Skip to main content

Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

Filter by
Sorted by
Tagged with
0 votes
1 answer
29 views

Can we use Super-Elliptic or Supersingular Elliptic Curves in Cryptography?

I am reading in literature articles and journals about Super Elliptic Curves and Super Singular Elliptic Curves such as this: https://arxiv.org/pdf/1906.02373 I have 2 questions: Do Super Elliptic ...
someone's user avatar
  • 29
0 votes
1 answer
59 views

Is MOV attack against ECDLP fundamentally impossible?

The main idea of the MOV attack is to map EC additive group of order $n$ to multiplicative group in the finite field extension $p^k$. For this, the groups must have the same order, what fully relies ...
Ярослав Ладанов's user avatar
1 vote
0 answers
34 views

Given powers of tau ; the veryfying and the proving key, how can I find the point [f] resulting from the trusted setup in Groth16?

For each circuits, Groth16 requires to compute a point $f$ such as $f=s×G$. While revealing the scalar $s$ used for computing $f$ would allow to produce fake proofs, $f$ can be exposed to the public. ...
user2284570's user avatar
1 vote
0 answers
49 views

Do Curve448 shared secret need to be hashed?

I am planning to implement key agreement in an application, and Curve25519 offers the right properties for 128-bit security (AES-128). In a question I previously asked (Can Curve25519 shared secret be ...
juhist's user avatar
  • 1,351
5 votes
2 answers
776 views

Can Curve25519 shared secret be safely truncated to half its size?

I am planning to use a key agreement mechanism in an application needing ephemeral keys, and Curve25519 looks promising, specifically because it offers 128 bits of security, just fine for AES-128 ...
juhist's user avatar
  • 1,351
1 vote
1 answer
114 views

How to Generate Low-Order Generator Points on Elliptic Curves

How can one generate a 'Generator Point' on an elliptic curve that has an extremely low order. Take this Elliptic Curve from HTB Cyber Apocalypse 2024. The order of G is 11. How can one replicate this ...
PotatoTomato's user avatar
0 votes
1 answer
38 views

How to modify a positive scalar in scalar multiplication in order to get the additive inverse on twisted Edwards curves?

I know this is something possible because of Pedersen Hash : when truncating the hash to keep only the X coordinate, is it possible to compute a collision when the Babyjubjub curve is used? ...
user2284570's user avatar
2 votes
1 answer
116 views

Is it possible to use abstract groups to generalize DSA, ECDSA and EdDSA signature creation and verification?

It is known, that DSA algorithm is defined as: Bob Creates private $x$ and public $Y=G^x\bmod p$ keys, where $G$ - generator, $p$ - group prime order Selects random value $k$ from $1 \le k\le q-1$ $...
Azii's user avatar
  • 77
0 votes
0 answers
25 views

A serious security issue in remote data storage

In order to ensure the integrity of remote data, Ateniese et al. first proposed the idea of provable data possession (PDP). In this proof, the data are computed as elements on a G-group in the form of ...
nan gan's user avatar
0 votes
1 answer
89 views

Using Sagemath, how to exactly find out what the order of a point of an elliptic curve in the twisted Edwards form is?

Simple question and I’m fully aware of the other question, but I need the answer for curves in the twisted Edwards form and I suppose converting the curve and the point to the Weierstrass form would ...
user2284570's user avatar
3 votes
2 answers
511 views

Is ElGamal homomorphic encryption using additive groups works only for Discrete Log ElGamal? What about EC ElGamal?

It is known that in Discrete Log ElGamal encryption, the ciphertext $E$ is encrypted as: $a\ =\ g^k$, where $k$ - random scalar from $[0,\ p)$, $g$ - group generator $b\ =\ (Y^k*m)\mod\ p$, where $Y$ -...
Azii's user avatar
  • 77
0 votes
0 answers
48 views

Why exactly finding the same result by changing a scalar in such a case is equivalent to solving the discrete logarithm between one or more points?

