Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

Filter by
Sorted by
Tagged with
0
votes
0answers
34 views

Generating anomalous elliptic curves with given order [on hold]

First of all please see this paper, I want to fully understand the section 3 and 4 of this paper and write a script that generates an anomalous elliptic curve with given prime order. Furthermore how I ...
0
votes
1answer
58 views

RSA vs Elliptic Curves

I am currently reading about how more efficient and ''light'' is ECC compairing to RSA as far as key generation is concerned. My question is simple, why does RSA continue to be used today (ex.SSL) ...
3
votes
0answers
44 views

Hash multiset to point on elliptic curve where $A = 0$

I want to hash a multiset to a point on the elliptic curve $y^2 = x^3 + 3$ over a finite field of some 254-bit prime order, where $P = 3 \pmod 4$. Moreover, I want this hash to be incremental, in that ...
2
votes
1answer
59 views

Elliptic Curve Discrete Log in a Composite Ring

Elliptic curves are usually defined over prime rings (fields), but what if we chose a ring of composite order? Let $n = pq$ for $p,q$ large primes. Say I have elliptic curve $y^2 = x^3 + ax + b$ over ...
0
votes
1answer
69 views

Learning elliptic curve cryptography for specific application

I would like to develop a protocol for specific purpose. This protocol will utilize asymmetric cryptography in which one private key can be paired with numerous public keys: messages encrypted with ...
4
votes
1answer
65 views

secp256k1 point density

I am working on a crypto project using the secp256k1 elliptic curve. I know that I can select a random point $P = (x, y)$ from the curve by randomly selecting the first coordinate $x \in \mathbb{Z}_p$...
0
votes
1answer
55 views

Elliptic curve with prime subgroup equal to field size

I am aware that when the equation $\#E(\mathbb{Z}_p) = p$ holds for prime $p$, the elliptic curve is called "anomalous" and is insecure do to "Smart's attack". Consider the similar case that $E(\...
1
vote
2answers
64 views

Using public-key signature instead of having API key

I am designing an application that will need an API key. At first I believed that generating a long, random token would be secure enough (say 32 chars string that includes 0-9, a-z and A-Z), and then ...
1
vote
2answers
64 views

“Dave Check” for a tweakable P-256 ECDH KDF

I have two devices with hardware tokens that contain P-256 private keys, and which allow me to compute ECDH shared secrets with arbitrary public keys. I need to build a tweakable key derivation ...
0
votes
2answers
83 views

Discrete logarithms on elliptic curves

In many examples of attacks on public key cryptography, examples of the form $a ^ x = b$ are used, but I can not understand the correlation between this and the multiplication of the generator point ...
-1
votes
1answer
59 views

P256 Key size and validation [duplicate]

Given a public key on the P-256 Curve is it correct to say that the public key is 64 bytes long ie. (x,y)? Secondly is the private key 32 bytes long? if so, how is the private key generated and why ...
0
votes
0answers
29 views

Is there an O(1) in space complexity k-of-n signature scheme?

I was looking in depth into Schnorr signatures recently, and while they are very attractive for their ability to be aggregated, this only works for n-of-n ...
-1
votes
1answer
71 views

Is that possible to calculate modular inverse of a point on elliptic curves?

Imagine that you are given a point $P$ so that $P=a\times G$. If you have no knowledge of $a$ is that possible to calculate point $I$ so that $I$ is the modular inverse of $P$? We know that over ...
2
votes
1answer
88 views

Is there any asymmetric encryption algorithm for eliptic curve(secp256k1) without AES? [duplicate]

I am looking for asymmetric encryption using SECP256K1. But all over the internet, I see that it also requires AES encryption. Instead of generating an AES secret key, is it possible to encrypt using ...
0
votes
0answers
32 views

ECDSA dA multiplication algorithm [duplicate]

I was looking at this question and i can`t understand this part: QA = dA G = 5 (5,1) = (9,16) I saw that algorithm used for this was Double-and-add algorithm but i didn't get it. Can ...
2
votes
2answers
87 views

Talking TLS with EC cryptography and the secp256k1 curve [duplicate]

How reasonable would it be to speak TLS over the secp256k1 curve? My initial experiments show that OpenSSL supports it (albeit with special flags, see below): Running an OpenSSL client against an ...
4
votes
2answers
546 views

ECDSA: Why is SigningKey shorter than VerifyingKey

Total Crypto Noob here. I was wondering why in ECDSA the Signing Key is so much (half of) shorter than the Verifying key? Lets look at some python code: ...
0
votes
1answer
51 views

