Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

0
votes
0answers
46 views

What Set and MultiSet Hash allows Secure, Homomorphic, commutative comparison of key-value databases? (Orderless, Online alternative to Merkle trees)

I am interested in Merkle tree like hashes that do not require the data to be ordered, but will hash the data, not the byte by byte, page by page storage but rather hash UNORDERED data (presumably ...
2
votes
1answer
284 views

What is the maximum message size when using ECDSA (specifically secp256k1?

I'm guessing that the message must conform to 256 bits but I was not able to find documentation of any message length limits.
2
votes
0answers
46 views

Asymmetric encryption property required in an authentication protocol

We want to choose an asymmetric encryption scheme for use as follows: A device holds its private key, with the corresponding public key known and trusted by all. The device also holds a small $b$-bit ...
3
votes
0answers
103 views

Cryptographically Secure Elliptic Curve

What are the properties a cryptographically secure Elliptic Curve must have? I have started to create a list and wanted to know if I forgot some important points, and if it is correct so far: A curve ...
0
votes
1answer
40 views

Using the a multiple of the x coordinate as a private key

ECDSA specs require private key ($d$) to be a random integer ($r$) in the range $[1, N-1]$, where $N$ is the order of the base point ($G$). What if the private key instead is set to the x-coordinate ...
3
votes
1answer
96 views

How Can I Know the Number of Points on an elliptic curve?

If I have the following Elliptic Curve: $$E: y^2 ≡ x^3 + 2x + 2 \mod 17$$ How Can I calculate the Number of Points on this elliptic curve $\#E$ ? and how can I invest the following law which ...
10
votes
2answers
2k views

How do malware rely safely on ECDH algorithm to maintain secrecy of keys?

In traditional malware (especially ransomware) using RSA approach, the public key may be hard-coded in the malware binary and is used to encrypt a symmetric key generated on the system. The symmetric ...
0
votes
1answer
170 views

multiplication of two points belong to elliptic curve

I have a question about multiplication of two points belong to elliptic curve. I know every think about adding and scalar multiplication but not about multiplication of two points. Is there any method ...
0
votes
1answer
164 views

decoding a Ed25519 key per RFC8032

RFC8032 Edwards-Curve Digital Signature Algorithm (EdDSA) 5.1.3 Decoding states the following: Decoding a point, given as a 32-octet string, is a little more complicated. First, interpret ...
1
vote
0answers
33 views

Crypto Vs crypto-less key establishment protocols for Internet of Things applications [closed]

With the advent of IoT, crypto-less key establishment protocols exploiting intrinsic channel randomness of physical layer are gaining great interest. These crypto-less protocols are computationally ...
1
vote
1answer
257 views

Does secp256r1 or secp256k1 use a=-3?

I saw a post here which I think states that for P256, a is equal to -3. Why is elliptic curve parameter $a=-3$ somehow special I am not sure if this is correct, or maybe I am misunderstanding ...
2
votes
0answers
295 views

What ECDSA key is used to sign the ECDHE key exchange?

I have a server using TLS1.2 with an ECDSA certificate using secp256r1. The algorithms being used to connect to my browser are TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 as I expect from my server ...
2
votes
0answers
58 views

Is it secure to encrypt with EC “for myself”? [duplicate]

I want to encrypt some small amount of data using ECDH for use by myself later, but I don't want to generate an ephemeral keypair like in ECIES, due to time and space constraints. Would it be safe to ...
0
votes
1answer
79 views

SIKE algorithm 2

I was recently reading this paper on SIKE and there on page 20 I encountered algorithm 2. I understanding line 14 of algorithm 2 in sike but I don't understanding line 17 of algorithm 2. $h (s || (c_0,...
0
votes
3answers
215 views

Allow everyone to decrypt a message, but don't allow anyone to encrypt it

I would like to create a software that will be installed on multiple clients. I would like to broadcast an encrypted message to all of those clients. Each client should be able to decrypt the message ...
0
votes
1answer
87 views

Is there a feasible way to generate an RSA key manually the same way as it is for an ECC one?

In elliptic curves, a private key is just a random number, and one relatively small compared to other crypto systems (256 bits for ECC vs 4096 bits for RSA for example). Suppose I don't trust ...
4
votes
3answers
701 views

How can there be insecure elliptic curves if the discrete logarithm problem is hard?

