Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

Filter by
Sorted by
Tagged with
6
votes
1answer
90 views

Why do Edwards curves protect against side-channel attacks?

From Wikipedia: One of the attractive feature of the Edwards Addition law is that it is strongly unified i.e. it can also be used to double a point, simplifying protection against side-channel ...
0
votes
1answer
46 views

Why public key has two parts in my secure messaging client similar to signal

I am working on a Golang code similar to Signal protocol. I need to modify it. I am confused on tripartite Diffie-Hellman handshake part of code, i.e. why public key has two separate parts as compared ...
1
vote
1answer
47 views

What is the possibility of collision of trailing 160 bits of Keccak_256, for any two differing public-keys as pre-images?

Earlier today I was answering a question on the ethereum SE site that analyzed the potential for more than one private key on curve secp256k1 (which maps to a distinct public key) to control the same ...
10
votes
3answers
4k views

Are all possible EC private keys valid?

I usually generate a key pair using OpenSSL or Bouncy Castle. I'm using curve secp256k1. The 256bit private keys look fairly random. Do all values of "private ...
9
votes
2answers
558 views

What does the special form of the base point of secp256k1 allow?

The popular ECC parameters secp256k1 are documented in SEC2 as using curve $y^2\equiv x^3+a\cdot x+b\pmod p$ with $a=0$, $b=7$, $p=2^{256}-2^{32}-\mathtt{3d1_h}$, base point $G$ with the apparently ...
2
votes
1answer
61 views

Elliptic Curve Discrete Log in a Composite Ring

Elliptic curves are usually defined over prime rings (fields), but what if we chose a ring of composite order? Let $n = pq$ for $p,q$ large primes. Say I have elliptic curve $y^2 = x^3 + ax + b$ over ...
0
votes
0answers
36 views

Generating anomalous elliptic curves with given order [closed]

First of all please see this paper, I want to fully understand the section 3 and 4 of this paper and write a script that generates an anomalous elliptic curve with given prime order. Furthermore how I ...
0
votes
1answer
61 views

RSA vs Elliptic Curves

I am currently reading about how more efficient and ''light'' is ECC compairing to RSA as far as key generation is concerned. My question is simple, why does RSA continue to be used today (ex.SSL) ...
3
votes
0answers
47 views

Hash multiset to point on elliptic curve where $A = 0$

I want to hash a multiset to a point on the elliptic curve $y^2 = x^3 + 3$ over a finite field of some 254-bit prime order, where $P = 3 \pmod 4$. Moreover, I want this hash to be incremental, in that ...
0
votes
1answer
71 views

Learning elliptic curve cryptography for specific application

I would like to develop a protocol for specific purpose. This protocol will utilize asymmetric cryptography in which one private key can be paired with numerous public keys: messages encrypted with ...
1
vote
1answer
93 views

Can the RSA accumulator scheme be converted to Elliptic Curve math?

Is it possible to translate the RSA accumulator scheme directly to EC without requiring bilinear pairings? In RSA we have: $A_{n+1} = A_n^c$ st. $\{c \: \textrm{prime} \: | \: c \in [\...
4
votes
1answer
71 views

secp256k1 point density

I am working on a crypto project using the secp256k1 elliptic curve. I know that I can select a random point $P = (x, y)$ from the curve by randomly selecting the first coordinate $x \in \mathbb{Z}_p$...
0
votes
1answer
56 views

Elliptic curve with prime subgroup equal to field size

I am aware that when the equation $\#E(\mathbb{Z}_p) = p$ holds for prime $p$, the elliptic curve is called "anomalous" and is insecure do to "Smart's attack". Consider the similar case that $E(\...
1
vote
2answers
64 views

“Dave Check” for a tweakable P-256 ECDH KDF

I have two devices with hardware tokens that contain P-256 private keys, and which allow me to compute ECDH shared secrets with arbitrary public keys. I need to build a tweakable key derivation ...
1
vote
2answers
65 views

Using public-key signature instead of having API key

I am designing an application that will need an API key. At first I believed that generating a long, random token would be secure enough (say 32 chars string that includes 0-9, a-z and A-Z), and then ...
1
vote
3answers
251 views

Is the curve25519 algorithm a special(implementation) one of ECDH?

It's the first time for me to learn about Key Exchange Protocol. And I thought that in both ECDH and DH there is a necessary step to share some public infomation(the common parameters) to each sides ...
0
votes
1answer
372 views

Given an elliptic curve, how do I calculate the order of the points manually, when we don't know about the curve's points?

