Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

Filter by
Sorted by
Tagged with
0
votes
1answer
18 views

Is it secure to use ECDSA for any arbitrary point on the Elliptic Curve as the Generator point?

My question concerns the elliptic curve $E$ over a prime field $\mathbb F_p$. To the best of my understanding, ECDSA requires a Generator point $G$ of prime order $n$, and the $r$ and $s$ values of ...
1
vote
1answer
82 views

How to Sample from Frobenius Eigenspace?

So I was implementing the $2$-point method described here[1], which requires to samples two points $P_0, P_1$ in the Frobenius eigenspace initially. It uses a method called Elligator, which seems to ...
1
vote
0answers
41 views

Security of ECC over finite fields of characteristic $p\approx2^{50\pm10}$?

What's the security of Elliptic Curve Cryptography over finite fields of word-sized characteristic $p\approx2^{50\pm10}$? We are talking about $\Bbb F_q$ where $q=p^k$ for some suitable $k$. ...
0
votes
1answer
63 views

Elliptic Curve - X Coordinate

I am currently working on a Koblitz curve. I have found the curve has two matching groups based on the base curve point and N-1 point. My question is as follows: Is there an algorithm to determine how ...
1
vote
1answer
60 views

Is there an asymetric encryption whos output size is quite equal to the input size

I want to verify, that a chunk of data which has a size of around 16 bytes is sent by me, by simply encrypting it via a private rsa key, providing the public key in the source code for the ...
1
vote
0answers
43 views

Is this distributed random oracle scheme safe?

This question comes from an issue raised in another question: Non interactive threshold signature without bilinear pairing (is it possible)? Is the proposed random oracle model safe when trying to ...
2
votes
0answers
59 views

Probability of a prime number of points on an elliptic curve over a prime field

Suppose we have some elliptic curve defined over $\mathbb F_p$, with $p$ a large prime. Let $n$ be the number of points on the curve. I am interested in what is currently known about the probability* ...
1
vote
0answers
43 views

How to find Y on an elliptical curve in a finite field?

For example, let's use secp256k1, the curve used by bitcoin, y^2 = x^3 + 7, and x=12. Over the real numbers, that calculation is trivial - I can simply use a calculator. But in a finite field, how ...
0
votes
0answers
20 views

Does reusing the same $R$ in Elliptic Curve ElGamal breach its security? [duplicate]

In Elliptic Curve ElGamal if I reuse the same randomness to get the same point $R$ for different messages, how can it breach its security ? Can you please illustrate with an example? Please see my ...
3
votes
1answer
121 views

How to secure Elliptic Curve ElGamal encryption against known plaintext attacks?

If I have an encoding function $f(x)$ that maps a message $m$ to a point $P$ on a suitable Elliptic Curve $E$ . If I have the public key $Q$ of my recepient then I can encrypt the message as follows: ...
6
votes
1answer
83 views

Does any $x < p$ satisfy the curve equation of X25519?

I've been reading about the famous X25519, a montgomery curve from wikipedia and in that article they say that we do not have to check for point validity. Is it because that any $x < p$ satisfy ...
4
votes
1answer
108 views

Is Ed25519 really constant-time as widely implemented?

Despite the frequent claims that Ed25519 is more secure against side-channel attacks than (for instance) signatures performed over NIST P-256, I noticed that most implementations (including the ...
1
vote
0answers
50 views

Elliptic curve of order $p = 2q + 1$

Does anyone know an example of an Elliptic Curve of caracteristic $p$ ($E_p$) that has a point generator $G$ that generates a subgroup of order $q$, with $p$, $q$ being prime numbers and $p = 2q + 1$?
2
votes
0answers
27 views

About the scalar multiplication on Koblitz curve in FIPS PUB 186-4 (2013)

In FIPS PUB 186-4, the computation of scalar multiplication on Koblitz curves is given in p.106~109. In p.109, step 11.3, $(r_0,r_1)$ is updated with $(r_1+\mu\,r_0/2,-r_0/2)$. But under ...
0
votes
0answers
28 views

What would be the impact of recently open-sourced Apple's CryptoKit lib as swift-crypto? [migrated]

Some of the APIs like P-256 in the swift-crypto are available iOS 13 onwards. If I import swift-crypto open-source lib from github into projects supporting older iOS versions, would it work? Is it ...
4
votes
1answer
67 views

What is the Bilinear-map accumulator disadvantage

Bilinear-map accumulator [1] is more efficient than the RSA accumulator [2] but do you know any disadvantage for the bilinear-map accumulator when compared to RSA accumulator?
2
votes
1answer
43 views

Does there exist the method of projective coordinates for the computation of scalar multiplication for Koblitz curve?

