Skip to main content

Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

Filter by
Sorted by
Tagged with
8 votes
1 answer
710 views

Why does Ed25519 use a twisted Edwards curve rather than a regular Edwards curve?

I'm trying to understand benefits of using Twisted Edwards curve over regular Edwards curve. I'm aware of some properties of Twisted Edwards curve that regular Edwards curve missing like isomorphism ...
3 votes
2 answers
1k views

Security of McCallum-Relyea exchange

I recently learned of the McCallum-Relyea exchange which allows for a method of key escrow without actually transmitting the key. It was developed at RedHat and is used by the tang and clevis ...
1 vote
1 answer
66 views

Secp256k1 giving y-value for inverse of point

Given a secp256k1 point $P$ with scalar 3 where: $P = 3*G$ You get a point with co-ordinates: ...
0 votes
0 answers
16 views

Safety per bit DHKA and ECDH

I have a project where I compare the classical Diffie Hellman key agreement with its implementation with elliptic curves. Therefore I need a list with the safety per bit. Does anyone know where I can ...
1 vote
0 answers
73 views

Is generating random blake256 hashes until packed points is on the curve, a safe algorithm to avoid the discrete log between the generated points?

I know there’re many questions that ask how to safely HashToCurve, but I want to know if the method I found in an actual implementation is secured against the ...
3 votes
1 answer
257 views

Why we use specifically Jacobian Groups for HECC?

The following is stated in this answer on "What is so special about elliptic curves?": But for these curves, an excellent geometric rule does not exist to add points, like in conics and ...
1 vote
1 answer
72 views

Scalars that are both Additive and Multiplicative inverses on secp256k1

I believe I have found two scalars (a) and (b) that are both additive and multiplicative inverses on the secp256k1 elliptic curve. So scalars (a) and (b) meet the following criteria: [𝑎+𝑏≡0 (mod 𝑛)]...
15 votes
2 answers
26k views

ECDSA Signature R|S to ASN1 DER Encoding question

I am trying to test my understanding on ECDSA Signature r|s to ASN.1 DER Encoding for NIST P-256. I have r|s and when I convert ...
3 votes
2 answers
209 views

Size of $E$ over $\mathbb{F}_p$ contains $p+1$ points

I am struggling to prove this claim: I proved that the map $x\mapsto x^3+1$ is a bijection from $\mathbb{F}_p$ to itself if we have that $p\equiv 2\bmod{3}$. We have to use this fact to prove that ...
7 votes
2 answers
2k views

Difficulty of Reversing Elliptic Curve

In ECC, it is apparently easy to verify the final point given the starting point and the number of hops. But it is difficult to compute the number of hops given just the starting point and the final ...
4 votes
2 answers
2k views

Find ECDSA PrivKey to PubKey = 0

I know it should be impossible (or at least infeasibly hard) to extract a ECDSA Private Key from a given Public Key (discrete logarithm problem). But I'm not deep enough into ECC to find an answer to ...
0 votes
1 answer
109 views

Elliptic Curve Cryptography: Point Multiplication by 3 on secp256k1 Curve

Is there a direct non-iterative formula for point multiplication by 3 in the secp256k1 elliptic curve just like point multiplication by 2 (point doubling)? If such a formula exists, could you explain ...
-2 votes
3 answers
168 views

can we modify the prime field by increasing it in secp256k1?

If in ECDSA secp256k1 we have the prime field p=2256 - 232 - 29 - 28 - 27 - 26 - 24 - 1, can we increase it to p=2256, if we keep the double and add operations the same, the curve equation the same ...
1 vote
2 answers
130 views

Example of elliptic curves endomorphism construction

I've started learning about complex multiplication (CM) on elliptic curves. For clarity (and intuition), I want to make some basic example of elliptic curves endomorphism construction for a concrete ...
1 vote
1 answer
38 views

Montgomery Powering Ladder for long weierstrass equations

My question is the following: I know that for elliptic curves in short weierstrass form, I have the following "one-coordinate addition" formula: Let $P = (x_p,y_p), Q = (x_q, y_q)$. If I am ...
1 vote
1 answer
983 views

What is the order of the generator point G=9 in curve25519?

In Curve25519 we typically have this generator point or base point: ...
1 vote
3 answers
188 views

Exponentiation Problem of G2 in MNT curve

I made a simple python program in the Charm framework (https://github.com/JHUISI/charm): ...
-2 votes
2 answers
1k views

How to find at least one private key from a large list of compressed public keys secp256k1

Not long ago I saw a discussion on the Bitcoin Talk forum: https://bitcointalk.org/index.php?topic=5060735.msg50736695#msg50736695 Please give advice and working methods? Is it possible to find at ...
4 votes
3 answers
3k views

Why is it impossible to find the private key from the public key?