So basically all I can do is use Lagrange's Theorem and figure which factors of the group order are in line, then start trying each of these using the Double-and-Add-Algorithm until I get $\mathcal{...
-1
votes
1answer
61 views

P256 Key size and validation [duplicate]

Given a public key on the P-256 Curve is it correct to say that the public key is 64 bytes long ie. (x,y)? Secondly is the private key 32 bytes long? if so, how is the private key generated and why ...
0
votes
2answers
83 views

Discrete logarithms on elliptic curves

In many examples of attacks on public key cryptography, examples of the form $a ^ x = b$ are used, but I can not understand the correlation between this and the multiplication of the generator point ...
3
votes
2answers
233 views

Why do elliptic curves require fewer bits for the same security level?

I'm studying the basics of cryptography and I didn't understand why elliptic curves use fewer bits. For example, finite-field Diffie-Hellman needs at least 1024 bit and it's a DLP, but elliptic ...
0
votes
0answers
29 views

Is there an O(1) in space complexity k-of-n signature scheme?

I was looking in depth into Schnorr signatures recently, and while they are very attractive for their ability to be aggregated, this only works for n-of-n ...
11
votes
1answer
2k views

After ECDH with Curve25519, is it pointless to use anything stronger than AES128?

Is the following reasoning correct: After ECDH with Curve25519, the resulting shared secret will be an EC public key with a bit strength of 128 bits. This public key would then be hashed (let's say ...
2
votes
1answer
282 views

Sextic twist of BN pairing parameters vs security

I've previously asked questions on BN pairing parameters. Here's one more. In the BN construction, one is working in a subgroup of a curve over an extension field $\mathbf{F}_{p^{12}}$ for some ...
-1
votes
1answer
72 views

Is that possible to calculate modular inverse of a point on elliptic curves?

Imagine that you are given a point $P$ so that $P=a\times G$. If you have no knowledge of $a$ is that possible to calculate point $I$ so that $I$ is the modular inverse of $P$? We know that over ...
2
votes
1answer
88 views

Is there any asymmetric encryption algorithm for eliptic curve(secp256k1) without AES? [duplicate]

I am looking for asymmetric encryption using SECP256K1. But all over the internet, I see that it also requires AES encryption. Instead of generating an AES secret key, is it possible to encrypt using ...
13
votes
2answers
569 views

Is it safe to reuse a ECDSA nonce for two signatures if the public keys are different?

We denote the s value of an ECDSA signature $(r, s)$ on a message $m$ as: $s=\frac{H(m)+xr}{k}$ Assume two ECDSA signatures sharing the same nonce $(r, s_1) , (r, s_2)$ on two messages $m_1, m_2$, ...
2
votes
2answers
88 views

Talking TLS with EC cryptography and the secp256k1 curve [duplicate]

How reasonable would it be to speak TLS over the secp256k1 curve? My initial experiments show that OpenSSL supports it (albeit with special flags, see below): Running an OpenSSL client against an ...
0
votes
0answers
32 views

ECDSA dA multiplication algorithm [duplicate]

I was looking at this question and i can`t understand this part: QA = dA G = 5 (5,1) = (9,16) I saw that algorithm used for this was Double-and-add algorithm but i didn't get it. Can ...
4
votes
2answers
547 views

ECDSA: Why is SigningKey shorter than VerifyingKey

Total Crypto Noob here. I was wondering why in ECDSA the Signing Key is so much (half of) shorter than the Verifying key? Lets look at some python code: ...
0
votes
1answer
51 views

Elliptic Curve Cryptography messages vs keys encryption [duplicate]

I have read a few tutorials about ECC implementaiton in C. What I am confused is this: Can I encrypt messages with ECC and without the use of any other algorithm, like AES, RSA or should I use them ...
1
vote
1answer
45 views

ECDH for more than two parties

With classic diffie-hellman it's possible do it with more than two parties. Is this applicable to elliptic curve diffie hellman? I'm guessing not. With ECDH you have a scalar number as the private ...
8
votes
1answer
1k views

Pollard's kangaroo attack on Elliptic Curve Groups

Let's say I've intercepted some bits of a Diffie-Hellman private key: $x = n \mod r$. I can get the remaining bits by doing a kangaroo search. This algorithm works over $\mathbb{F}_p$. Can it be ...
1
vote
0answers
45 views

