Questions tagged [elliptic-curves]
Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.
2,124
questions
0
votes
0
answers
41
views
Ed25519 and sealed boxes libsodium
Accidentally used ed25519 public key to create libsoidum_sealed_box. Is there any way to decrypt the data if the private key ed25519 is known?
3
votes
0
answers
93
views
EC public key with leading zeros
Let us take example of secp256k1 curve. The current known public key with most leading zero (in x cordinate) is:
...
- 31
1
vote
0
answers
66
views
Does ECC give the most secure assymetric cipher for a given public key size?
Cracking an ideal block cipher is basically a brute force key enumeration. The complexity of the attack is exponential, growing as $2^b$. Cracking ECC is also exponential, but the cost grows as $2^{\...
- 21
3
votes
1
answer
1k
views
Why do we need additional secret value (k) in ECDSA?
Formula for calculating an ECDSA signature (r, s) is:
s = k-1(z + qr)
k - private key for a random point R
z - hash of a message
q - original private key
r - x(R)
I am interested in why do we need ...
- 133
2
votes
1
answer
226
views
Is there an algebra group (or ring) in which computing the inverse element is hard without some trapdoor information?
Specifically, I want an algebra group $G$ (or ring $R$) features:
Given elements $g,h\in G$ (or $R$ ), computing $g\cdot h \in G$ (or $R$ ) is easy.
Given an element $g \in G$ (or $R$ ), finding the ...
- 368
-2
votes
3
answers
94
views
Understanding Point Negation in secp256k1 Elliptic Curve
I'm exploring the secp256k1 elliptic curve in the context of cryptography and encountered the concept of Point negation. I would appreciate clarification on what point negation means in this context.
...
- 9
1
vote
0
answers
66
views
Can the byte overhead of an ECDH based hybrid cryptosystem be reduced by encoding data in ephemeral key?
Motivation
I have a use case that involves sending small (25-50 byte) encrypted messages over a very constrained channel. Many senders send public key encrypted messages to other receivers. Anonymity (...
- 1,701
0
votes
0
answers
48
views
Efficiently using BSGS or other algorithms if key range is known on Elliptic Curves
Let $X$ be a point on an elliptic curve such that $X = [x]G$, where $G$ is a generator. Let us assume that we know $x$ is something $x = 65t + 1$ where $t$ is an integer.
Now if I know that the key ...
- 31
0
votes
1
answer
153
views
Implementing Floor Division on secp256k1 Elliptic Curve in Python
I understand that the // operator is used for floor division in regular arithmetic
result = 7 // 3 # This will result in 2
but ...
- 9
1
vote
1
answer
171
views
Key exchange for encrypted firmware update
I'm trying to implement encrypted firmware update functionality for an embedded device. The goal is to prevent reverse engineering of our firmware when the update files are shared with our customers.
...
- 23
2
votes
1
answer
96
views
Recover Y coordinate from xz elliptic curve multiplication
I have an elliptice curve in the form
y² = x³ + ax + b (mod p)
And I have a multiplication algortihm which uses only x and z coordinate
How can I recover the Y coordinate ?
I tried to use the curve ...
- 21
2
votes
2
answers
90
views
Is it possible to check pedersen commitment is of postive or negative number without knowing the original value
I generated a Pedersen commitment for a given account balance (say, 10) and stored it in the ledger. Now, when I debit 15 tokens from the same account, I first retrieve the Pedersen commitment of 10 ...
- 21
0
votes
0
answers
29
views
Three ECDSA signatures sharing first component r, verifying against same message and public key?
For some common curve, can we exhibit three distinct ECDSA signatures $(r,s_1)$, $(r,s_2)$, $(r,s_3)$, a message $m$, and valid public key $Q$, such that the signatures verify?
Can we also generate ...
- 138k
2
votes
0
answers
40
views
SRP on elliptic curves: replacing + and - operations?
I was thinking about how SRP might be used with Curve25519 or Curve448. In this question, Can SRP be used with Elliptic Curves?, the answer is that you can't directly translate SRP to a group that ...
- 2,513
1
vote
1
answer
126
views
Double- and -add algorithm
I am currently doing the elliptic curves and I'm stuck for 8 hours without finding solutions. I under stand the process of double and add but don't know how to obtain 5 * 8P = 4OP =11 P. 11 P was in ...
- 11
1
vote
1
answer
171
views
Finding scalar in scalar multiplication on secp256k1 elliptic curve
In elliptic curve cryptography using the secp256k1 curve, how can I determine the number of times the base point $G$ has been multiplied to derive a new point? The formula is as follow:
$k * G = Q$
...
- 21
2
votes
1
answer
79
views
What would be the security consequences of replacing $H(R, A, M)$ with $H(R, M)$ in EdDSA?
