Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

-1
votes
1answer
70 views

Secure communication channel recommendations

I'm working on a cryptography-related project, which uses ECC (elliptic curve cryptography). And one of the things that I need is a "secure" communication channel for two entities. I need someone to ...
0
votes
1answer
54 views

Using Microsoft SIDH library for messages signing

SIDH library looks good but lacks documentation and samples. The only signature-related code was found at http://github.com/yhyoo93/isogenysignature/blob/master/tests/kex_tests.c appeared not able to ...
1
vote
1answer
135 views

Zero-knowledge transfer of value protocol II [closed]

This is an improvement of the protocol described here. The protocol does not require trusted setup and is very efficient (much more efficient than anything else I could find). The protocol allows the ...
0
votes
1answer
118 views

Differences between ECIES and DHIES

I'm studying the Integrated Encryption Scheme and I did't understand which are the main differences between ECIES and DHIES. Can someone help me ? Thank you in advance.
0
votes
0answers
72 views

NIST Elliptic Curve Algorithm

I am wondering which algorithms are used to compute ec_mult and ec_twin_mult in the following implementation guidance document. ...
-1
votes
1answer
256 views

ECDH over secp256k1 implementation

I'm using ECDH over secp256k1 in multiple languages, and I saw something a little weird in the rust library I use. After the point multiplication it changes y to <...
3
votes
1answer
111 views

ECIES: ECDSA with Kmac and without MAC

I have couple of questions about ECIES. I understand how ECIES work and what I must do if I want to have ECIES with ECDSA for authentication (I understand that for full authentication I have to have ...
2
votes
2answers
185 views

ECIES with ECDSA

I understand how ECIES work. I have a structure of message [alice`s ephemeral public key, MAC tag, ciphertext] I do not understand what I shoud do if I want to ...
0
votes
0answers
33 views

Can I share a secret among more than two keys in ECC? [duplicate]

Sharing a secret in ECC is easy. Alice calculates $S = aB$ and Bob calculates $S=bA$. They will both arrive at the same secret because $aB=bA=abG$. This does not seem to be easily generalizable to ...
7
votes
1answer
228 views

What does the special form of the base point of secp256k1 allow?

The popular ECC parameters secp256k1 are documented in SEC2 as using curve $y^2\equiv x^3+a\cdot x+b\pmod p$ with $a=0$, $b=7$, $p=2^{256}-2^{32}-\mathtt{3d1_h}$, base point $G$ with the apparently ...
1
vote
0answers
33 views

Problem with brainpool? [duplicate]

In the GnuPG 2.1 release notes, there is this phrase: For many people the NIST and also the Brainpool curves have an doubtful origin I've read elsewhere that people have doubts about the NIST ...
1
vote
1answer
321 views

Choice of ECC curve on USB token

I would like to get a USB token to secure my keys. My use case is protection of 3 GnuPG keys that I will be using 10 times per day at least. I plan to create a new key ring from scratch. Because ECC ...
0
votes
0answers
98 views

ECDSA authentication + ECDH key exchange +AES encryption - Replay attack

I am using ECDSA for authentication of two embedded devices, later after authentication I am using ECDH for key generation, which after hashing the keys I am using it as part of AES-CTR for ...
1
vote
1answer
64 views

Encryption scheme with high complexity encryption over decryption

I need an encryption operation be 1000-1000000 times more complex than decryption operation. Is it possible to achieve with EC ...
3
votes
0answers
81 views

Why does ECDSA transmit s and not s^-1? [duplicate]

Given: $eG=P$, $kG=(r,y)$ ECDSA signature transmits (r,s) and does this calculation: $u = \frac{z}{s}$, $v = \frac{r}{s}$ $uG+vP=(r,y)$ means the signature is valid Why do we transmit $s$ and not ...
2
votes
1answer
77 views

Understanding the q-SDH Problem (on elliptic curves)

I have some troubles in understanding the q-SDH problem. The discrete logarithm problem states the following. Given a point P of order on an elliptic curve and a point Q on the same curve. It is hard ...
3
votes
0answers
72 views

How to map the points of an elliptic curve cyclic group to $\mathbb{Z}_q$ using a hash function?

Let $E$ be an elliptic curve defined over $\mathrm{GF}(q)$, where $q=p^r$. Let $G$ be a cyclic group of points of $E$. Then how we can map points of $G$ into $\mathbb{Z}_q$ using a hash function.
1
vote
1answer
121 views

In ECDSA, why are u and v dividing by s?

