# Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

2,196 questions
Filter by
Sorted by
Tagged with
710 views

### Why does Ed25519 use a twisted Edwards curve rather than a regular Edwards curve?

I'm trying to understand benefits of using Twisted Edwards curve over regular Edwards curve. I'm aware of some properties of Twisted Edwards curve that regular Edwards curve missing like isomorphism ...
1k views

### Security of McCallum-Relyea exchange

I recently learned of the McCallum-Relyea exchange which allows for a method of key escrow without actually transmitting the key. It was developed at RedHat and is used by the tang and clevis ...
1 vote
66 views

### Secp256k1 giving y-value for inverse of point

Given a secp256k1 point $P$ with scalar 3 where: $P = 3*G$ You get a point with co-ordinates: ...
16 views

### Safety per bit DHKA and ECDH

I have a project where I compare the classical Diffie Hellman key agreement with its implementation with elliptic curves. Therefore I need a list with the safety per bit. Does anyone know where I can ...
1 vote
73 views

### Is generating random blake256 hashes until packed points is on the curve, a safe algorithm to avoid the discrete log between the generated points?

I know there’re many questions that ask how to safely HashToCurve, but I want to know if the method I found in an actual implementation is secured against the ...
257 views

### Why we use specifically Jacobian Groups for HECC?

The following is stated in this answer on "What is so special about elliptic curves?": But for these curves, an excellent geometric rule does not exist to add points, like in conics and ...
1 vote
72 views

### Scalars that are both Additive and Multiplicative inverses on secp256k1

I believe I have found two scalars (a) and (b) that are both additive and multiplicative inverses on the secp256k1 elliptic curve. So scalars (a) and (b) meet the following criteria: [𝑎+𝑏≡0 (mod 𝑛)]...
26k views

### ECDSA Signature R|S to ASN1 DER Encoding question

I am trying to test my understanding on ECDSA Signature r|s to ASN.1 DER Encoding for NIST P-256. I have r|s and when I convert ...
209 views

### Size of $E$ over $\mathbb{F}_p$ contains $p+1$ points

I am struggling to prove this claim: I proved that the map $x\mapsto x^3+1$ is a bijection from $\mathbb{F}_p$ to itself if we have that $p\equiv 2\bmod{3}$. We have to use this fact to prove that ...
2k views

### Difficulty of Reversing Elliptic Curve

In ECC, it is apparently easy to verify the final point given the starting point and the number of hops. But it is difficult to compute the number of hops given just the starting point and the final ...
2k views

### Find ECDSA PrivKey to PubKey = 0

I know it should be impossible (or at least infeasibly hard) to extract a ECDSA Private Key from a given Public Key (discrete logarithm problem). But I'm not deep enough into ECC to find an answer to ...
109 views

### Elliptic Curve Cryptography: Point Multiplication by 3 on secp256k1 Curve

Is there a direct non-iterative formula for point multiplication by 3 in the secp256k1 elliptic curve just like point multiplication by 2 (point doubling)? If such a formula exists, could you explain ...
168 views

### can we modify the prime field by increasing it in secp256k1?

If in ECDSA secp256k1 we have the prime field p=2256 - 232 - 29 - 28 - 27 - 26 - 24 - 1, can we increase it to p=2256, if we keep the double and add operations the same, the curve equation the same ...
1 vote
130 views

### Example of elliptic curves endomorphism construction

I've started learning about complex multiplication (CM) on elliptic curves. For clarity (and intuition), I want to make some basic example of elliptic curves endomorphism construction for a concrete ...
1 vote
38 views

### Montgomery Powering Ladder for long weierstrass equations

My question is the following: I know that for elliptic curves in short weierstrass form, I have the following "one-coordinate addition" formula: Let $P = (x_p,y_p), Q = (x_q, y_q)$. If I am ...
1 vote
983 views

### What is the order of the generator point G=9 in curve25519?

In Curve25519 we typically have this generator point or base point: ...
1 vote
188 views

### Exponentiation Problem of G2 in MNT curve

I made a simple python program in the Charm framework (https://github.com/JHUISI/charm): ...
1k views

