People who code: we want your input. Take the Survey

# Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

1,660 questions
Filter by
Sorted by
Tagged with
1answer
80 views

### Can the security of ECDSA be compromised by the chosen parameters?

The recommended parameters for a secp256k1 ECDSA curve are: (All values are in hexadecimal) ...
1answer
48 views

### A few questions about the elliptic curves functionalities

I've been learning about the elliptic curves and how they work, and their usage in cryptography, and I'm trying to figure out how to use them using Go. Where is the 'a' parameter from my ECC equation ...
1answer
24 views

### How are the points computed in the ElGamal elliptic curve encryption algorithm?

I was looking at an example of the ElGamal encryption operation here (page 24), but I can't seem to understand why: $$\beta = 3(10, 3) = (10, 8)$$
1answer
59 views

### An elliptical curve over GF(2^3) is defined as y^2+xy=x^3+ax^2+b with the given value of a= g^3 and b=1.R = P + Q, where P = (0, 1) and Q = (g^2, 1)

An elliptical curve over $GF(2^3)$ is defined as $y^2+xy=x^3+ax^2+b$ with the given value of $a= g^3$ and $b=1$. $R = P + Q$, where $P = (0, 1)$ and $Q = (g^2, 1)$ Can someone solve this question ...
2answers
58 views

### Combining ECC and AES for a Web Chat system

I am working on a portable secure chat via desktop or mobile, which adopts OTP plus asymmetric encryption. The idea goes like this: Suppose that Alice and Bob are clients, and the server is run by ...
1answer
52 views

### Theorem of the dual isogeny in SIDH Zk proof

In the proof of soundness for the SIDH ZK proof protocol (section 6.2 in DJP11) the authors refer to the "Theorem of the dual isogeny". What do they mean by this? In particular, I don't ...
2answers
72 views

### Advantage of Curve25519 (Elliptic Curve - Diffie Hellman)?

Is there any known vulnerability or attacks against Curve25519 ?? And pros and cons of using it?
1answer
42 views

### Could I use baby jubjub curve to implement BulletProofs?

I use this gnark-crypto baby jubjub to implement BulletProofs, but it seems can not work well. But I use secp256k1 that will work well. So I'm wondering that if I can use baby jubjub curve to ...
1answer
57 views

### Time complexity of DLP over Elliptic curve group

Consider NIST 192 elliptic curve group https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-186-draft.pdf. What is the time complexity of discrete log problem of it? Is it Pollard $\rho$ ...
0answers
83 views

### ECDSA Algorithm

Let the curve $$y^2 = x^3 + 3x+ 5$$ be defined on $Z_{19}$ . If my private key is $d=4$ what is my public key for $P=(9,1)$ . If $H(M)=4$, find your ECDSA signature for message. Randomize the ...
1answer
104 views

### Why are different private and public key generated in online brainwallets?

Why is that different wallet generating sites give different public and private keys when you enter the same passphrase even though they both use the same Algorithm (Sha 256)? Thank you P.S. Ok...one ...
1answer
83 views

### Verify that a point belongs to secp256r1

I need to verify that the point in this public key ...
1answer
40 views

### How to determine secp256r1 or secp256k1 is used on the web sites

I'm pretty new at Cryptography (and at Cryptanalysis), but I went to the website Elliptic to try to discover the elliptic curve they use, and I found they use ECDP 256. So, by SEC2 I discovered they ...
1answer
53 views

### Do I need to implement multi precision arithmetic operations?

I want to implement Elliptic Curves arithmetics (for edu purpose and better understanding) for special NIST primes: point addition, exponentiation, etc.. all operations needed for EC encryption/...
0answers
36 views

### Formatting first/last byte of curve25519 private key? [duplicate]

Can anyone dumb it down for me on why you would need to format the first and last byte of a random number to properly generate a curve25519 private key as noted in 'Computing secret keys' section of ...
0answers
38 views

### Why does Montgomery Ladder not work for Brainpool curves

According to SafeCurves, the Brainpool curves mentioned there (P256t1 and P384t1) do not support the Montgomery Ladder for scalar multiplication in constant time. I am wondering why this is the case ...
0answers
33 views

### Is it possible to apply the El Gamal encryption/decryption technique using Edwards curve in Montgomery form

I've been trying to understand the ElGamal encryption/decryption technique. I plan to use it for sending a private message to the server. That is: Alice needs to send $Pm$ (private message encoded via ...
0answers
50 views

### Kleptographic attack of ECDSA key generation?

Kleptographic attacks can be designed for RSA key generation, Diffie–Hellman key exchange, DSA/ECDSA signing, etc. Is it also possible for ECDSA key generation? More detailed: Is it possible for an ...
2answers
139 views

### Finding an elliptic curve of specific order

I wish to use elliptic curves for cryptographic operations like commitments etc. I see that most standard elliptic curves like $\operatorname{secp256k1, sect571r1}$ have a certain specific and fixed ...
0answers
66 views

### Is there a complete summarized list of attacks on elliptic curve cryptography?

Is there a complete summarized list of attacks on elliptic curve cryptography? In RSA, there is https://crypto.stanford.edu/~dabo/papers/RSA-survey.pdf, so I was wondering if there is such a list ...
3answers
665 views

### secp256k1: is it theoretically possible to generate same signature with different key, message hash and k?

For a given private key $d$, random $k$ and message hash $h$ is it possible that there exists a different set of $d$, $k$ and $h$ which produces the same signature using $\text{secp256k1}$ curve?
1answer
116 views