From what I understand, based on the article A Beginner’s Guide: Private and Public Key Cryptography Deciphered, the public key is generated by performing $n$ tangent plus mirroring operations from ...
1 vote
2 answers
585 views

Can we retrieve his private key using his public key in ECC?

A paper wallet is the name given to an obsolete and unsafe method of storing bitcoin which was popular between 2011 and 2016. It works by having a single private key and bitcoin address, being printed ...
0 votes
1 answer
62 views

Getting the slope of a public key given its x and y coordinates

Is it possible to get the slope of a public key given its $x$ and $y$ coordinates? Since all the ECC calculations come from geometry, I thought this calculation might be possible.
0 votes
1 answer
63 views

diffie hellman key exchange compared with ECDH [closed]

I have to write a paper about the Diffie Hellman key agreement. I want to focus on the implementation with elliptic curves and comparing the safety for selected attacks such as Pollards Rho and ...
2 votes
1 answer
174 views

Questions related to Hyper Elliptic Curve Cryptography

I have read the wikipedia section related to HECC (Hyper Elliptic Curve Cryptography) and various questions opened in the current Cryptography Stackexchange site. But I need some help on the following ...
2 votes
1 answer
125 views

Is the D = D1 + D2 of HECC the equivalent of the P + Q tangent-and-chord method as occurs in ECC?

I am reading about Hyper Elliptic Curve Cryptography here: https://en.wikipedia.org/wiki/Imaginary_hyperelliptic_curve#The_divisor_and_the_Jacobian In Elliptic Curve Cryptography we have the tangent-...
0 votes
1 answer
69 views

wrting algorithm for torsion group elements

Yesterday,I took an exam. There are two questions I received very low points. I will write the first question in this post. The question says let $E:y^2:x^3+kx+1$ in GF(p) be an elliptic curve where p ...
2 votes
1 answer
386 views

Implementing ECDSA threshold using a secret sharing scheme

My question might be a duplicate but I wasn't able to find a similar question. I recently developed a wallet-like app and I am trying to implement some MPC features. I searched a little and even asked ...
1 vote
1 answer
147 views

What’s the fastest known Koblitz curve addition law for FPGA that maximizes the per-LUT throughput?

The addition or multiplication laws used by large mainstream libraries achieve faster speed by using many many more operations in order to avoid larger numbers. And my problem is here: faster speeds ...
28 votes
1 answer
26k views

ElGamal with elliptic curves

I've searched some information on ECC, but so far I have only found Diffie-Hellman key-exchange implementations using ECC, but I don't want to exchange keys, I want to encrypt & decrypt data like ...
0 votes
1 answer
185 views

Finite Fields and security level in HECC (Hyper Elliptic Curve Cryptography)

How to calculate the security level for HECC (Hyper Elliptic Curve Cryptography) genus = 2, 3, for a Finite Field of 128-bits or 256-bits or 512-bits, by following the below rationale of the ECC here: ...
43 votes
3 answers
27k views

How does recovering the public key from an ECDSA signature work?

It is possible to recover the public key from an ECDSA signature values $(r,s)$? Please explain how this works.
1 vote
2 answers
116 views

Is it safe to reuse the same scalar when doing direct scalar multiplication on Koblitz curves?

Let $s$ be a private key and $k=intAsScalar(s)$. Finding $s$ from $P_k=[k]G$ involves solving the Elliptic curves discrete logarithm problem. But what if the same $k$ is also used for performing 1 or ...
0 votes
1 answer
42 views

SDLog - looking for papers

Reading trough SEC 1 V2.0 in txe appendices there is a mention of a elliptic curve semi logarithm (ECSLP) being used to forge ECDSA signatures. I am looking for papers on that problem and have been ...
0 votes
1 answer
103 views

Given pedersen commitments of some elements, how to prove that the sum of only one subset of these elements is equal to the given element θ?

Assume that Prover have $n$ pedersen commitments ($V_{a_1},V_{a_2},\cdots,V_{a_n}$ where $V_{a_i}=G \cdot a_i + H \cdot r_{a_i}$) of $n$ elements $a_1,a_2,\cdots,a_n$. The Prover have another element $...
5 votes
3 answers
795 views

CVE-2024-31497, nonces and random numbers: Can someone explain, please?

