People who code: we want your input. Take the Survey

Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

Filter by
Sorted by
Tagged with
2
votes
1answer
80 views

Can the security of ECDSA be compromised by the chosen parameters?

The recommended parameters for a secp256k1 ECDSA curve are: (All values are in hexadecimal) ...
1
vote
1answer
48 views

A few questions about the elliptic curves functionalities

I've been learning about the elliptic curves and how they work, and their usage in cryptography, and I'm trying to figure out how to use them using Go. Where is the 'a' parameter from my ECC equation ...
1
vote
1answer
24 views

How are the points computed in the ElGamal elliptic curve encryption algorithm?

I was looking at an example of the ElGamal encryption operation here (page 24), but I can't seem to understand why: $$\beta = 3(10, 3) = (10, 8)$$
0
votes
1answer
59 views

An elliptical curve over GF(2^3) is defined as y^2+xy=x^3+ax^2+b with the given value of a= g^3 and b=1.R = P + Q, where P = (0, 1) and Q = (g^2, 1)

An elliptical curve over $GF(2^3)$ is defined as $y^2+xy=x^3+ax^2+b$ with the given value of $a= g^3$ and $b=1$. $R = P + Q$, where $P = (0, 1)$ and $Q = (g^2, 1)$ Can someone solve this question ...
2
votes
2answers
58 views

Combining ECC and AES for a Web Chat system

I am working on a portable secure chat via desktop or mobile, which adopts OTP plus asymmetric encryption. The idea goes like this: Suppose that Alice and Bob are clients, and the server is run by ...
0
votes
1answer
52 views

Theorem of the dual isogeny in SIDH Zk proof

In the proof of soundness for the SIDH ZK proof protocol (section 6.2 in DJP11) the authors refer to the "Theorem of the dual isogeny". What do they mean by this? In particular, I don't ...
0
votes
2answers
72 views

Advantage of Curve25519 (Elliptic Curve - Diffie Hellman)?

Is there any known vulnerability or attacks against Curve25519 ?? And pros and cons of using it?
1
vote
1answer
42 views

Could I use baby jubjub curve to implement BulletProofs?

I use this gnark-crypto baby jubjub to implement BulletProofs, but it seems can not work well. But I use secp256k1 that will work well. So I'm wondering that if I can use baby jubjub curve to ...
0
votes
1answer
57 views

Time complexity of DLP over Elliptic curve group

Consider NIST 192 elliptic curve group https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-186-draft.pdf. What is the time complexity of discrete log problem of it? Is it Pollard $\rho$ ...
0
votes
0answers
83 views

ECDSA Algorithm

Let the curve $$y^2 = x^3 + 3x+ 5$$ be defined on $Z_{19}$ . If my private key is $d=4$ what is my public key for $P=(9,1)$ . If $H(M)=4$, find your ECDSA signature for message. Randomize the ...
0
votes
1answer
104 views

Why are different private and public key generated in online brainwallets?

Why is that different wallet generating sites give different public and private keys when you enter the same passphrase even though they both use the same Algorithm (Sha 256)? Thank you P.S. Ok...one ...
2
votes
1answer
83 views

Verify that a point belongs to secp256r1

I need to verify that the point in this public key ...
1
vote
1answer
40 views

How to determine secp256r1 or secp256k1 is used on the web sites

I'm pretty new at Cryptography (and at Cryptanalysis), but I went to the website Elliptic to try to discover the elliptic curve they use, and I found they use ECDP 256. So, by SEC2 I discovered they ...
0
votes
1answer
53 views

Do I need to implement multi precision arithmetic operations?

I want to implement Elliptic Curves arithmetics (for edu purpose and better understanding) for special NIST primes: point addition, exponentiation, etc.. all operations needed for EC encryption/...
0
votes
0answers
36 views

Formatting first/last byte of curve25519 private key? [duplicate]

Can anyone dumb it down for me on why you would need to format the first and last byte of a random number to properly generate a curve25519 private key as noted in 'Computing secret keys' section of ...
0
votes
0answers
38 views

Why does Montgomery Ladder not work for Brainpool curves

According to SafeCurves, the Brainpool curves mentioned there (P256t1 and P384t1) do not support the Montgomery Ladder for scalar multiplication in constant time. I am wondering why this is the case ...
1
vote
0answers
33 views

Is it possible to apply the El Gamal encryption/decryption technique using Edwards curve in Montgomery form

I've been trying to understand the ElGamal encryption/decryption technique. I plan to use it for sending a private message to the server. That is: Alice needs to send $Pm$ (private message encoded via ...
2
votes
0answers
50 views

Kleptographic attack of ECDSA key generation?