Let’s say I have 3 randomly sampled points on a curve in Edwards form (sampled only the first time and not at each computation) $P1$ $P2$ $P3$ and 3 scalars $S1$ $S2$ $S3$ such as : Both $S1$ $S2$ $...
user2284570's user avatar
0 votes
0 answers
44 views

Edwards curve example

I am looking to deepen my understanding of Edwards elliptic curves, specifically focusing on addition operations. Could anyone recommend books or websites that provide detailed examples with numerical ...
Nawras Hussein's user avatar
2 votes
1 answer
163 views

Is it possible to abstract an ElGamal encryption for EC and Discrete Log by using a Group Law?

ElGamal encryption for Discrete Log is defined as: Bob side does: $Y\ =\ (g^x)\ mod\ P$, where $g$ - generator, $x$ - random value among the group elements and $P$ - prime number, typically ultra ...
Azii's user avatar
  • 77
1 vote
1 answer
162 views

DH Encrypt by XOR

I'm working in the Curve25519 domain (EC curve, 256-bit key size). I have a peer pubkey, and need to send it an encrypted message. For starters we create a "nonce" (ephemeral key), and use ...
valdo's user avatar
  • 359
0 votes
2 answers
176 views

Given a random point on a curve defined over a prime field, is it possible to compute 2 different scalar that will lead to the same result?

Simple question : given a randomly selected point $P$ belonging on a given Edwards curve defined on a prime field, does 2 scalars $S1$ $S2$ exist such as : $packed(S1\cdot P)= packed(S2\cdot P$) (...
user2284570's user avatar
0 votes
0 answers
58 views

Does this script calculate valid points on a curve twist?

Start point on curve secp256k1, twist curve EllipticCurve(GF(p), [0, -7]). Does point on twist is a walid point and point on a twist and calculated without mistakes ? Does a points in subgroups of ...
Caraco Mongos's user avatar
2 votes
1 answer
141 views

How to convert $y^2 = x^3 +7$ over $F_p$ to $y^2 = x^3 + 12$ over $F_p$

...
mazedat's user avatar
  • 21
1 vote
1 answer
52 views

ECC multiplicative inverse problems while performing point division (multiplication with inverse multiplier of 2 )

I have been trying to understand the mathematics behind point multiplication. what i understand with ECC is that there is no division on ECC but multiplication, addition and negation. i recently ...
Melwyn's user avatar
  • 31
0 votes
0 answers
44 views

Subtraction of inverse points in secp256k1

In pure math given: k = 10 l = -10 k + l = 0 k - l = 20 Now in secp256k1 $K = k*G$ $L = l*G$ $K+L = O$ $K-L = O$ Why do we get identity point on subtraction since: ...
dred28's user avatar
  • 13
1 vote
0 answers
61 views

Trusted code to test that a Bitcoin address corresponds to a certain private key

I apologise for asking a possibly trivial question. I am not much of a programmer and that's my problem. In an answer to another question about obtaining the Bitcoin address from a private key the ...
kodlu's user avatar
  • 22.8k
1 vote
1 answer
91 views

Secp256k1 giving y-value for inverse of point

Given a secp256k1 point $P$ with scalar 3 where: $P = 3*G$ You get a point with co-ordinates: ...
dred28's user avatar
  • 13
0 votes
0 answers
17 views

Safety per bit DHKA and ECDH

I have a project where I compare the classical Diffie Hellman key agreement with its implementation with elliptic curves. Therefore I need a list with the safety per bit. Does anyone know where I can ...
anonym's user avatar
  • 1
1 vote
0 answers
88 views

Is generating random blake256 hashes until packed points is on the curve, a safe algorithm to avoid the discrete log between the generated points?

I know there’re many questions that ask how to safely HashToCurve, but I want to know if the method I found in an actual implementation is secured against the ...
user2284570's user avatar
1 vote
1 answer
82 views

Scalars that are both Additive and Multiplicative inverses on secp256k1

I believe I have found two scalars (a) and (b) that are both additive and multiplicative inverses on the secp256k1 elliptic curve. So scalars (a) and (b) meet the following criteria: [𝑎+𝑏≡0 (mod 𝑛)]...
TrialAndError's user avatar
3 votes
1 answer
271 views

Why we use specifically Jacobian Groups for HECC?

