Questions tagged [elliptic-curves]
Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.
2,096
questions
177
votes
4
answers
125k
views
Why is elliptic curve cryptography not widely used, compared to RSA?
I recently ran across elliptic curve crypto-systems:
An Introduction to the Theory of Elliptic Curves (Brown University)
Elliptic Curve Cryptography (Wikipedia)
Performance analysis of identity ...
- 1,975
160
votes
4
answers
53k
views
Should we trust the NIST-recommended ECC parameters?
Recent articles in the media, based upon Snowden documents, have suggested that the NSA has actively tried to enable surveillance by embedding weaknesses in commercially-deployed technology -- ...
- 36.1k
61
votes
3
answers
27k
views
Why Curve25519 for encryption but Ed25519 for signatures?
NaCl and libsodium libraries use Curve25519 for authenticated encryption (actually for sharing a key which is used for encryption) and Ed25519 for signatures. What is the purpose of using different ...
- 711
54
votes
2
answers
35k
views
ECDSA vs ECIES vs ECDH
Recently I started studying Elliptic Curve Cryptography and I just loved it. I want to transfer some big data (like 3KB), What is the best method, ECDSA, ECIES, or ECDH (and why)?
I am confused, how ...
- 643
53
votes
4
answers
53k
views
Is secp256r1 more secure than secp256k1?
Curves secp256r1 and secp256k1 are both examples of two elliptic curves used in various asymmetric cryptography.
Googling for these shows most of the top results are Bitcoin related. I've heard the ...
- 1,007
52
votes
6
answers
18k
views
Who uses Dual_EC_DRBG?
Recent news articles have suggested that the NSA may be involved in trying to influence the cryptography in public standards or commercially deployed software, to enable the NSA to decrypt the ...
- 36.1k
43
votes
4
answers
36k
views
Basic explanation of Elliptic Curve Cryptography?
I have been studying Elliptic Curve Cryptography as part of a course based on the book Cryptography and Network Security. The text for provides an excellent theoretical definition of the algorithm but ...
- 1,883
41
votes
2
answers
25k
views
How does recovering the public key from an ECDSA signature work?
It is possible to recover the public key from an ECDSA signature values $(r,s)$?
Please explain how this works.
- 614
39
votes
1
answer
30k
views
Explaining weakness of Dual EC DRBG to wider audience?
I have an audience of senior (non-technical) executives and senior technical people who are taking the backdoor in Dual_EC_DRBG and considering it as a weakness of Elliptic curves in general. I can ...
- 1,697
37
votes
1
answer
16k
views
ECDSA, EdDSA and ed25519 relationship / compatibility
I'm trying to understand the relationship between those three signature schemes (ECDSA, EdDSA, and ed25519) and mainly to what degree they are mutually compatible in the sense of key-pair derivation, ...
- 473
36
votes
1
answer
14k
views
Why do the elliptic curves recommended by NIST use 521 bits rather than 512?
Wikipedia says in reference to the elliptic curves officially recommended by NIST in FIPS 186-3:
Five prime fields for certain primes p of sizes 192, 224, 256, 384, and 521 bits. For each of the ...
- 463
35
votes
4
answers
12k
views
Can ECDSA signatures be safely made "deterministic"?
Using the terminology of the ECDSA Wikipedia page, ECDSA (and DSA) signatures require a random k value for each signature which ensures that the signature is different each time even if the message ...
- 742
34
votes
4
answers
4k
views
What is so special about elliptic curves?
There seems to be sources like this, this also, and some introductions that discuss elliptic curves in general and how they're used. But what I'd like to know is why these particular curves are so ...
- 573
33
votes
3
answers
5k
views
Why would anyone use an elliptic curve with a cofactor > 1?
In cryptography, an elliptic curve is a group based on a finite field $GF(p^k)$; this group has $n$ elements on it, and we work on a prime-sized subgroup of size $q$. We denote the value $h = n/q$ as ...
- 143k
31
votes
2
answers
4k
views
When using Curve25519, why does the private key always have a fixed bit at 2^254?
When using Curve25519, the private key always seems to have a fixed bit set at position $2^{254}$.
Why is that? Is there any good reason to use a fixed positioned most-significant-bit in the private ...
- 694
30
votes
2
answers
13k
views
How to determine the order of an elliptic curve group from its parameters?
Let $\quad E:\; y^2 = x^3 + ax + b \quad$ be an elliptic curve defined over a finite field $\mathbb F_q$ where $q = p^n$, $a,b \in \mathbb F_q$ and $p \neq 2, 3$. By Hasse's theorem we know that the ...
- 665
30
votes
2
answers
5k
views
What does "birational equivalence" mean in a cryptographic context?