Kleptographic attacks can be designed for RSA key generation, Diffie–Hellman key exchange, DSA/ECDSA signing, etc. Is it also possible for ECDSA key generation? More detailed: Is it possible for an ...
3
votes
2answers
139 views

Finding an elliptic curve of specific order

I wish to use elliptic curves for cryptographic operations like commitments etc. I see that most standard elliptic curves like $\operatorname{secp256k1, sect571r1}$ have a certain specific and fixed ...
2
votes
0answers
66 views

Is there a complete summarized list of attacks on elliptic curve cryptography?

Is there a complete summarized list of attacks on elliptic curve cryptography? In RSA, there is https://crypto.stanford.edu/~dabo/papers/RSA-survey.pdf, so I was wondering if there is such a list ...
4
votes
3answers
665 views

secp256k1: is it theoretically possible to generate same signature with different key, message hash and k?

For a given private key $d$, random $k$ and message hash $h$ is it possible that there exists a different set of $d$, $k$ and $h$ which produces the same signature using $\text{secp256k1}$ curve?
2
votes
1answer
116 views

Derive one public key from ECDH when the other and and the shared secret is known

Suppose we have an elliptic curve Diffie-Hellman key exchange protocol, where Bob and Alice have public keys $pk_{Alice}= [sk_{Alice}]G$ and $pk_{Bob}= [sk_{Bob}]G$ ($[.]$ elliptic curve "...
1
vote
1answer
57 views

ElGamal with elliptic curves for security

I only know that ElGamal belongs to CPA based on DDH or CDH hard problem. But, if i want to proof the CPA security for ECC-ElGamal, then, what hard problem should i based?DLP? ECC-ElGamal algorithm: ...
2
votes
2answers
57 views

Independent parameters basis for torsion-groups in SIDH: Is the Weil-pairing necessary?

In the original SIDH paper by De Feo, Jao and Plût, the basis points $P_A$ and $Q_A$ are supposed to be independent points in $E(\mathbb{F}_{p^2})$ of order $\ell_A^{e_A}$ for some small prime $\ell_A$...
0
votes
0answers
40 views

Comparing Diffie Hellman and EC Diffie Hellman sizes

So, I am currently trying to understand the differences between DH and ECDH. I understand the basics between how the two algorithms work, however, I do not clearly understand how to compare the ...
3
votes
1answer
103 views

“Batched affine” short-Weierstrass elliptic-curve additions

In https://safecurves.cr.yp.to/rho.html Bernstein talks about fastest possible rho method that uses "batched affine" additions and requires only 5 multiplications mod p, 1 squaring mod p and ...
1
vote
1answer
58 views

Elliptic Curves and Finite Abelian Groups

One can note that, given an elliptic curve mod $p$, that the set of points together with the usual addition law gives a finite Abelian group. Now by the fundamental theorem of finite abelian groups, $$...
2
votes
1answer
113 views

Question about Novotney's paper on Weak Curves

This is the paper - https://wstein.org/edu/2010/414/projects/novotney.pdf In Section 2.1 I see 2 chunks of code/commands in SageMath ...
1
vote
1answer
70 views

EC scalar multiplication with zero scalar

Is the elliptic curve scalar multiplication $[n]G$ defined if $n=0$? I saw multiple software implementations with multiple results such that, $[0]G=0$ or $[0]G=G$. This made me wonder, how can i ...
2
votes
1answer
55 views

Public key derivation for Ed448

Another potentially silly question here, but I seem to have developed tunnel vision and I am missing something very basic. In RFC 8032 one can find a number of test vectors for Ed488 - for example: <...
1
vote
1answer
103 views

Is there any way to mapping point between 2 elliptic curves?

Consider the elliptic curve $E_1: y^2 = x^3+7$ over $\mathbb F_{17}$ with the base point $G=(15, 13)$ and the second elliptic curve $E_2: y^2 = x^3+7$ over $\mathbb F_{31}$ with the same base point $...
1
vote
1answer
72 views

ECDH public keys restrictions

I know that Bob can calculate the shared DH key without knowing the private key. If he sends to Alice a public key = 1, then the the DH key would be 1. Can i achieve something like this in ECDH? where ...
5
votes
1answer
433 views

Looking at just EC Public Key parameters, how can you tell if it is invalid?

I am trying to handle when a parsers goes off the rails and reads an EC public keys wrong (just the X and Y components, I know the curve prior). Right now I check for the following (false means ...
1
vote
1answer
52 views

what motivated the design decisions of RFC 8291 (“Message Encryption for Web Push”)?

Related question here. I'm reading RFC 8291, which describes a protocol to protect web push messages sent between an application server and a user agent (typically a mobile browser or other mobile ...
0
votes
0answers
69 views

Convert sr25519 key pair to Curve25519 key pair

I'm trying to implement public key encryption that support key pairs generated by different libraries: Curve25519 - libsodium cryptoBoxKeypair() Ed25519 - Google ...
1
vote
1answer
43 views

What if the bitlength of the value evaluated in Barrett reduction is greater than 2k the modulus?

