# Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

1,900 questions
Filter by
Sorted by
Tagged with
1 vote
11 views

### Does an binary elliptic curve like sect571r1 support a bijective asymmetric operation pair on bytes? If so, is there a self-contained example?

I'm wondering if a binary elliptic curve (such as sect571r1 aka B-571) supports pairs of asymmetric operations (for example, either sign/verify or encrypt/decrypt) on a fixed bit or byte input size in ...
572 views

### EC has lower CPU consumption than RSA under what condition?

When I searched Google, the top result said On average, processing for ECC is about four times less CPU-intensive than for RSA. Yeah, but under what condition? The page says "A 256-bit EC ...
59 views

### Is Index Calculus Attack on hyperelliptic curves feasible with a common laptop?

I am studying this paper about an index calculus attack in hyperelliptic curves for genus $3, 4, 5, \dots, 9$. Nicolas Thériault, Index calculus attack for hyperelliptic curves of small genus, 2003. ...
75 views

### Does the ECDSA private or public keys contain data about the signature hash algorithm?

:-) Hello I was wondering if the signature hash algorithm was a part of the private key or just the signing process? Should a signature instance depend on the private key? (Of course, still talking ...
164 views

### How are the unified addition formulae in extended twisted Edwards coordinates derived from the affine addition formulae?

I am trying to understand point addition in RFC8032 section 5.1.4, which references the paper "Twisted Edwards Curves Revisited" (https://eprint.iacr.org/2008/522.pdf) to describe the quick ...
234 views

### Find Ed25519 Y Coordinate from X Coordinate

Are there any available formulas to determine a $Y$ coordinate given only an $X$ for the Ed25519 curve? The closest thing I've come to find is the recover_x(y, sign)...
165 views

### Is it true that Public keys with even y coordinate correspond to private key that are less than n/2 and vice versa? (Secp256k1)

The question is somewhat complex and directed to clearing things out. Suppose that $n$ is the order of the cyclic group. It $n - 1$ is the number of all private keys possible ...
741 views

198 views

### Using Microsoft SIDH library for messages signing

SIDH library looks good but lacks documentation and samples. The only signature-related code was found at http://github.com/yhyoo93/isogenysignature/blob/master/tests/kex_tests.c appeared not able to ...
49 views

### Why g is 2 and 3 to derive the lambda and beta values for endomorphism on the secp256k1 curve?

As you can seen here, in hex, N and P are: N = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141 P = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F The ...
161 views

### Will a semi-hyperelliptic pairing be used in real-world cryptography if it is faster than state-of-the-art elliptic pairings?

Let $\mathbb{G}_1$, $\mathbb{G}_2$, $\mathbb{G}_T$ stand for three groups of the same large prime order $r$. I invented a pairing $e\!: \mathbb{G}_1 \times \mathbb{G}_2 \to \mathbb{G}_T$ (with ...
166 views

### ECCDH: direct or with temporary ECC keypairs?

I am moving from RSA to ECC for my application. Looking at these posts 1 2 3, they all suggest that Alice generates a temporary (ephemeral) ECC keypair eKP to send a message to Bob. The sessionkey sK ...
47 views

### Check if pubkey belongs to twisted Edwards25519

I want to check if some pubkey belongs to twisted edwards25519 (I guess this is used for ed25519 ?) The problem is that I have in theory some valid pubkeys like: ...
421 views

### Replacing Curve25519 with Ristretto255

Quoting Ristretto255 for the PHP Community, Ristretto255 is Ristretto defined over Curve25519, which allows cryptographers to extend the Ed25519 signature scheme to support complex zero-knowledge ...
1 vote
39 views

### How do I calculate number of multiplication, exponential, and pairing operations in a cryptographic algorithm (signcryption/unsigncryption)?

I have been working on signcryption scheme and its security proof. I want to compute the efficiency in terms of number of scalar multiplication operation, number of exponential operations, and number ...
1 vote
186 views

### How to know that MAC isn't modified in ECIES

I am new to ECC but I was wondering, If there is a situation where instead of the ciphertext being falsified, the sent MAC was tampered. How does the receiver verify that the ciphertext is still ...
66 views

### How does the ECIES-AES encryption work with a key size that is not supported by AES?

I am currently studying and implementing ECC algorithms but I encountered a problem. I want to use Secp521r1 for generating a shared key and encrypting with ECIES using AES256 but AES-256 requires a ...
1 vote
132 views

### Assuming secp256k1 curve and given fixed (but random) $h$ and $d$ values, is it possible to calculate a $k$ such that $h\equiv(k\,G)_X\,(k-d)\pmod n$?

For generator point $G$ in the secp256k1 curve, I want to find a value $k$ such that: $$h\equiv(k\,G)_X\,(k-d)\pmod n$$ where $n$ is the group order, and $(k\,G)_X$ indicates the x-coordinate (mod n) ...
255 views

### Are the FIPS 186-5 and ANSI X9.142-2020 definitions of ECDSA consistent?

FIPS 186-4 Digital Signature Standard defers to ANSI X9.62-2005 for the specification of ECDSA, with additional requirements set out in Chapter 6 and Appendix D. However, X9.62-2005 has since been ...
1 vote
100 views

### ECC Range proof

In ECC, the proof showing that given $G$, $x$ and $y$ is in the range $[-z,z]$ is known as the range proof. Related to: Proving that two points on elliptic curve are within range So, if: $$H=xG−yG$$ ...
4k views

### "Probability" of an ECDSA signature

The article Elliptic Curve Digital Signature Algorithm in Bitcoin's wiki talks about signatures having probabilities (as in ...
1 vote
88 views

### Zero secret key in EC ElGamal: standards vs theory

I'm a bit confused by the standards and some replies regarding zero (the point at infinity) in elliptic curves ElGamal. TL;DR: Why do some people recommend excluding zero? It has nothing to do with ...
277 views

### Is this distributed random oracle scheme safe?

This question comes from an issue raised in another question: Non interactive threshold signature without bilinear pairing (is it possible)? Is the proposed random oracle model safe when trying to ...
45 views

59 views

### Proof that user compressed public key corresponds the curve equation (secp256k1)

I am trying to check if some compressed public key corresponds to an elliptic curve equation (secp256r1). As far as I know it should be valid once the following equation is fulfill y^2 = x^3 + ax + b ...