Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

Filter by
Sorted by
Tagged with
4
votes
1answer
76 views

Simple explanation of sliding-window and wNAF methods of elliptic curve point multiplication

I'm trying to understand the implementation of elliptic curve point multiplication. I can easily understand the naive double-and-add algorithm, but I'm struggling to find a good explanation / example ...
9
votes
2answers
668 views

How are points on an elliptic curve discretized?

I'm a working programmer (read: a person without a maths degree) trying to get a better grasp on elliptic curves specifically in the context of elliptic curve cryptography (though to be clear, this is ...
2
votes
1answer
165 views

What is the ChainOfFools/CurveBall Attack on ECDSA on Windows 10 CryptoAPI

What is the ChainOfFools/CurveBall Attack on ECDSA on Windows 10 CryptoAPI (Crypt32.dll) Could someone provide details?
1
vote
1answer
103 views

How to divide 2 coordinates on elliptic curve? [closed]

On the elliptic curves, there is no divide function, and I need divide coordinates - X/Y, o I need not divide but make (X minus or multiply to "modified" Y). How to modify Y?
-3
votes
0answers
22 views

ElGamal Elliptic Curve Cryptosystem & Menezes-Vanstone Elliptic Curve Cryptosystem

Hello everyone and Good day .. I modified the elgamal elliptic curve and menezes-vanstone elliptic curve cryptosystem, and I need to test them on attacks to appear how it strong. How can i testing, ...
3
votes
1answer
166 views

Is this distributed random oracle scheme safe?

This question comes from an issue raised in another question: Non interactive threshold signature without bilinear pairing (is it possible)? Is the proposed random oracle model safe when trying to ...
0
votes
1answer
58 views

Why are ed25519 keys not recommended for encryption?

Was wondering why there is no straightforward way of using ed25519 keys for encryption. Then I found this: https://github.com/indutny/elliptic/issues/108 There it is stated that it's unlike RSA not ...
6
votes
0answers
115 views

Iterations of pollards kangaroo attack on elliptic curves

I want to understand the Pollard kangaroo attack on elliptic curves. I found this Pollard's kangaroo attack on Elliptic Curve Groups Q/A pretty helpful, but not complete. The posts provides a pretty ...
3
votes
1answer
641 views

Why do the subexponential algoriths for the DLP not work for the ECDLP?

Elliptic curve cryptography is much more secure for the same parameters because attacks that work on the DLP do not work on the ECDLP. Why do the attacks fail in the latter case?
2
votes
0answers
46 views

MOV-attack on ecc: Time complexity and example

There already is this pretty big post about the MOV-attack. It states, that the discrete logarithm problem on elliptic curves can be transformed to a discrete logarithm problem over a finite field. ...
4
votes
1answer
122 views

ECC: application of multiple multiplicative inverses

I've recently read about "Montgomery trick" on Application of Montgomery's Trick to Scalar Multiplication by Pradeep Kumar Mishra and Palash Sarkar which provides a way to compute several ...
2
votes
0answers
44 views

What is a formula of a twist?

With the curve secp256k1, the order of the twist is 3×197×1559×96769×146849×2587814237219×375925338294461779×101009178936527559588563023359 But I can't understand what is formula of this twist(twist ...
1
vote
0answers
55 views

Quantum computers and elliptic curves

I know, that quantum computers can theoretically break the discrete logarithm problem using the shor algorithm. The problem with quantum computers is not the time, but the space ( the needed qubits ). ...
2
votes
1answer
104 views

Calculate a base point on the twist of secp192k1 with maximal order

I want to calculate a base point on the twist of secp192k1 with maximal order. ...
0
votes
1answer
45 views

Choosing UWP encryption algorithms

I've just come across the large variety of encryption ciphers available in the UWP WinRT API, both symmetric and asymmetric. I'm trying to figure out which are commonly seen as the most favourable ...
0
votes
0answers
26 views

Where can I find references to the theory behind PBC library?