Elliptic Curve Cryptography messages vs keys encryption [duplicate]

I have read a few tutorials about ECC implementaiton in C. What I am confused is this: Can I encrypt messages with ECC and without the use of any other algorithm, like AES, RSA or should I use them ...
1
vote
1answer
44 views

ECDH for more than two parties

With classic diffie-hellman it's possible do it with more than two parties. Is this applicable to elliptic curve diffie hellman? I'm guessing not. With ECDH you have a scalar number as the private ...
1
vote
0answers
45 views

GPG implementation of ECC “Encryption” (ECDH) vs RSA

My understanding of GPG with traditional RSA keys, is that RSA is by definition can be used to both sign and encrypt. This is because RSA can be directly applied to plaintext in the following form: <...
1
vote
0answers
35 views

How to use Montgomery arithmetic for elliptic curves (FIAT cryptography)

Let us consider the source code for curve P-256 from BoringSSL. This source code can be found here. This source code uses the FIAT generated implementation for field arithmetic. This implementation ...
1
vote
0answers
35 views

Is ECC multiplication over real number also one-way? [duplicate]

ECC multiplication over GF(p) is clearly one-way. How about ECC over real number? Is ECC division over real number also practically impossible?
5
votes
2answers
885 views

Raw curve25519 public key points

I'm trying to understand curve25519, and ECC public points. I'm playing with Minisign, to better understand the fundamentals of ECC. Minisign uses curve25519 and outputs public keys as base64 ...
1
vote
1answer
39 views

CSR signature using elliptic curve [closed]

We've been asked to generate a certificate signing request using elliptic curve and we can't use any third-party library as it's an embedded application with very limited resources). We are used to ...
0
votes
0answers
26 views

ECDHE Key with KDF Necessary [duplicate]

Is it necessary to pass a ECDH generated key to a KDF? According to the python cryptography documentation, it is stated that For most applications the shared_key should be passed to a key ...
1
vote
1answer
63 views

Point doubling with only one coordinate

In many source codes that implement ECDH, there is a function that multiplies the base point of that curve with a constant. This function usually takes as arguments the constant and just one ...
5
votes
1answer
175 views

Difference between Pure EdDSA (ed25519) and HashEdDSA (ed25519ph)

My question refers to EdDSA as specified in RFC 8032. I get from the RFC that ed25519 and ed25519ph are two different instances of EdDSA mainly differing in the fact that that in the case of ...
4
votes
0answers
71 views

Why do Edwards curves protect against side-channel attacks?

From Wikipedia: One of the attractive feature of the Edwards Addition law is that it is strongly unified i.e. it can also be used to double a point, simplifying protection against side-channel ...
3
votes
1answer
203 views

Representations of secret keys on Curve25519

https://tools.ietf.org/html/draft-josefsson-tls-curve25519-06#appendix-A.2 gives the following as a secret key / public key combo: ...
1
vote
1answer
91 views

Can the RSA accumulator scheme be converted to Elliptic Curve math?

Is it possible to translate the RSA accumulator scheme directly to EC without requiring bilinear pairings? In RSA we have: $A_{n+1} = A_n^c$ st. $\{c \: \textrm{prime} \: | \: c \in [\...
1
vote
1answer
63 views

Secure Communication

Focus: I have to design a secure keep alive communication protocol and was wondering if it was necessary to sign the ciphertext after the session key has been generated as an attacker will not know ...
1
vote
1answer
57 views

Computational Complexity: ECC multiplication vs Modular multiplication

How does performing scalar multiplication on an elliptic curve compare to exponentiation in a multiplicative group modulo a prime? I.e. on a given elliptic curve of size $|t|$, what's the complexity ...
0
votes
0answers
43 views

Difficulty of Reversing Elliptic Curve

In ECC, it is apparently easy to verify the final point given the starting point and the number of hops. But it is difficult to compute the number of hops given just the starting point and the final ...
1
vote
1answer
37 views

formulas for adding points on curve25519

Curve25519 is a Montgomery curve. https://hyperelliptic.org/EFD/g1p/auto-montgom-xz.html#diffadd-dadd-1987-m-3 gives a set of formulas for adding two points (well, more specifically, the X coordinate ...
10
votes
1answer
1k views

Why are co-factors 4 and 8 so popular when co-factor is more than one?