GPG implementation of ECC “Encryption” (ECDH) vs RSA

My understanding of GPG with traditional RSA keys, is that RSA is by definition can be used to both sign and encrypt. This is because RSA can be directly applied to plaintext in the following form: <...
1
vote
0answers
35 views

How to use Montgomery arithmetic for elliptic curves (FIAT cryptography)

Let us consider the source code for curve P-256 from BoringSSL. This source code can be found here. This source code uses the FIAT generated implementation for field arithmetic. This implementation ...
1
vote
1answer
39 views

CSR signature using elliptic curve [closed]

We've been asked to generate a certificate signing request using elliptic curve and we can't use any third-party library as it's an embedded application with very limited resources). We are used to ...
1
vote
0answers
35 views

Is ECC multiplication over real number also one-way? [duplicate]

ECC multiplication over GF(p) is clearly one-way. How about ECC over real number? Is ECC division over real number also practically impossible?
5
votes
2answers
889 views

Raw curve25519 public key points

I'm trying to understand curve25519, and ECC public points. I'm playing with Minisign, to better understand the fundamentals of ECC. Minisign uses curve25519 and outputs public keys as base64 ...
0
votes
0answers
27 views

ECDHE Key with KDF Necessary [duplicate]

Is it necessary to pass a ECDH generated key to a KDF? According to the python cryptography documentation, it is stated that For most applications the shared_key should be passed to a key ...
1
vote
1answer
63 views

Point doubling with only one coordinate

In many source codes that implement ECDH, there is a function that multiplies the base point of that curve with a constant. This function usually takes as arguments the constant and just one ...
5
votes
1answer
179 views

Difference between Pure EdDSA (ed25519) and HashEdDSA (ed25519ph)

My question refers to EdDSA as specified in RFC 8032. I get from the RFC that ed25519 and ed25519ph are two different instances of EdDSA mainly differing in the fact that that in the case of ...
3
votes
1answer
203 views

Representations of secret keys on Curve25519

https://tools.ietf.org/html/draft-josefsson-tls-curve25519-06#appendix-A.2 gives the following as a secret key / public key combo: ...
3
votes
1answer
137 views

ECDSA signing process

I am trying to learn how ECDSA works. I do not have a background in maths, but have been following a guide which has built me up from finite fields, elliptic curves. I am unable to figure out how a ...
1
vote
1answer
63 views

Secure Communication

Focus: I have to design a secure keep alive communication protocol and was wondering if it was necessary to sign the ciphertext after the session key has been generated as an attacker will not know ...
0
votes
1answer
119 views

The Secp256k1 curve is used in cryptocurrency. Can someone generate a private key with a different curve?

Many cryptocurrencies use Secp256k1. Every cryptocurrency library comes with its own redundant implementation of Secp256k1, ECDSA, RIPEMD160, and SHA256. So, there can be some inconsistencies across ...
1
vote
1answer
57 views

Computational Complexity: ECC multiplication vs Modular multiplication

How does performing scalar multiplication on an elliptic curve compare to exponentiation in a multiplicative group modulo a prime? I.e. on a given elliptic curve of size $|t|$, what's the complexity ...
14
votes
3answers
4k views

How effective is quantum computing against elliptic curve cryptography?

I've been reading the Wikipedia page on Elliptic-Curve Cryptography and I came across the following. in August 2015, the NSA announced that it plans to replace Suite B with a new cipher suite due ...
0
votes
2answers
312 views

How can I send a secure public message using ECC? [closed]

I want to know how to send a secure message protected with elliptic curve private and public keys.
0
votes
0answers
43 views

Difficulty of Reversing Elliptic Curve

In ECC, it is apparently easy to verify the final point given the starting point and the number of hops. But it is difficult to compute the number of hops given just the starting point and the final ...
10
votes
1answer
1k views

Why are co-factors 4 and 8 so popular when co-factor is more than one?

For elliptic curve cryptography, I seem to keep coming across curves with either co-factors of 4 or 8 whenever it is a non-prime order group. Is this a co-incidence? Have we studied ECC for curves ...
1
vote
1answer
37 views

formulas for adding points on curve25519

Curve25519 is a Montgomery curve. https://hyperelliptic.org/EFD/g1p/auto-montgom-xz.html#diffadd-dadd-1987-m-3 gives a set of formulas for adding two points (well, more specifically, the X coordinate ...