I don't know if this is the right place to ask this type of question. Anyway, I'm using PBC library for a project, but I'm a very newbie for what concerns pairing based cryptography. Then I ask some ...
4
votes
1answer
141 views

Curve25519/Montgomery curves points with order 8

I found this post about Curve25519. It states, that there are only 5 points with a very low order. With this paper I was able to understand, how the points with order 2 and 4 were computed. My ...
1
vote
1answer
106 views

Smart's attack for secp256k1 does not work

This is the Sage code that I use, and the results I get: ...
0
votes
0answers
162 views

Fast Extended Euclidean Algorithm in Harley's elliptic curves point counting method

Could you help me with Harley's norm computation algorithm that is based on the Fast Extended Euclidean Algorithm that was suggested by Harley in an email to NMBRTHRY list in 2002 and that described ...
4
votes
1answer
135 views

Diffie-Hellman: difficulty of computing $g^{x^2}$ given $g^x$?

Hoepfuly a simple question. Given a group where the CDH problem is hard, if the adversary sees a public key $g^x$, is it easy or hard for the adversary to compute $g^{x^2}$? My intuition says it ...
1
vote
1answer
69 views

Find Consecutive X-Coordinate algorithm

The question is as follows: Is there an algorithm to calculate a $(x,y)$ pair which is consecutive to an existing $x$-Coordinate on an elliptic curve? Background Information for the curve: Known ...
0
votes
1answer
59 views

Using xor encryption in the following use case

I use an encryption scheme based on a symmetric cipher, with the corresponding symmetric key encrypted with RSA/OAEP using the public RSA key of the recipient. I now want to use ECC crypto in ...
1
vote
2answers
144 views

With RSA or ECC, if I encrypt my private key with my public key, is there a way to recover my private key?

Is there an algorithmic, mathematical, technical or implementation "hack" to recover the private key or is it definitively encrypted without any particular mathematical property, like any ...
0
votes
0answers
36 views

Elliptic curve group inverse addition in OpenSSL

I am using group P-256 on OpenSSL with C++. My understanding was that, if you have a point $xP$ and then calculate (xP)^(-1) with EC_POINT_invert(group, xP_inv, ctx), then when I calculate: xP + (xP)^(...
1
vote
1answer
104 views

Is it possible to compute the y-coordinate of a point on SECP256K1, given only the x-coordinate

Given an x-coordiante of a point on the SECP256K1 curve, is it possible to calculate the corresponding y-coorindate? (Assuming the point is a verifying public key that complies with the Bitcoin ...
-1
votes
0answers
43 views

Why is my ECC key not 32 bytes?

I have generated an ECC Key, Secp256k1, using a variety of means: OpenSSL, EC-Key npm, and even an online generator. Every time I write this key to a file and check the size, it is more than 32 bytes (...
2
votes
2answers
360 views

Are the asymmetric roles of the two keys in the elliptical curves the same (as for RSA)? Can they be interchanged indifferently?

More precisely, and as for RSA, is it really true that it is not feasible to recirculate one of the keys knowing ONLY the other with the Elliptic Curves, as for RSA? Or does ECs work differently on ...
2
votes
0answers
77 views

Pollard Rho Optimization

One of the most important attacks on Elliptic Curve cryptography is Pollard's Rho method. The effect on security can be seen on SafeCurves. This attack is pretty old and there has been a bunch of ...
1
vote
1answer
72 views

Can I convert $F_{q^{12}}$ to $F_q$?

I seeing a paper about Elliptic curve based proxy re-encryption. And I want to implement this through BLS12-381 Curve. However, When looking at the documentation for paring or the library, the value ...
2
votes
0answers
73 views

Curve25519 Attacks and Security

Curve25519 is a pretty secure way to exchange a key. In the original Paper and on SafeCurves a lot of attacks and security aspects are mentioned: Attacks: Brute force: This one is theoretically ...
10
votes
2answers
1k views

Is it safe to reuse ECDH asymmetric keys for authentication?

Alice, Bob, and Carol each generate ECDH keypairs. Alice and Bob establish a communication channel and negotiate an AliceBob secret. The question is: Is it safe for Alice and/or Bob to reuse their ...
4
votes
3answers
1k views

What is the point at infinity on secp256k1 and how to calculate it?

I hear that there should be a point at infinity on secp256k1. I wounder how to calculate it and what does it even mean. I tried to calculate it as $P_{inf}=P+(-P)$ but this gives different results for ...
1
vote
1answer
54 views

What is different between G1×G1→GT and G1×G2→GT in the bilinear pairing?

It is an implementation of the bls12-381 algorithm known as pairing-friendly, at GitHub. Looking at this, the pairing parameters are $G_1$ and $G_2$, $G_1$ is the point of $F_q$, $G_2$ is the point of ...
1
vote
1answer
44 views

What is the order of the Identity point on prime order elliptic curve groups?