Although the computation for scalar multiplications for Koblitz curve can be efficiently executed by TNAF method, but it still need to compute the multiplicative inverse for each point addition.
4
votes
2answers
260 views

Why does EdDSA require a b-bit private key instead of b/2-bit?

By design, EdDSA requires a $b$-bit string as the secret key $k$, and when signing, it is expanded to a $2b$-bit string $H(k)$, some bit-twiddling is done, and the first half is used as the private ...
3
votes
0answers
81 views

Which is the smallest safe elliptic curve (bit-length)?

At https://safecurves.cr.yp.to/ some elliptic curves are listed which passed certain security test. The smallest bit-length of a safe curve listed there is 221 bits. At wiki page discrete logarithm ...
1
vote
1answer
64 views

Double discrete logarithm on elliptic curve

Background: I am attempting to implement the paper Publicly Verifiable Secret Sharing. I managed to get it working using modular groups, but when I want to make it more efficient by transferring to ...
5
votes
1answer
111 views

Protecting Ed448 against DPA and fault attacks

There are some papers (1, 2) describing fault attacks in EdDSA. One suggested countermeasure is to add randomness to the input of the first hash call, which outputs a scalar. This paper describes a ...
0
votes
0answers
19 views

Lifting point to quadratic twisted curve

How to lift point to it’s quadratic twisted curve? I use secp256k1. Is the diiscrete log still same? Thanks before
3
votes
0answers
50 views

ECC: Lightweight proof of correct exponentiation

In the context of ECC. There's an EC point $P$ which is supposed to be a known power of another known point $G$ (generator). That is: $P = [k]G$ (in additive notation) This should be verified on an ...
0
votes
0answers
31 views

BIP32 Extended Key to EC Private and Public Key Pair

We are working on an application in Android using Java. In our project, we used to generate EC key pairs (of size 384 bits) using SpongyCastle - an old Android version of Bouncy Castle. The problem ...
2
votes
1answer
58 views

Checking if point is on EC twist

Given a short Weierstrass elliptic curve $C$ over $F_p$ and a point $(x, y)$, it is easy to verify that $(x, y)$ either satisfies the curve equation (on-curve) or does not (off-curve). In the case ...
0
votes
0answers
32 views

What is the best way to encrypt whole partitions with Ed448-Goldilocks?

I like crypto, but I'm a bioanalytical chemistry person by trade. I like this algorithm and was wondering if I could use it to encrypt partitions like a MBR that prompts a passphrase, like BitLocker.
2
votes
0answers
52 views

Shamir three-pass protocol Elliptic Curve

I want to know how I can implement this protocol. I know how Shamir three pass protocol operates without elliptic curve, but I don't know how I can perform it with elliptic curve. I read about this ...
2
votes
3answers
159 views

Can DNA computing to solve elliptic curve algorithms using this method

The authors of this paper: Fast Parallel Molecular Algorithms for DNA-Based Computation: Solving the Elliptic Curve Discrete Logarithm Problem over $GF(2^n)$ proposed a novel algorithm based on DNA ...
0
votes
1answer
43 views

Division of Point in Elliptic Curve: Getting Back Point

Let $P=(x_p,y_p)$ be a point on elliptic curve $E (a, b) := y^2=x^3+ax+b$, for an integer $n$, there exists a point $Q=(x_q,y_q)=nP$ on $E (a, b)$. If $(x_q,y_q)$ and $n$ are given, what is the ...
0
votes
0answers
41 views

Can knowing the ephemeral key recover the private key in ECDSA

If the attacker - some guy who really, really wants to steal bitcoins - somehow finds the ephemeral key used in an 256-bit ECDSA signature, can he recover the private key? If so, would knowing the ...
1
vote
0answers
47 views

Elliptic Curve (Point Counting)

I am studying elliptic curves in particular point counting. If I have coordinates P and 2P, is there a way to calculate the total points in between P and 2P using either curve parameters or algorithm? ...
2
votes
1answer
63 views

Finding subgroup in elliptic curve over finite field $ \mathbb{F}_{11}$

For elliptic curve $ y^2 = x^3 +3x+7$ I found the finite group $ E(\mathbb{F}_{11})= \left\{ \mathcal{O}, (1,0),(5,2),(5,9),(8,2),(8,9),(9,2),(9,9),(10,5),(10,6) \right\}$. I have to find a ...
0
votes
0answers
27 views

Pair-friendly elliptic curves vs non friendly

Group law operations on pair-friendly elliptic curves are slower than in non friendly elliptic curves, but how much slower? Can't seem to find a performance comparison between the two for a given ...
0
votes
0answers
37 views

Generalized Schnorr's signature variations

I'm working on an ECC-based system. There's a Schnorr's signature, by which the prover may prove a knowledge of a preimage (i.e. scalar, private key) of an EC point (i.e. public key). It can be ...
1
vote
1answer
51 views

Does ECC's cofactor affects ECC's private key selection?