The question is mainly stated in the title. We don't consider any other changes to the scheme except for the following:
We replace $S = H(R,A,M) \cdot a + r$ with $S = H(R,M) \cdot a + r$.
My thoughts ...
- 878
3
votes
0
answers
105
views
Elliptic Curve Scalar Multiplication - Boneh & Shoup
I'm currently reading the 'A Graduate Course in Applied Cryptography' paper written by Boneh and Shoup. More precisely, I'm reading the chapter about 'Elliptic Curve' and I'm stuck at the exercise ...
- 31
0
votes
0
answers
33
views
can ownership proofs be added to circuits to make them zk-snark resistant to quantum proof forgery attacks?
According to my previous question the proofs cannot be broken by quantum computation, you cannot obtain the witness of the generated zk-snark proof.
link to my previous question.
Now if the concern is ...
- 3
-1
votes
1
answer
156
views
Why don't secp256k1 use a prime order subgroup?
Using a prime order subgroup prevents mounting a Pohlig–Hellman algorithm attack. Meanwhile, secp256k1 doesn't use a ...
- 409
2
votes
1
answer
195
views
Which benefits do Twists of elliptic curves bring?
I understand that an elliptic curve $E$ over a field $K$ has an associated twist, that is another elliptic curve which is isomorphic to $E$ over an algebraic closure of $K$.
Which cryptographic ...
- 409
0
votes
1
answer
80
views
can secrets be deciphered from the proofs generated with ZK-Snarks if a quantum attack were plausible?
can secrets be deciphered from the proofs generated with ZK-Snarks if a quantum attack were plausible?
I understand the concern that ZK-snarks and some of their cryptography may be broken by quantum ...
- 3
0
votes
0
answers
50
views
Framework for manipulating digital signatures
for a research project, i am currently looking for a way to manipulate the digital signature of a HTTPS TLS message flow. More specifically, i am trying to create a working example for a malicious ...
2
votes
2
answers
132
views
Elliptic curves over extension fields
I'm trying to understand which benefits can using of extension fields in elliptic curve cryptography bring over prime fields. Popular curves like secp256k1, curve25519, secp384r1 are defined over a ...
- 409
-1
votes
1
answer
158
views
Can the public key be derived from the private key? [closed]
The calculation/formula i use in deriving a public key from the private key without importing any module in python3 script involves the following steps:
Define the parameters of the secp256k1 ...
3
votes
2
answers
229
views
Could a EC public key have zero coordinate?
Take secp256r1 as an example, the parameter of the curve is
...
- 133
-2
votes
1
answer
136
views
Validating slope (s) in secp256k1 elliptic curve
knowing the coordinates of $R$ on secp256k1 and an integer $s$, how do we validate that $s$ is the slope at the point $Q$ on secp256k1 such that $R=2Q$ ?
- 29
2
votes
1
answer
178
views
Point halving formula for Koblitz curve over prime field
Consider a Koblitz elliptic curve over a prime field $\mathbb F_p$, with equation $y^2=x^3+b$, prime order $n$ close to (but different from) $p$. This includes secp256k1, secp224k1, secp192k1, ...
- 21
3
votes
0
answers
74
views
Real-world protocols based on pairings such that the number of additions in $\mathbb{G}_1$ is equal to the number of additions in $\mathbb{G}_2$
Consider a pairing-friendly elliptic curve $E$ over a finite field $\mathbb{F}_q$ with embedding degree $k$. Do you know examples of real-world cryptographic protocols based on pairings $\mathbb{G}_1 \...
- 395
-1
votes
1
answer
273
views
How to convert (Rx1 and Ry1) to (Rx2 and Ry2)
I'm working with the secp256k1 elliptic curve and have point doubling and point addition formulas for this curve.
If a point is given $Q_x$ and $Q_y$
...
- 29
0
votes
0
answers
56
views
Same message different nonce but similarities in r value of the signatures(r,s)
I'm studying a case where when i sign a same message with the same private key and a different nonce, i sometimes get signatures (r,s) where r values share some similarities (same numbers at the same ...
- 101
1
vote
2
answers
268
views
PAGE 2: Can I move elements from cyclic subgroup to its cyclic parent group?
We will continue our previous topic here⬇️ for clarity...
The following context is based on elliptic curves in short-weierstrass form y^2 = x^3 + b.
pls read carefully-
I am looking for a function/...
- 21
1
vote
2
answers
225
views
Can I move elements from cyclic subgroup to its cyclic parent group?
The following context is based on elliptic curves in short-weierstrass form y^2 = x^3 + b.
I know that elements of a non-prime order cyclic group G can be moved to its subgroup H by a process called &...