The verification algorithm for ECDSA is: $P=e\times G$, $(r,y)=k\times G$, and $s=(z+re)\times k^{-1} \bmod n$, where $P$ is the public curve point, $G$ is the generator point, $e$ is the ...
9
votes
1answer
1k views

Why are Jacobian Coordinates used?

I couldn't find this explained in another question, but is there an actual reason as to why Jacobian coordinates are used for elliptic curves? Do they provide some sort of advantage in terms of ...
4
votes
2answers
493 views

Elliptic curve and “vanity” public keys

I want to find an algorithm to get a private/public key pair where one coordinate of the public key has some specific prefix (for example: 20 leading zeroes). In the secp256k1 case (the Bitcoin curve),...
1
vote
1answer
385 views

How many points are there on the X25519 curves?

The order of the base point, $l$, is 2^252 + 27742317777372353535851937790883648493 However, the base point group is nested within other large groups, the largest of which is of size $8l$. There are ...
1
vote
3answers
183 views

EC Calculations in Java

Just for the sake of learning, I'm attempting to write an ECDSA implementation in Java. I have what I believe is a correct implementation for point addition and doubling, but I'm not sure how to ...
3
votes
1answer
178 views

Key equivalence across different elliptic curves

Is it possible to prove key-equivalence across elliptic curves of different order? Specifically: Suppose I have a key $x$ valid for both curves listed below On curve $g$ (for example, Curve25519) it ...
2
votes
1answer
123 views

What is the one way function in ECC?

In the RSA algorithm it's the the integer factorisation problem, it's easy to multiply the two large primes to generate n, but given just n it's very difficult to find the constitutent primes. In the ...
2
votes
1answer
200 views

Zero-knowledge integer comparison

This question is a follow up to the question I asked here. Basically, the protocol I described has a flaw (as pointed out in this answer), and I am trying to figure out how to address it. The setup ...
3
votes
3answers
282 views

Zero-knowledge transfer of value protocol inspired by EC El Gamal

This is a follow up on the question I asked here. I designed a scheme that allows the following: Alice has a value $a$ which she wants to keep secret Bob has a value $b$ which he wants to keep secret ...
2
votes
0answers
100 views

Is EC El Gamal the only option?

This question is related to the question I asked here. I'm looking for encryption scheme with the following properties: Given $m$ is a 256-bit value, $pub_a$ and $pub_b$ are public keys, and $priv_a$ ...
-4
votes
5answers
88 views

Multiple Encryption - One-Time Pad

It is known that One-Time Pad(OTP)s are theoretically unbreakable but impractical for use because of the size of the key length. But what if multiple encryption is used? Not to encrypt the first ...
0
votes
1answer
155 views

Half of any bitcoin (crypto) public key - (public key half) is possible

I found a topic on bitcointalk Public key x and y == Double(Half of the Public key x and y) half any public key is possible how that possible , in crypto there is subtraction and multiplication ...
1
vote
1answer
83 views

How do I convert an elliptic key signature r and s value into a signature byte array?

I have an existing system that signs an arbitrary binary blob with an ECDSA key. The output of this is an r and s value. I now need to verify this signature on another system. On this other system ...
1
vote
1answer
144 views

does TLS 1.3 use ECDSA-Sig-Value encoded signatures for Ed25519 / Ed448?

Quoting The Transport Layer Security (TLS) Protocol Version 1.3: ECDSA algorithms Indicates a signature algorithm using ECDSA [ECDSA], the corresponding curve as defined in ANSI X9.62 [...
6
votes
1answer
204 views

Ed25519 PKCS8 private key example from IETF draft seems malformed

Malformed PKCS8 Key Algorithm Identifiers for Ed25519, Ed448, X25519 and X448 for use in the Internet X.509 Public Key Infrastructure § 10.3. Examples of Ed25519 Private Key states the following: <...
4
votes
0answers
117 views

What is the difference between Elliptic curves and Hyper-elliptic curves in terms of security?

What is the difference between Elliptic curves and Hyperelliptic curves in terms of security? I am relatively new to cryptography and have heard a great deal more about Elliptic curves than ...
11
votes
3answers
3k views

How effective is quantum computing against elliptic curve cryptography?