The discrete logarithm problem is the mathematical trap door function underpinning elliptic curve cryptography. If it's naturally hard to climb back through the trap door, how can there be insecure ...
1
vote
1answer
162 views

Is there a proxy re-encryption algorithm for Elliptic Curve ECIES?

I was wondering if there is a way to perform proxy re-encryption for ECIES public-key encryption (i.e. given a message encrypted with Alice's public key, re-encrypt it using Bob's public key). Is that ...
0
votes
0answers
76 views

Is it safe to use Barreto-Naehrig curve 158 bit?

I'm trying to understand the Pairing-Friendly Elliptic Curves of Prime Order and I need to know if it is acceptable to use the BN-158 curves, hence if this curve ensures a security level of 80 bits. I'...
7
votes
1answer
990 views

What is the curve type of SECP256K1?

This is possibly a dumb question. I'm trying to input SECP256K1 curve parameters to a system that expects any custom curve. The form is asking for "curve type". It offers three options: Short ...
3
votes
1answer
148 views

Wrong Miller's Weil Pairing implementation?

I tried to implement the Miller's Weil Pairing algorithm in python using the book "An introduction to mathematical cryptography" by Hoffstein, Pipher and Silverman. I tried my code with the example ...
-1
votes
1answer
58 views

Which elliptic curve cryptography algorithm can be used for this scenario and how to do? Please explain step by step

I want to implement the below scenario using elliptic curve cryptography: Steve has list of IDs and he wants to encrypt with private key - IDs Steve send the list of encrypted IDS to John - Steve(...
10
votes
1answer
3k views

ECDSA, EdDSA and ed25519 relationship / compatibility

I'm trying to understand the relationship between those three signature schemes (ECDSA, EdDSA and ed25519) and mainly, to what degree are they mutually compatible in the sense of key pair derivation, ...
5
votes
2answers
172 views

How to get an optimal strategy in computing isogenies for SIDH/SIKE

How to get a strategy $(s_1,...,s_{t-1})$ as mentioned in section 1.3.7 of SIKE spec? If possible, can anyone give me an example? And why do we need to compute all leaf point? I though we just need ...
0
votes
2answers
610 views

How to calculate a private key from public key on elliptic curve?

Provided, that you have to multiply a well known G by the private key to obtain the public key, why not keep adding G to itself until you reach the public key. The private key should be the number of ...
1
vote
0answers
73 views

Elliptical Curve Cryptography benchmark test

I have built web app that implement Elliptical Curve Cryptography. During testing using data set that i chose on my own, it already run well.. But, for now, i want to test it in some benchmark test, ...
0
votes
1answer
155 views

Quantum bit level security of Supersingular Isogeny based Diffie Hellman scheme

I'm a newbie in studying and learning how SIDH works. I have a simple doubt. So my question is in the SIKE submission present in this link (https://csrc.nist.gov/Projects/Post-Quantum-Cryptography/...
4
votes
1answer
219 views

Elliptic Curve Cryptography, decrypting returns false result

I build some application to encrypt and decrypting some text using ecc My curve paramaters are p = 59 a = 2 b = 2 resulting in 64 points including infinite ...
0
votes
0answers
74 views

What is the difference DET-ABE Vs CP-ABE and KP-ABE?

I can't understand what's does it mean DET-ABE (digital envelope technique ) exactly , and is there a difference between it and the the cipher or key policy attribute based encryption, could someone ...
3
votes
1answer
68 views

Does an EC signature preserve entropy?

Assume I have a perfect source of entropy, which is unknown to me, and is used to generate a private key (also unknown to me, but usable). If I make a signature with this unknown private key on a ...
-4
votes
1answer
675 views

Where is RSA applied in real life?

For instance, I know that the BlackBerry uses a form of ECC built-in for data protection. But would like to know if either the iPhone or Android smartphones, for instance, use a form of RSA? If RSA ...
6
votes
1answer
350 views

Can Pohlig-Hellman encryption be done over elliptic curves?