- 21
1
vote
2
answers
73
views
Zero Knowledge Argument for Elliptic Curve Multiplication/Inverse Multiplication Correctness?
I was reading this post and the accepted answer wrote about a way to “prove that some list of points $[A,B,C,...]$ when multiplied by $x$ produces $[A′,B′,C′,...]$”. However, in their explanation ...
8
votes
1
answer
458
views
Who originally generated the elliptic curve now known as P256/secp256r1
Background: there is a theory going around that claims that P256 was backdoored by the NSA. The theory goes is that the NSA found a weakness that applies to a nontrivial fraction of elliptic curves (...
- 145k
0
votes
1
answer
60
views
Does BearSSL Library Support ECC Encryption/Decryption Functionality?
I'm researching cryptographic libraries for a project I'm working on, and I'm particularly interested in the BearSSL Library due to its lightweight nature. But I'm not sure if it supports ECC (...
- 1
0
votes
0
answers
77
views
Formula for deriving the x-coordinate using the y-coordinate (decompressing a compress public key)
According to my understanding a public key is made up of x and y coordinate and a compress public key is made up of the y-coordinate since it's possible to directly calculate the uncompress public key ...
- 29
5
votes
1
answer
530
views
Why do Ed25519 use Twisted Edwards curve but not regular Edwards curve
I'm trying to understand benefits of using Twisted Edwards curve over regular Edwards curve. I'm aware of some properties of Twisted Edwards curve that regular Edwards curve missing like isomorphism ...
- 409
0
votes
0
answers
20
views
Use secp384r1 PEM key to sign a Verifiable Credential with Linked Data proofs
Ok, let me preface this by clarifying that I am not a cryptographer by trade, but I've been using cryptographic suites in the context of signing w3c Verifiable Credentials, and I am not sure if this ...
- 101
1
vote
1
answer
149
views
2
votes
1
answer
112
views
Statistics-heavy crypto papers
I'm currently taking a course in which we choose a stats-heavy paper and analyse it, summarising our work in the form of a written report and presentation. I have tried to find such a paper in crypto, ...
1
vote
0
answers
19
views
Does exist an Elliptic analogue of Benaloh encryption scheme?
The definition of Benaloh encryption scheme can be found here.
Does exist an elliptic analogue of this scheme?
I want to use this scheme but the length of the key ...
- 175
2
votes
1
answer
49
views
Reflecting a point on the Edwards curve
Let's say we have a point $nP = (x,y)$ on a curve $E$ over a prime $p$. The corresponding Edwards curve coordinates are $(u,v)$. I want to construct the point corresponding to $(u,-v)$ on the Edwards ...
- 135
1
vote
2
answers
107
views
Deriving $y$-coordinate
Is there any formula for deriving the $y$-coordinate using the $x$-coordinate and the slope in the secp256k1 elliptic curve?
For example:
Calculate the slope:
...
- 29
1
vote
0
answers
87
views
Why are my Curve25519 points so different than standard? [closed]
I'm trying to implement X25519 for a little game I'm working on. I knew nothing about this stuff a week ago so it's been a bit of a learning curve (that was really funny).
Most of the resources I ...
0
votes
2
answers
89
views
Determining the order of operations in elliptic curve cryptography: Point doubling vs point addition for obtaining x and y values of a public key
I have a question regarding the operations performed on an elliptic curve, specifically related to point doubling and point addition. I am trying to understand whether it is possible to determine the ...
- 29
1
vote
1
answer
82
views
In TLS 1.2 and TLS 1.3, does the EC curve used to generate the ephemeral keys be the same on both client and server sides?
In TLS 1.2 and TLS 1.3, does the EC curve used to generate the ephemeral keys at the client side, does it need to be the same as that on the and server sides?
For example can I use secp521r1 at the ...
- 33
1
vote
1
answer
76
views
is it possible to calculate the difference between 2 public keys of secp256k1
I am inquiring about the feasibility of calculating the point difference between two distinct secp256k1 elliptic curve points. Given the nature of secp256k1, which is widely used in cryptographic ...
- 11
1
vote
0
answers
30
views
Disjunctive ZK Proof of knowledge of discrete log
I want to construct a non-interactive ZK proof that in a set of pairs of group (where the DDH-assumption holds true) elements:
$(g_1, Y_1), (g_2, Y_2), ..., (g_n, Y_n)$
, the prover knows at least one ...
- 21
2
votes
0
answers
125
views
Equality of ElGamal plaintext & Pedersen commitment message
Let's imagine two entities: Bob and Alice. Bob's public key is $B = bG$. Alice's public key is $A = aG$.
Alice encrypts her number $n$ with Bob's public key so Bob could decrypt it ($n$ is small ...
- 33