicly committed to using two elliptic curves of distinct order. The curves are $g$ and $g'$ of orders $q$ and $q'$ (with $q < q'$) and ...
4
votes
1answer
138 views

Generating new Koblitz curves

is there the way how to generate new Koblitz curves (over F2n and Fp as well)? I found that "The recommended parameters associated with a Koblitz curve were chosen by repeatedly selecting parameters ...
1
vote
0answers
104 views

Implementing key mapping across different elliptic curves

From this answer I understood how to prove key equivalence across two elliptic curves. Now, I'm trying to figure out some more practical aspects of implementing this. Before jumping into questions, ...