Following a bunch of questions on the topic of Pohlig-Hellman encryption. I was wondering if this could be trivially adapted to be done over elliptic curves just like we create EC-DH instead of DH. ...
3
votes
1answer
340 views

Curve point generators for ECC

I'm working on a cryptosystem based on ECC (elliptic curve cryptography). I need to choose several (~10) curve points which should be used as generators, and it's important that their relation is ...
1
vote
1answer
138 views

Basic question on interaction with HSM using PKCS11

I am a beginner on cryptography, I've been reading about PKCS11 and usage of PKCS11 on HSM's I understand the concept of HSM, I read about the HD wallets in bitcoin how keys are hashed and combined ...
2
votes
0answers
79 views

Group signature Elliptic curve

I have been doing some research in group and ring signature literature. I am trying to find a ring/group signature which provide the following propriety: Anonymity for the signer Verifiable by a ...
-1
votes
2answers
65 views

Can we apply elliptic curves to reduce key sizes in symmetric cryptography?

elliptic curve reduces key sizes thus reducing storage and transmission requirements and also provide the same level of security. Symmetric encryption such as AES needs to increase its key size to ...
2
votes
2answers
228 views

How to compute a smooth-degree isogeny given a generator point of its kernel?

I need to compute an isogeny from $E: y^2 = x^3 + ax + b$, given a generator point for its kernel subgroup, using Python. The point has smooth order. I need both the parameters for the curve and ...
3
votes
2answers
654 views

Recovering private key from Secp256k1 signatures

I've seen many answers here and many articles that says we can recover the private key from reused R signatures. But, what if the r,s signatures are different in transaction of bitcoin then is there a ...
1
vote
1answer
87 views

do koblitz curves over $\mathbb{F}_{P}$ as generalized in SEC2 always have $a$ as 0?

I reviewed all the curves in http://www.secg.org/SEC2-Ver-1.0.pdf . All the secp*k* curves have the $a$ parameters as 0 and those are the only ones with the $a$ as 0. Is this a defining requirement ...
3
votes
1answer
563 views

Exponentiation in ECC

I have a naive question, what is the nomenclature of exponentiation mean in ECC? I was reading about exponential ElGamal, what does it mean if a generator point $G^x$ ? What does $G * \ldots * G$ ...
1
vote
1answer
2k views

ECDSA Signature R|S to ASN1 DER Encoding question

I am trying to test my understanding on ECDSA Signature r|s to ASN.1 DER Encoding for NIST P-256. I have r|s and when I convert ...
0
votes
0answers
57 views

ECIES encryption output with additional parameters

Although I can't recall the source, I've seen somewhere a block diagram of the encryption process in ECIES, where apart from the standard outputs of the ...
4
votes
1answer
132 views

How secure is ECDH if the public keys are never changed?

I have a scenario where I'd like to use Diffie Hellman keys where the public keys are exchanged once and then never changed. So server generates a key pair (secp256k1 or secp256r1) and sends its ...
3
votes
1answer
324 views

Verification using recovered public key from ECDSA signature and normal verification: what are the differences?

For ECDSA, a given signature and its message can be used to recover the public key used to sign it (produce 2 public keys). By making comparison of these recovered public keys against the known public ...
4
votes
1answer
492 views

Varying ECDH key output on different ECC implementations on the secp256k1 curve

Like the title says, I have used several implementations of ECDH, and I have found a discrepancy with libraries that wrap ...
4
votes
2answers
218 views

Compact Schnorr signature?

The commonly-used ECDSA signature consists of 2 scalars $(r,s)$. There's also a Schnorr signature. Given private key $k$, public key $C = [k]G$ and the message $M$: Generate random scalar $k_1$ ...
1
vote
1answer
59 views

Requirements for attacker-controlled ECDSA identity point signature

Wikipedia's description of the ECDSA verification algorithm suggests verifiers should confirm that step 6 doesn't produce the identity point: Calculate the curve point ${(x_{1},y_{1})=u_{1}G + u_{...
1
vote
3answers
428 views

How to deterministically generate a 256 bit ECC key from 128 bits of entropy without a CSPRNG

A safe way to generate a 256 bit ECC key from 128 bits of entropy is to use a CSPRNG, according to this answer: https://crypto.stackexchange.com/a/56551/43864 However, it's difficult to find a cross ...
1
vote
1answer
89 views

Schnorr NIZK over Ed25519

I am trying to implement the following Schnorr non-interactive zero-knowledge protocol: https://tools.ietf.org/html/rfc8235#page-7 I'm using the libsodium 1.0.16 and GNU MP libraries. I just can't ...
4
votes
2answers
294 views

Is it safe to generate two 256-bit ECC keys from 128 bits of entropy?

Apparently it is perfectly safe to use 128 bits of entropy to generate a single 256 bit ECC key. Can I use 128 bits of entropy and a KDF to make a 256-bit ECC key? I assume this is because 256 bit ...