The following is stated in this answer on "What is so special about elliptic curves?": But for these curves, an excellent geometric rule does not exist to add points, like in conics and ...
someone's user avatar
  • 29
1 vote
1 answer
41 views

Montgomery Powering Ladder for long weierstrass equations

My question is the following: I know that for elliptic curves in short weierstrass form, I have the following "one-coordinate addition" formula: Let $P = (x_p,y_p), Q = (x_q, y_q)$. If I am ...
max_121's user avatar
  • 111
0 votes
1 answer
67 views

Getting the slope of a public key given its x and y coordinates

Is it possible to get the slope of a public key given its $x$ and $y$ coordinates? Since all the ECC calculations come from geometry, I thought this calculation might be possible.
Dev Tenji's user avatar
0 votes
1 answer
65 views

diffie hellman key exchange compared with ECDH [closed]

I have to write a paper about the Diffie Hellman key agreement. I want to focus on the implementation with elliptic curves and comparing the safety for selected attacks such as Pollards Rho and ...
anonym's user avatar
  • 1
1 vote
2 answers
152 views

Example of elliptic curves endomorphism construction

I've started learning about complex multiplication (CM) on elliptic curves. For clarity (and intuition), I want to make some basic example of elliptic curves endomorphism construction for a concrete ...
PracticeMakesPerfect's user avatar
2 votes
1 answer
129 views

Is the D = D1 + D2 of HECC the equivalent of the P + Q tangent-and-chord method as occurs in ECC?

I am reading about Hyper Elliptic Curve Cryptography here: https://en.wikipedia.org/wiki/Imaginary_hyperelliptic_curve#The_divisor_and_the_Jacobian In Elliptic Curve Cryptography we have the tangent-...
someone's user avatar
  • 29
0 votes
1 answer
186 views

Finite Fields and security level in HECC (Hyper Elliptic Curve Cryptography)

How to calculate the security level for HECC (Hyper Elliptic Curve Cryptography) genus = 2, 3, for a Finite Field of 128-bits or 256-bits or 512-bits, by following the below rationale of the ECC here: ...
someone's user avatar
  • 29
1 vote
1 answer
151 views

What’s the fastest known Koblitz curve addition law for FPGA that maximizes the per-LUT throughput?

The addition or multiplication laws used by large mainstream libraries achieve faster speed by using many many more operations in order to avoid larger numbers. And my problem is here: faster speeds ...
user2284570's user avatar
0 votes
1 answer
42 views

SDLog - looking for papers

Reading trough SEC 1 V2.0 in txe appendices there is a mention of a elliptic curve semi logarithm (ECSLP) being used to forge ECDSA signatures. I am looking for papers on that problem and have been ...
immigrantswede's user avatar
1 vote
2 answers
120 views

Is it safe to reuse the same scalar when doing direct scalar multiplication on Koblitz curves?

Let $s$ be a private key and $k=intAsScalar(s)$. Finding $s$ from $P_k=[k]G$ involves solving the Elliptic curves discrete logarithm problem. But what if the same $k$ is also used for performing 1 or ...
user2284570's user avatar
2 votes
1 answer
184 views

Questions related to Hyper Elliptic Curve Cryptography

I have read the wikipedia section related to HECC (Hyper Elliptic Curve Cryptography) and various questions opened in the current Cryptography Stackexchange site. But I need some help on the following ...
someone's user avatar
  • 29
-2 votes
3 answers
177 views

can we modify the prime field by increasing it in secp256k1?

If in ECDSA secp256k1 we have the prime field p=2256 - 232 - 29 - 28 - 27 - 26 - 24 - 1, can we increase it to p=2256, if we keep the double and add operations the same, the curve equation the same ...
MR Man's user avatar
  • 1
5 votes
3 answers
828 views

CVE-2024-31497, nonces and random numbers: Can someone explain, please?