I am doing a project using ECDH with Curve25519. I use mbedtls library, in the implement, I realize that the private key of Curve25519 is clear 3 last bit, or it is divide by 8 and the cofactor of ...
1
vote
1answer
83 views

Elliptic Curve vs RSA key length comparison

I'm new to ECC. From this website (GlobalSign Elliptic Curve Cryptography) a 256 elliptic curve key pair provides as much security as a 3072 bit RSA key pair. My question is: how do experts come to ...
4
votes
1answer
151 views

Is double encryption really a bad idea? Are meet-in-the-middle attacks practical at all?

Meet-in-the-middle attacks are used to justify that attacks on ECC and double encryption will have complexity of $O(\sqrt{n})$ for ECC and $O(2^{n+1})$ for double encryption complexity instead of $O(n)...
1
vote
2answers
63 views

How to impelement mapping point Curve25519 to weierstrass point?

I am implementing a ECDH using Curve25519 to communicate two system. One system have library that use for weierstrass curve only, it can define with domain parameter like p, a, b, G_x, G_y. I have ...
1
vote
0answers
57 views

is forward secrecy irrelevant for non-streaming applications?

I asked a question yesterday about the Keybase key model and got no answers, unfortunately. Let me rephrase the question to make it clearer: in the case, if 2 users just want to send each other low-...
1
vote
0answers
44 views

Trying to understand Keybase's key model and replacing PGP with device keys

I am exploring Keybase and I thought it was merely a wrapper for gpg and connecting its public key with social accounts (e.g. github, twitter, etc...). But after reading the very short and unclear ...
-2
votes
1answer
65 views

ECDSA multiplication vs exponentiation

In Elliptic Curve Digital Signature Algorithm (ECDSA) I often see 2 different written equations of it: Elliptic curve point multiplication by a scalar, $Q_{A}=d_{A}\times G$, source Modular ...
0
votes
0answers
38 views

Where can I find standardized implementations of lightweight cryptographic ciphers?

I am working on a project that requires encrypting messages with different ciphers. I am looking for the following ciphers: PRESENT, CLEFIA, LEA, Hill cipher, Affine cipher, Elliptic Curve ...
1
vote
1answer
94 views

Assistance with parsing PGP PRIVATE KEY BLOCK's Secret-Key Packet (0x6) and Secret-Subkey Packet (0x7) using command lines and RFC 4880?

The throw away private keys below (master ed25519 & subkey curve 25519) were exported without being password encrypted. % cat skaht_0523F5B4_Secret.asc ...
1
vote
0answers
49 views

Verifying the ownership of curve25519 public keys

Let's say we have a group of users, authenticated by a server that providers the service, communicating on a secure channel (e.g. over HTTPS/TLS) and each user has a corresponding curve25519 key pair. ...
1
vote
1answer
83 views

Complexity of computing zk-SNARK Proofs

Disclaimer: I have no background in cryptography, and everything I'm asking about is what I've learnt from last couple of days of frantic reading on this topic. Any help is much appreciated. Q: What ...
0
votes
1answer
48 views

Understanding simplification steps when solving complicated equations in Galois Field

I just encountered a problem when I tried to understand a basepoint conversion from x25519 to ed25519. I can't really wrap my head around how the value of $x$ can be the stated value below? Can ...
6
votes
2answers
454 views

How to create an EC point from a plaintext message for encryption

It seems that ElGamal encryption is also possible for Elliptic Curve cryptography. However, that requires the user to convert the message to a point on the curve. What strategies are there to derive a ...
0
votes
1answer
91 views

ECC public key encryption without symmetric cipher

Imagine the following scenario. A process is running in background and permanently encrypting some data. An adversary has full control of the process, e.g. it can dump the process memory any time and ...
3
votes
2answers
80 views

Size of $E$ over $\mathbb{F}_p$ contains $p+1$ points

I am struggling to prove this claim: I proved that the map $x\mapsto x^3+1$ is a bijection from $\mathbb{F}_p$ to itself if we have that $p\equiv 2\bmod{3}$. We have to use this fact to prove that ...
0
votes
0answers
27 views

Compute shared public keys

I want to compute, in a distributed way, the following shared public keys on an elliptic curve: $(xG, x^2G,...,x^nG)$, being $x$ a secret scalar that no single party knows, $G$ the public ...

1 2 3 4 5 28