For $c\equiv a \pmod n$, in Barrett Reduction, $\mu = \lfloor{\frac{2^{2k}}{n} \rfloor}$ is precomputed, where $k = \lceil{\log_2{n}} \rceil$ and the bitlength of $a$ is assumed to be less than $2k$. ...
4
votes
3answers
127 views

Order of Edwards curve and its twist

In Mike Hamburg's Ed448-Goldilocks, a new elliptic curve (eprint 2015, WECCS 2015) it is studied untwisted Edwards curves in the prime field $\mathbb F_p$ $$E_d:\,y^2+x^2\,=\,1+d\,x^2\,y^2$$ with ...
0
votes
1answer
46 views

Modified ElGamal encryption (ElGamal encryption with messages in the exponent ) is implemented in a pairing friendly elliptic curve. Is it secure?

In my scenario, I need to distinguish if the encrypted message is 0 or not. The message is encrypted by Elgamal encryption but with the message in the exponent. i.e. $(C,R)=(g^my^r,g^r)$ where $y$ is ...
0
votes
0answers
65 views

An “unsafe” curve over RSA? [duplicate]

I'm implementing a token server and considering backing them with ECDSA. The options from the library I'm using expose the NIST curves P-256, P-384, and P-521. The safe curves site does not list P-521,...
1
vote
0answers
61 views

Security of an ECDSA Adaptor Signature Implementation

I'm currently working on an implementation of ECDSA Adaptor Signatures, and part of the signature scheme calls for a NIZK proof to verify knowledge of exponent over two public keys that share a ...
2
votes
1answer
118 views

ElGamal on elliptic curves attack model (CPA,CCA1,CCA2)?

I can't find relevant literature discussing three attack models of the ECC-ElGamal algorithm (CPA, CCA1, CCA2) ECC-ElGamal algorithm: ElGamal with elliptic curves I only know that ElGamal belongs to ...
0
votes
0answers
32 views

Multiparty computation on circuits that perform group operations

I see that a lot of multiparty computation and garbling protocols are implemented for circuits like AES or SHA256. For my project, I would like to garble a circuit that performs some group operations ...
1
vote
1answer
60 views

How to select parameters for elliptic curves not found in standards (Hessian, Jacobi Intersection, Jacobi Quartic, etc)?

I am currently in the process of researching different forms of elliptic curves defined over prime fields. In many curve standards, such as NIST, Brainpool, etc, there exist a list of curve equations ...
0
votes
0answers
83 views

Why was Curve448 Selected for Standardzation but not Curve41417?

In 2014, Bernstein et al. published the Curve41417 paper, and in 2015, Mike Hamburg published Curve448. They are designed to solve the same problems that Curve25519 solved (e.g. using the Montgomery ...
1
vote
0answers
52 views

Which program/language was used to plot the point at infinity of these images? (See the images)

The code of the first image was provided by Squeamish Ossifrage in this answer. In wich language/program was plot? In JavaScript or GeoGebra? Also, I found in YouTube the image below with the point ...
0
votes
1answer
49 views

Software implementation of symmetric and asymmetric bilinear pairings

I have recently read a paper about pairings, which only implemented asymmetric bilinear pairings and it mentiond that $\eta_{T}$ pairing is the most efficient algorithm for symmetric pairings. I ...
0
votes
1answer
76 views

Why computation of $u*v^3*(u*v^7)^{(p-5)/8}$ is suggested instead of $(u/v)^{(p+3)/8}$

Working with Curve25519 I've faced with suggested form of computation square root candidate as: $uv^3(uv^7)^{\frac{p-5}{8}}$ instead of $\left(\frac{u}{v}\right)^{\frac{p+3}{8}}$. Why it is so? Or why ...
2
votes
1answer
123 views

Are GPUs inefficient for calculations on big numbers? Is RSA and EC cypto generally done on CPU only?

Looking specifically at RSA and EC algorithms which imply doing operations on integers >= 256 bits (>> 64 bits), I have noticed (from my limited experience) that 99% of the software for ...
0
votes
1answer
140 views

How to compare the time of encryption, cracking and verification elliptic curve problem in the same framework?

everyone! As a beginner, I would like to ask you a question. The best algorithm known for cracking (done by anonymous snooper) this problem (Discrete logarithm problem of elliptic curve or ECDSA)is ...
0
votes
1answer
63 views

Elliptic curve in Binary Field implementation

For Elliptic curves defined over $GF(2^n)$, by adding any two points P and Q over $GF(2^n)$ we get the third point over $GF(2^n)$. In Elliptic Curve Digital Signature Algorithm (ECDSA) https://en....

1
2 3 4 5
34