For elliptic curve cryptography, I seem to keep coming across curves with either co-factors of 4 or 8 whenever it is a non-prime order group. Is this a co-incidence? Have we studied ECC for curves ...
2
votes
1answer
49 views

Why does Ed25519 scalar multiplication allow values larger than the subgroup order?

The GeScalarMultBase function is documented like so. From the way it is documented we see that it expects a little-endian value and has a precondition that constrains the range it accepts. ...
13
votes
2answers
569 views

Is it safe to reuse a ECDSA nonce for two signatures if the public keys are different?

We denote the s value of an ECDSA signature $(r, s)$ on a message $m$ as: $s=\frac{H(m)+xr}{k}$ Assume two ECDSA signatures sharing the same nonce $(r, s_1) , (r, s_2)$ on two messages $m_1, m_2$, ...
3
votes
0answers
70 views

Check validity of generated parameters for SIDH

In section 4.1 of the paper Towards Quantum-Resistant Cryptosystems From Supersingular Elliptic Curve Isogenies by Feo, Jao and Plût it is described how you generate valid parameters for the SIDH ...
0
votes
1answer
47 views

Get points of an Elliptic Curve defined over a Finite Field on Twisted Edwards Extended Coordinates

I'm working on a crypto library, and I need to perform some tests for the implementation of: Point Addition. Point Subtraction. Point Doubling. Scalar Mul Point. The operations are performed on ...
1
vote
1answer
133 views

curve25519 by openSSL

How can i generate ec curve25519 keys using openSSL? When I run openssl ecparam -name curve25519 -genkey -noout -out private.ec.key I have this message ...
1
vote
1answer
38 views

Does any problem arise when the order of an elliptic curve is equal to its prime field modulus? [duplicate]

Regarding cryptographic schemes in elliptic curve cryptography, is there a problem with having the order of an elliptic curve being equal to its prime field modulus? That is, an elliptic curve where $...
0
votes
0answers
48 views

Modifying Elliptic Curve Parameters

For context, I was watching this bit of the video: which goes over this source code. The piece is about elliptic curve cryptography and how it works. I want to use some of this knowledge to make my ...
0
votes
0answers
25 views

What is the cryptography involved in the initial setup of a cryptocurrency?

I keep hearing that when a cryptocurrency is created it goes through an initial setup phase wherein cryptographic parameters are created that are used by the cryptocurrency network throughout its ...
0
votes
0answers
39 views

The ECC private key is generated with 0x00 at the beginning.(prefix)

I created a private key using the prime256v1 curve. My purpose is to get a 32 byte private key. However, the private key is preceded by 0x00, resulting in 33 bytes. Why is this happening? The only ...
0
votes
0answers
27 views

How to get a random point of a specific EC group with cofactor Not-Equal 1?

We got a EC group generated with point G, and the cofactor of E(G) is with the similar size of the Order. Now we need a random point of E(G) and not revealing the "logarithm" of the random point, so ...
2
votes
1answer
81 views

Are there any security risks in using Elliptic Curves defined over fields $\mathbf{F}_{p^n}$ where $n>1$

I've recently been studying elliptic curves, and I've found that most of the current implementations use fields $\mathbf{Z_p}$ or in some cases $\mathbf{F}_{2^n}$. All the reasons I've seen for not ...
1
vote
1answer
42 views

Replacing elliptic curve diffie-hellman primitive with elliptic curve cofactor diffie-hellman for specifc curves?

From what I've read about elliptic curve Diffie-hellman with and without cofactor (I am pretty new to the whole thing so I am not able to understand everything) is that when the cofactor of the curve $...
0
votes
1answer
61 views

Why does Hasse's theorem sometimes seem to be invalid?

In order to generate secure elliptic curves, this answer recommends to Calculate the cardinal $|E(\mathbb{F}_p)|$ Check this cardinal is in the hasse interval (with $p$ prime) and to ...
4
votes
1answer
107 views

Elliptic Curve Cryptography insecure when input does not lie on the curve?

I am new to Elliptic Curve Cryptography and I was reading up on it online when I came across this link. It stated the following. Unfortunately, there is a gap between ECDLP difficulty and ECC ...
0
votes
1answer
45 views

Reasoning about WebCrypto ECDSA choices: P-256/384/521, SHA-1/256/384/512?

When implementing EC signing/verification in Javascript, the only options available via the WebCrypto API are: Curves: P-256, P-384, or P-521 Hashes: SHA-1, SHA-256, SHA-384, or SHA-512 If I was ...