Regarding CVE-2024-31497 a German article "Nur NIST P-521 betroffen: PuTTY-Lücke kompromittiert private SSH-Schlüssel" wrote something about a vulnerability in PuTTY. The issue was claimed ...
1 vote
1 answer
95 views

How to use smt solvers in order to restrict the possible key search where a portion of the private key and a portion of the public key hash is known?

I’m in the following situation : I’ve a portion/first bytes of a private secp256k1 security key such as it would take minutes to fully recover it through Pollard’s Kangaroo if I had the public key. ...
1 vote
0 answers
178 views

Need help with Cryptohack's ProSign 3 ECDSA problem [closed]

I'm trying to solve the CTF challenge called ProSign 3 at Cryptohack platform which involves exploiting an ECDSA signing service that allows us to sign a fixed message being padded with the time ... ...
3 votes
1 answer
1k views

When incrementing a private key by 1, by how much is the public key Incremented?

If you have a secp256k1 keypair and you increment the private key by 1, then a faster way to compute the new public key is to perform an addition on the previous public key. But by how much? Some ...
4 votes
1 answer
238 views

Split a private key into shares and sign successively or separately

Assume I have a private key, priv_k, a public key pub_key and a message, msg, along with its ...
1 vote
0 answers
44 views

I want to find the Zero Value Points on SECP256R1 curve... Is there an alternative to Chien's method of finding roots over large Finite Fields?

This PDF explains that on certain elliptic curves, there exists ZVP (Zero Value Points) that cause zero value registers during the scalar-to-point multiplication (i.e during the double operation or ...
2 votes
1 answer
145 views

Recover Y coordinate from xz elliptic curve multiplication

I have an elliptice curve in the form y² = x³ + ax + b (mod p) And I have a multiplication algortihm which uses only x and z coordinate How can I recover the Y coordinate ? I tried to use the curve ...
2 votes
1 answer
427 views

Authentication protocol for communication with Arduino Uno [closed]

I am using an ECDH key exchange to establish a shared secret between an Arduino Uno and an Android device. For this purpose I am using this library and more specifically Curve25519. This is the ...
0 votes
2 answers
189 views

Trouble detecting cyclic group order crossovers in SECP256K1

There's a problem in detecting whether the sum of public key addition has crossed the cyclic group order boundary For this example, think of public keys $Pub$ as private keys $Priv$, (private scalars),...
0 votes
1 answer
163 views

How to know if an ECC public key is y or -y

I'm a beginner still learning how ecc works... And i think I understand that in secp256k1 public keys there is something called addictive and negative inverse for example private key:- ...
1 vote
0 answers
102 views

Curve448 ECC parameters for use with OpenSSL

I need to be able to deterministically generate (and re-generate) private-public ECC key pairs curve448 for ECDH from human-friendly passphrases (not necessarily human-memorable, just easy to type in),...
4 votes
1 answer
136 views

Changing ECDSA for Shorter Signatures: deterministic k

I am exploring a modification to ECDSA to produce shorter signatures, even though it compromises security (in a controllable way). My rationale behind this change is in this discussion. In my ...
1 vote
2 answers
219 views

Is there a ZKP that proves knowledge of a particular elliptic curve point?

Let E be an elliptic curve of prime order n. If we assume that Alice and Bob both know a scalar value ...
3 votes
2 answers
510 views

Why is the bilinearity of an elliptic curve pairing shown as multiplicative rather than additive?

In vitalik's post here the below is mentioned, This is the pairing. Mathematicians also sometimes call it a bilinear map; the word “bilinear” here basically means that it satisfies the constraints: $...
1 vote
1 answer
50 views

Is there any reference about the half-trace when m is even in F(2^m)

There is a algorithm listed in D.1.6, Algorithm 3, it seems that it is used to solve the quadratic equation when $m$ is even in $F(2^m)$. However, I can not find any reference about this algorithm, as ...
1 vote
1 answer
100 views

Montgomery Curve Point Multiplication in Projective Coordinates

Is the result of 4G the same when calculated as 3G + 1G or 2G + 2G in projective coordinates? Considering a curve like (y^2 = x^3 + 10x^2 + x (mod 83)) with a Generator point G = (3, 28) in affine ...
0 votes
0 answers
39 views

Constraints needed to express a + b + c = d in zkp circuit

I am writing an ECC based zkp circuit and need to express the constraints: a + b + c = d a, b, c, d >= 0 a, b, c, d will be represented by points on the curve so addition can wrap around the ...

1
2 3 4 5
44