Regarding CVE-2024-31497 a German article "Nur NIST P-521 betroffen: PuTTY-Lücke kompromittiert private SSH-Schlüssel" wrote something about a vulnerability in PuTTY. The issue was claimed ...
U. Windl's user avatar
  • 229
1 vote
1 answer
105 views

How to use smt solvers in order to restrict the possible key search where a portion of the private key and a portion of the public key hash is known?

I’m in the following situation : I’ve a portion/first bytes of a private secp256k1 security key such as it would take minutes to fully recover it through Pollard’s Kangaroo if I had the public key. ...
user2284570's user avatar
3 votes
1 answer
1k views

When incrementing a private key by 1, by how much is the public key Incremented?

If you have a secp256k1 keypair and you increment the private key by 1, then a faster way to compute the new public key is to perform an addition on the previous public key. But by how much? Some ...
user2284570's user avatar
1 vote
0 answers
209 views

Need help with Cryptohack's ProSign 3 ECDSA problem [closed]

I'm trying to solve the CTF challenge called ProSign 3 at Cryptohack platform which involves exploiting an ECDSA signing service that allows us to sign a fixed message being padded with the time ... ...
YazeedAllabadi24's user avatar
1 vote
0 answers
46 views

I want to find the Zero Value Points on SECP256R1 curve... Is there an alternative to Chien's method of finding roots over large Finite Fields?

This PDF explains that on certain elliptic curves, there exists ZVP (Zero Value Points) that cause zero value registers during the scalar-to-point multiplication (i.e during the double operation or ...
Cyth's user avatar
  • 11
0 votes
1 answer
71 views

wrting algorithm for torsion group elements

Yesterday,I took an exam. There are two questions I received very low points. I will write the first question in this post. The question says let $E:y^2:x^3+kx+1$ in GF(p) be an elliptic curve where p ...
user avatar
1 vote
0 answers
129 views

Curve448 ECC parameters for use with OpenSSL

I need to be able to deterministically generate (and re-generate) private-public ECC key pairs curve448 for ECDH from human-friendly passphrases (not necessarily human-memorable, just easy to type in),...
Logan R. Kearsley's user avatar
0 votes
1 answer
195 views

How to know if an ECC public key is y or -y

I'm a beginner still learning how ecc works... And i think I understand that in secp256k1 public keys there is something called addictive and negative inverse for example private key:- ...
Melwyn's user avatar
  • 1
1 vote
1 answer
52 views

Is there any reference about the half-trace when m is even in F(2^m)

There is a algorithm listed in D.1.6, Algorithm 3, it seems that it is used to solve the quadratic equation when $m$ is even in $F(2^m)$. However, I can not find any reference about this algorithm, as ...
Insecticide's user avatar
4 votes
1 answer
140 views

Changing ECDSA for Shorter Signatures: deterministic k

I am exploring a modification to ECDSA to produce shorter signatures, even though it compromises security (in a controllable way). My rationale behind this change is in this discussion. In my ...
Ehsan's user avatar
  • 51
3 votes
2 answers
516 views

Why is the bilinearity of an elliptic curve pairing shown as multiplicative rather than additive?

In vitalik's post here the below is mentioned, This is the pairing. Mathematicians also sometimes call it a bilinear map; the word “bilinear” here basically means that it satisfies the constraints: $...
Chirag Parmar's user avatar
0 votes
0 answers
39 views

Constraints needed to express a + b + c = d in zkp circuit

I am writing an ECC based zkp circuit and need to express the constraints: a + b + c = d a, b, c, d >= 0 a, b, c, d will be represented by points on the curve so addition can wrap around the ...
gws's user avatar
  • 101
1 vote
1 answer
101 views

Montgomery Curve Point Multiplication in Projective Coordinates

Is the result of 4G the same when calculated as 3G + 1G or 2G + 2G in projective coordinates? Considering a curve like (y^2 = x^3 + 10x^2 + x (mod 83)) with a Generator point G = (3, 28) in affine ...
Nawras Hussein's user avatar

1
2 3 4 5
45