### Derive one public key from ECDH when the other and and the shared secret is known

Suppose we have an elliptic curve Diffie-Hellman key exchange protocol, where Bob and Alice have public keys $pk_{Alice}= [sk_{Alice}]G$ and $pk_{Bob}= [sk_{Bob}]G$ ($[.]$ elliptic curve "...
1answer
57 views

### ElGamal with elliptic curves for security

I only know that ElGamal belongs to CPA based on DDH or CDH hard problem. But, if i want to proof the CPA security for ECC-ElGamal, then, what hard problem should i based?DLP? ECC-ElGamal algorithm: ...
2answers
57 views

### Independent parameters basis for torsion-groups in SIDH: Is the Weil-pairing necessary?

In the original SIDH paper by De Feo, Jao and Plût, the basis points $P_A$ and $Q_A$ are supposed to be independent points in $E(\mathbb{F}_{p^2})$ of order $\ell_A^{e_A}$ for some small prime $\ell_A$...
0answers
40 views

### Comparing Diffie Hellman and EC Diffie Hellman sizes

So, I am currently trying to understand the differences between DH and ECDH. I understand the basics between how the two algorithms work, however, I do not clearly understand how to compare the ...
1answer
103 views

### “Batched affine” short-Weierstrass elliptic-curve additions

In https://safecurves.cr.yp.to/rho.html Bernstein talks about fastest possible rho method that uses "batched affine" additions and requires only 5 multiplications mod p, 1 squaring mod p and ...
1answer
58 views

1answer
46 views

### Modified ElGamal encryption (ElGamal encryption with messages in the exponent ) is implemented in a pairing friendly elliptic curve. Is it secure?

In my scenario, I need to distinguish if the encrypted message is 0 or not. The message is encrypted by Elgamal encryption but with the message in the exponent. i.e. $(C,R)=(g^my^r,g^r)$ where $y$ is ...
0answers
65 views

### An “unsafe” curve over RSA? [duplicate]

I'm implementing a token server and considering backing them with ECDSA. The options from the library I'm using expose the NIST curves P-256, P-384, and P-521. The safe curves site does not list P-521,...
0answers
61 views

### Security of an ECDSA Adaptor Signature Implementation

I'm currently working on an implementation of ECDSA Adaptor Signatures, and part of the signature scheme calls for a NIZK proof to verify knowledge of exponent over two public keys that share a ...
1answer
118 views

### ElGamal on elliptic curves attack model (CPA,CCA1,CCA2)?

I can't find relevant literature discussing three attack models of the ECC-ElGamal algorithm (CPA, CCA1, CCA2) ECC-ElGamal algorithm: ElGamal with elliptic curves I only know that ElGamal belongs to ...
0answers
32 views

### Multiparty computation on circuits that perform group operations

I see that a lot of multiparty computation and garbling protocols are implemented for circuits like AES or SHA256. For my project, I would like to garble a circuit that performs some group operations ...
1answer
60 views

### How to select parameters for elliptic curves not found in standards (Hessian, Jacobi Intersection, Jacobi Quartic, etc)?

I am currently in the process of researching different forms of elliptic curves defined over prime fields. In many curve standards, such as NIST, Brainpool, etc, there exist a list of curve equations ...
0answers
83 views

### Why was Curve448 Selected for Standardzation but not Curve41417?

In 2014, Bernstein et al. published the Curve41417 paper, and in 2015, Mike Hamburg published Curve448. They are designed to solve the same problems that Curve25519 solved (e.g. using the Montgomery ...
0answers
52 views

### Which program/language was used to plot the point at infinity of these images? (See the images)

The code of the first image was provided by Squeamish Ossifrage in this answer. In wich language/program was plot? In JavaScript or GeoGebra? Also, I found in YouTube the image below with the point ...
1answer
49 views

### Software implementation of symmetric and asymmetric bilinear pairings

I have recently read a paper about pairings, which only implemented asymmetric bilinear pairings and it mentiond that $\eta_{T}$ pairing is the most efficient algorithm for symmetric pairings. I ...
1answer
76 views

### Why computation of $u*v^3*(u*v^7)^{(p-5)/8}$ is suggested instead of $(u/v)^{(p+3)/8}$

Working with Curve25519 I've faced with suggested form of computation square root candidate as: $uv^3(uv^7)^{\frac{p-5}{8}}$ instead of $\left(\frac{u}{v}\right)^{\frac{p+3}{8}}$. Why it is so? Or why ...
1answer
123 views

### Are GPUs inefficient for calculations on big numbers? Is RSA and EC cypto generally done on CPU only?

Looking specifically at RSA and EC algorithms which imply doing operations on integers >= 256 bits (>> 64 bits), I have noticed (from my limited experience) that 99% of the software for ...
1answer
140 views

### How to compare the time of encryption, cracking and verification elliptic curve problem in the same framework？

everyone! As a beginner, I would like to ask you a question. The best algorithm known for cracking (done by anonymous snooper) this problem （Discrete logarithm problem of elliptic curve or ECDSA）is ...
1answer
63 views

### Elliptic curve in Binary Field implementation

For Elliptic curves defined over $GF(2^n)$, by adding any two points P and Q over $GF(2^n)$ we get the third point over $GF(2^n)$. In Elliptic Curve Digital Signature Algorithm (ECDSA) https://en....