In a recent question on using the same curve for signing and ECDH it was noted for the Ed25519 curve and Curve25519:
Nitpick: the curves are birationally equivalent, not isomorphic.
Now this term ...
- 45.6k
30
votes
1
answer
18k
views
ECDSA Compressed public key point back to uncompressed public key point
From the ECDH demo here, if I generate a private key for Alice I can get _
P = 1175846487558108474218546536054752289210804601041
Which gives the following public ...
- 493
30
votes
1
answer
19k
views
How strong is the ECDSA algorithm?
Some cryptographic algorithms are as strong as the size of their key is, while other have some weaknesses that limit their strength (such as SHA-1). How strong is the ECDSA algorithm, and does that ...
- 1,659
28
votes
3
answers
39k
views
How can I use SSL/TLS with Perfect Forward Secrecy?
I'm new to the field of cryptography, but I want to make the web a better web by setting up the sites that I host with Perfect Forward Secrecy. I have a list of questions regarding the setup of ...
- 421
27
votes
3
answers
25k
views
Why is the P-521 elliptic curve not in Suite B if AES-256 is?
In the NSA's document, "The Case for Elliptic Curve Cryptography" (archived), we have
...
- 1,697
27
votes
2
answers
8k
views
Using same keypair for Diffie-Hellman and signing
Are there any security risks using a single key-pair for both key-exchange and signing?
I'm mainly interested in using Curve25519 for key-exchange and Ed25519 for signing. But similar combinations, ...
- 24.7k
26
votes
2
answers
9k
views
How does the MOV attack work?
What exactly is the MOV attack, how does it actually work, and what is it used for?
It's explained briefly here and I'd like to know what it is more / what is it fully used for.
- 699
26
votes
1
answer
24k
views
ElGamal with elliptic curves
I've searched some information on ECC, but so far I have only found Diffie-Hellman key-exchange implementations using ECC, but I don't want to exchange keys, I want to encrypt & decrypt data like ...
- 363
26
votes
1
answer
13k
views
How does ECDH arrive on a shared secret?
I read a brilliant, three part article on Elliptic Curve cryptography (one, two, three). It was able to explain Elliptic Curves to me in a way that didn't require a math degree to understand. The ...
- 983
25
votes
2
answers
7k
views
Why is it not possible to increase the size of RSA keys indefinitely?
According to this primer on elliptic curves by Ars Technica, when composite numbers get "too" big, they become easier to factorize with Quadratic Sieve and General Number Field Sieve.
While this is ...
- 361
23
votes
3
answers
13k
views
How effective is quantum computing against elliptic curve cryptography?
I've been reading the Wikipedia page on Elliptic-Curve Cryptography and I came across the following.
in August 2015, the NSA announced that it plans to replace Suite B with a new cipher suite due ...
23
votes
4
answers
5k
views
EC Schnorr signature: multiple standard?
I'm working on some EC-Schnorr signature code.
Reading various papers on that, it seems EC-Schnorr is not standardized as
well as ECDSA.
For example, I found two main differences in two main actors ...
- 413
22
votes
7
answers
10k
views
Current mathematics theory used in cryptography/coding theory
What are the mainstream techniques borrowed from algebraic geometry (or some other branch of mathematics) which are currently used in cryptography/coding theory? I've only heard about a small subset ...
- 441
22
votes
2
answers
17k
views
Which elliptic curves are quantum resistant? [closed]
If I want to learn about quantum resistant crytography what are the best resources? Which type of elliptic curves should I be studying?
- 329
22
votes
1
answer
13k
views
How many qubits are required to break RSA 2048 or 4096 with a universal quantum computer?
So in the news this week, IBM have created a universal quantum computer with 5 fully functional qubits. Logic and Moore's law dictates they will be able to scale this up to a lot more qubits within a ...
- 231
22
votes
1
answer
3k
views
Mapping points between elliptic curves and the integers
My primary question is:
Is there an easy way to create a bijective mapping from points on an elliptic curve E (over a finite field) to the integers (desirably to $\mathbb{Z}^*_q$ where $q$ is the ...
- 8,567
21
votes
2
answers
7k
views
Is there a feasible method by which NIST ECC curves over prime fields could be intentionally rigged?
The NIST elliptic curves P-192, P-224, P-256, P-384, and P-521, prescribed in FIPS 186-4 appendix D.1.2, are generated according to a well defined process, but using an arbitrary random-looking seed ...
- 137k
21
votes
1
answer
8k
views
Reasons for Chinese SM2 Digital Signature Algorithm
In the IETF RFC draft named "SM2 Digital Signature Algorithm" a signature algorithm is specified. The RFC does however not mention why this signature algorithm has been defined. Nor does it ...