### How to find at least one private key from a large list of compressed public keys secp256k1

Not long ago I saw a discussion on the Bitcoin Talk forum: https://bitcointalk.org/index.php?topic=5060735.msg50736695#msg50736695 Please give advice and working methods? Is it possible to find at ...
3k views

### Why is it impossible to find the private key from the public key?

From what I understand, based on the article A Beginner’s Guide: Private and Public Key Cryptography Deciphered, the public key is generated by performing $n$ tangent plus mirroring operations from ...
1 vote
585 views

### Can we retrieve his private key using his public key in ECC?

A paper wallet is the name given to an obsolete and unsafe method of storing bitcoin which was popular between 2011 and 2016. It works by having a single private key and bitcoin address, being printed ...
62 views

### Getting the slope of a public key given its x and y coordinates

Is it possible to get the slope of a public key given its $x$ and $y$ coordinates? Since all the ECC calculations come from geometry, I thought this calculation might be possible.
63 views

### diffie hellman key exchange compared with ECDH [closed]

I have to write a paper about the Diffie Hellman key agreement. I want to focus on the implementation with elliptic curves and comparing the safety for selected attacks such as Pollards Rho and ...
174 views

### Questions related to Hyper Elliptic Curve Cryptography

I have read the wikipedia section related to HECC (Hyper Elliptic Curve Cryptography) and various questions opened in the current Cryptography Stackexchange site. But I need some help on the following ...
125 views

### Is the D = D1 + D2 of HECC the equivalent of the P + Q tangent-and-chord method as occurs in ECC?

I am reading about Hyper Elliptic Curve Cryptography here: https://en.wikipedia.org/wiki/Imaginary_hyperelliptic_curve#The_divisor_and_the_Jacobian In Elliptic Curve Cryptography we have the tangent-...
69 views

### wrting algorithm for torsion group elements

Yesterday,I took an exam. There are two questions I received very low points. I will write the first question in this post. The question says let $E:y^2:x^3+kx+1$ in GF(p) be an elliptic curve where p ...
386 views

### Implementing ECDSA threshold using a secret sharing scheme

My question might be a duplicate but I wasn't able to find a similar question. I recently developed a wallet-like app and I am trying to implement some MPC features. I searched a little and even asked ...
1 vote
147 views

### What’s the fastest known Koblitz curve addition law for FPGA that maximizes the per-LUT throughput?

The addition or multiplication laws used by large mainstream libraries achieve faster speed by using many many more operations in order to avoid larger numbers. And my problem is here: faster speeds ...
26k views

### ElGamal with elliptic curves

I've searched some information on ECC, but so far I have only found Diffie-Hellman key-exchange implementations using ECC, but I don't want to exchange keys, I want to encrypt & decrypt data like ...
185 views

### Finite Fields and security level in HECC (Hyper Elliptic Curve Cryptography)

How to calculate the security level for HECC (Hyper Elliptic Curve Cryptography) genus = 2, 3, for a Finite Field of 128-bits or 256-bits or 512-bits, by following the below rationale of the ECC here: ...
27k views

### How does recovering the public key from an ECDSA signature work?

It is possible to recover the public key from an ECDSA signature values $(r,s)$? Please explain how this works.
1 vote
116 views

### Is it safe to reuse the same scalar when doing direct scalar multiplication on Koblitz curves?

Let $s$ be a private key and $k=intAsScalar(s)$. Finding $s$ from $P_k=[k]G$ involves solving the Elliptic curves discrete logarithm problem. But what if the same $k$ is also used for performing 1 or ...
42 views

### SDLog - looking for papers

Reading trough SEC 1 V2.0 in txe appendices there is a mention of a elliptic curve semi logarithm (ECSLP) being used to forge ECDSA signatures. I am looking for papers on that problem and have been ...
103 views

1 vote
50 views

### Is there any reference about the half-trace when m is even in F(2^m)

There is a algorithm listed in D.1.6, Algorithm 3, it seems that it is used to solve the quadratic equation when $m$ is even in $F(2^m)$. However, I can not find any reference about this algorithm, as ...
1 vote