I've been reading the Wikipedia page on Elliptic-Curve Cryptography and I came across the following. in August 2015, the NSA announced that it plans to replace Suite B with a new cipher suite due ...
10
votes
1answer
1k views

After ECDH with Curve25519, is it pointless to use anything stronger than AES128?

Is the following reasoning correct: After ECDH with Curve25519, the resulting shared secret will be an EC public key with a bit strength of 128 bits. This public key would then be hashed (let's say ...
0
votes
0answers
61 views

Compact encoding of an elliptic curve point

I'm working on a project with elliptic curve cryptography (ECC), I'm using the secp256k1 library (the one that's used in bitcoin). My goal is to create the most compact platform-independent ...
0
votes
0answers
139 views

In ECC which previous multiples of G is added to get next multiple?

I was finding multiples of G in ECC like 1G, 2G, 3G e.t.c, then I came across this problem, its that how do we know which previous multiples to add to get next multiple. Like to get 5G we can add 4G+...
1
vote
2answers
108 views

What are the properties of secure Elliptic Curves?

I have heard about the standard elliptic curves called NIST curves. What are the properties of such cryptographically secure elliptic curves? Are they standardized according to certain protocols? Also,...
16
votes
5answers
4k views

Is there a situation where RSA cannot be replaced with ECC + symmetric algorithms? If no, why do we still use it?

RSA is both an asymmetric encryption algorithm and a digital signature algorithm. However, in recent years, many cryptographic protocols (TLS, for example) have moved away from the use of RSA to ...
1
vote
1answer
75 views

In what mode does Signal applies cryptography over voice and data?

I have read all of the technical documentations provided via signal and so far I have figured out that signal intitializes a common key via X3DH key agreement and manages the keys via double rachet ...
0
votes
1answer
87 views

Does Signal Application use Eliptic Curve cryptography for encryption as well?

I am studying how Signal application works and as I was reading the documentation on how is applied the XEdDSA and VXEdDSA Signature Schemes. But I kept wondering: if Signal uses elliptic curve for ...
4
votes
0answers
134 views

Encrypt using ECDH with two different EC public keys, minimizing payload size

Let's say Alice has the private EC keys $a$ and $b$, with a base point of prime order $G$. Alice computes the corresponding public keys $A = aG$ and $B = bG$, and sends them to Bob. Bob now wants to ...
2
votes
0answers
93 views

A method for creating distributed public key for ECDSA, what are the risk factors?

There is quite a bit of literature on distributed ECC signing without a trusted dealer. Published works are mostly overly complicated, so I am proposing this simple technique which I am sure if it is ...
2
votes
1answer
43 views

Point multiplication twice - can it be squeezed into one equation?

p_1 := (d_1)G p_2 := (d_2)p_1 $P_2$ is calculated as shown above. Will $P_2$ be the same of $P_2$ in the second equation? ...
1
vote
1answer
34 views

ciphers depend on Elliptic curve cryptography

IS there any cipher dependent on the Elliptic curve cryptography? and it is Accredited by any origanization like RSA or El GAMAL Which are the ciphers depend on the Elliptic curve cryptography?
2
votes
1answer
274 views

Why do we need to use supersingular curve on SIDH?

if i'm not mistaken, the supersingular curve's endomorphism ring is non-abelian. but why does it matters? or is it not even related to its endomorphism ring?
-1
votes
1answer
164 views

ECC private key generation collision

I am generating ECC private keys. however I noticed that since ECC private key is just a BigInteger. e.g. spec256k1 says private key is anywhere between [0~2^256-1]....
-1
votes
1answer
138 views

Elliptic curve discrete logarithm problem and mini example

Consider the group E23(9,17), this the group defined by the equation y2 mod 23 = x3 + 9x + 17 mod 23. What is the discrete logarithm k of Q = (4,5) to the base P = (16,5)? the solution is: 2P = (20,...
3
votes
1answer
114 views

How to prove that two EC public keys created with two different generators share the same secret key?

Consider a situation where there is a (scalar) secret key $x$, known only to Alice. There are two well known generator points $G$ and $H$, known to both Alice and Bob. $H$ is chosen such that ...
-2
votes
1answer
87 views

Can an elliptic curve have the form y^2 ≡ x^2 + 2x + 2 mod 17?

I'm new to cryptography and the associated level of maths. I'm practising past papers for an exam and found the question: Show that the condition 4a^3 + 27b^2 ≠ 0 mod p is fulfilled for the ...