I'm trying to understand how the identity point is represented in a group of prime order. What I think is correct: If the group has even order, then the identity point is in the group, because the ...
6
votes
0answers
124 views

Which is the smallest safe elliptic curve (bit-length)?

At https://safecurves.cr.yp.to/ some elliptic curves are listed which passed certain security tests. The smallest bit-length of a safe curve listed there is 221 bits. At wiki page discrete logarithm ...
1
vote
1answer
66 views

Pohlig Hellman and small subgroup attacks

While studying Curve25519 I read about the small subgroup attack in chapter 3. So far i know, that you need a point with a small subgroup to do such an attack. Curve25519 has a basepoint with prime ...
1
vote
1answer
90 views

Performing EdDSA/Ed448 employing Montgomery ladder

EdDSA can be efficiently performed employing the Montgomery ladder. In order to implement this method, the base point should be converted to Mont. space, then the Mont. ladder should be executed, and ...
2
votes
0answers
91 views

All Curve25519 Parameters with Explanation

I'm trying to sum up all Curve25519 parameter and specification reasons. Can you tell me if I missed some important reasons or parameters in the following list?: Curve: Montgomery Curve. $M_{A,B}: By^...
3
votes
1answer
142 views

Likelihood of signature collision with EdDSA

Taking EdDSA as an example, given the length of a signature is 512-bits for a given data payload, what is the probability of a collision where there is another 512-bit value that is also a valid ...
159
votes
4answers
107k views

Why is elliptic curve cryptography not widely used, compared to RSA?

I recently ran across elliptic curve crypto-systems: An Introduction to the Theory of Elliptic Curves (Brown University) Elliptic Curve Cryptography (Wikipedia) Performance analysis of identity ...
2
votes
2answers
567 views

How do I multiply a Twisted Edwards point in Montgomery space?

EdDSA (and ed25519) signatures require a scalar multiplication. Currently, I do this directly in Twisted Edwards space. (The code can be found in my crypto library.) My research and my tests ...
3
votes
0answers
106 views

Check validity of generated parameters for SIDH

In section 4.1 of the paper Towards quantum-resistant Cryptosystems From Supersingular Elliptic Curve Isogenies by Feo, Jao and Plût it is described how you generate valid parameters for the SIDH ...
3
votes
1answer
50 views

Are skeleton keys possible for ECCDSA?

As alluded to here (split-key vanity addresses for bitcoin), ECCDSA-keys can be merged such that the sum of two private keys $S=S_1+S_2$ yields a public key which is the sum of the respective public ...
0
votes
1answer
34 views

Curve25519 base point speed up

In the paper regarding Curve25519 DJB defines the base point to be $P_{base} = (9,y)$. The main reason for choosing it this way is, that $P_{base}$ has a big prime order which gives security ...
1
vote
1answer
45 views

Hash into elliptic curves for private set intersection

Would it be insecure to hash a message $m$ to an elliptic curve point by multiplying it to some generator $G$ for the purpose of a private set intersection ? $$ M = hash(m) * G $$ I keep seeing ...
1
vote
2answers
97 views

Curve25519 function, scalar multiplikation

This is the main paper for Curve25519. In section 2: Specification there is a important theorem. In this theorem Bernstein defines the function $X_0 : E(F_{p^2}) \rightarrow F_{p^2}$. First Question:...
3
votes
1answer
69 views

Curve25519 key structure

In the paper regarding Curve25519, the set of public keys $q$ is $\{q : q\in \{ 0,1,2,...,2^{256} - 1\}\}$ and the set of private keys $n$ is $\{n : n\in 2^{254} + 8 \cdot \{ 0,1,2,...,2^{251} - 1\}\}$...
3
votes
1answer
48 views

Curve25519 extension field

The paper regarding curve25519 presents a theorem in chapter 2 (specification). The extension field $F_{p^2}$ is used in this theorem. I don't understand why this extension field is needed for the ...
1
vote
1answer
1k views

Is ECDH(E) Key Exchange FIPS 140-2 compliant?

We have read dozens of documents now - some that contradict each other - and cannot find a solid source of truth. Does FIPS 140-2 compliance allow for the use of elliptic curve cryptography as a key ...

1
2 3 4 5
30