- 91.1k
20
votes
1
answer
3k
views
Does Curve25519 only provide 112 bit security?
In a recent mail on the IETF CFRG mailing list it was claimed that:
The (currently missing) security considerations (or somewhere) should describe why Curve25519 is ok when used in contexts where ...
- 45.6k
20
votes
3
answers
9k
views
Why is Curve25519 in the GPG “expert” options?
The only way to access the Curve25519 curve in GPG is through gpg --expert --full-gen-key.
From my knowledge, Curve25519 is one of the most secure (and fast) ...
- 4,355
20
votes
2
answers
22k
views
How does Diffie–Hellman differ from elliptic curve Diffie–Hellman?
I didn't understand how ECDH actually works. Disclaimer: I know very little about elliptic curves.
Here is how DH works:
Alice and Bob agree on a prime number $P$ and a generator $G$. (They use one ...
- 201
20
votes
1
answer
4k
views
Using a single Ed25519 key for encryption and signature
The libsodium documentation contains a function crypto_sign_ed25519_pk_to_curve25519 that converts an Ed25519 key into a Curve25519 one, so it can be used for both ...
user2552
19
votes
3
answers
2k
views
Can deterministic ECDSA be protected against fault attacks?
In a paper by Barenghi and Pelosi, it was described that fault attacks could be used to derive the secret key when using deterministic ECDSA as described in RFC6979 by @Thomas_Pornin
Deterministic (...
- 361
19
votes
1
answer
2k
views
Why are elliptic curve variants of RSA "chiefly of academic interest"?
Yesterday I was thinking about elliptic curve variants of popular protocols/algorithms (ECDH, ECES[1], etc) and the thought occured that I had never seen an elliptic curve variant of RSA. My ...
- 38.4k
19
votes
1
answer
4k
views
What is the relationship between p (prime), n (order) and h (cofactor) of an elliptic curve?
I am reading up on ECC and having trouble understanding how these are related.
In a finite field, all point operations are taken modulo $p$.
$n$ is the order of the generator $G$ — which apparently ...
- 465
19
votes
1
answer
2k
views
Compressing EC private keys
For reasonable security, EC private keys are typically 256-bits. Shorter EC private keys are not sufficiently secure. However, shorter symmetric keys (128-bits, for example) are comparably secure.
I ...
- 4,709
18
votes
5
answers
6k
views
Is there a situation where RSA cannot be replaced with ECC + symmetric algorithms? If no, why do we still use it?
RSA is both an asymmetric encryption algorithm and a digital signature algorithm. However, in recent years, many cryptographic protocols (TLS, for example) have moved away from the use of RSA to ...
- 562
18
votes
3
answers
6k
views
How does ECC go from decimals to integers?
I realise that elliptical curves are tricky, but there's one aspect that no one seems to explain. I've looked, and it's towards the beginning. This is the traverse over a red curve:-
This is only ...
- 15k
18
votes
1
answer
23k
views
Is there any difference between NIST and SECP curves in-terms of their algorithms and implementation?
I'm implementing ECDSA for NIST P-256 curve. I just want to know if the same implementation will also work for SECP curves? If it doesn't, can you point me to one or more references of algorithms for ...
- 605
18
votes
1
answer
17k
views
How does encryption work in elliptic curve cryptography?
So I think I understand a good amount of the theory behind elliptic curve cryptography, however I am slightly unclear on how exactly a message in encrypted and then how is it decrypted.
So my ...
- 461
18
votes
1
answer
4k
views
After ECDH with Curve25519, is it pointless to use anything stronger than AES-128?
Is the following reasoning correct:
After ECDH with Curve25519, the resulting shared secret will be an EC public key with a bit strength of 128 bits.
This public key would then be hashed (let's say ...
- 4,672
18
votes
2
answers
4k
views
Schnorr signatures: multisignature support
Schnorr signature is mentioned as a promising upgrade to bitcoin to improve scalability. It support multisignature, several signatures can be aggregated into a single, new signature. But I fail to ...
- 367
18
votes
1
answer
4k
views
How to calculate elliptic curve parameters?
I'm having a rough time understanding the math behind elliptic curves.
I want to implement ECDH where user can define a, b, and p parameters of elliptic curve.
How can I calculate generator base ...
- 181
17
votes
4
answers
31k
views
How does one calculate the scalar multiplication on elliptic curves?
I found this example online:
In the elliptic curve group defined by
$$y^2 = x^3 + 9x + 17 \quad \text{over } \mathbb{F}_{23},$$
what is the discrete logarithm $k$ of $Q = (4,5)$ to the base $...
