Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

Filter by
Sorted by
Tagged with
1
vote
1answer
17 views

Pairings for Beginners: Pohlig–Hellman attack time complexity

I'm reading Pairings for beginners by Craig Costello. I'm trying to understand this example of (what I think) is the Pohlig–Hellman algorithim (on page 31 of the book). Consider $E/\mathbb{F}_{1021}\,...
2
votes
2answers
171 views

Modulo p in Elliptic Curve Cryptography

To carry out Elliptic Curve Cryptography between parties, are all elliptic curve equations considered to be in the form $\bmod p$? For example, the $secp256k1$ Bitcoin curve of the equation $y^2=x^3+7$...
0
votes
0answers
17 views

Coefficent alteration in elliptic curve equation for Elliptic Curve Cryptography

Something caught my attention while reading about the mathematics behind Elliptic Curve Cryptography. When setting up the elliptic curve equation for communicating between parties, why are only the $a$...
1
vote
1answer
37 views

Which application protocols use elliptic curve key recovery?

Section 4.1.6 of https://www.secg.org/sec1-v2.pdf describes a technique for recovering public keys from ECDSA signatures. I guess Ethereum uses this. Like if you want to validate a particular ...
1
vote
0answers
32 views

Is curve25519 faster than spec256k1 on point multiplication?

Suppose $G_1, G_2$ are the base points on curve25519 and spec256k1, respectively. Point multiplication means to compute $kG_1$ and $kG_2$. Then which curve is faster?
2
votes
1answer
29 views

Why is the set of r-torsion points isomorphic to $\mathbb{Z}_r \times \mathbb{Z}_r$

I'm reading "On the implementation of pairing-based cryptosystems". It states that $E(\mathbb{F}_{k^q})[r]$ is isomorphic to the product of $\mathbb{Z}_r$ with itself. $E(\mathbb{F}_{k^q})[r]...
3
votes
2answers
395 views

Can two different hash function create two unlinkable `ed25519` keys from the same randomness?

Assume the following scenario: Alice has access to 32 bytes of true randomness $s$. Alice hashes $s$ with SHA-512, and uses the resulting hash as the secret $d_{A}$ for ...
0
votes
1answer
72 views

Help breaking ECDSA with biased nonces

I am currently trying to do the cryptopals challenge 62, breaking ECDSA with biased nonces, with the help of those two links (1 2) that describe accurately the attack. However, after around 15 hours, ...
0
votes
0answers
20 views

EC implementation on Edward curves : what modulo is used in implementation?

I'm trying to implement EC scalar multiplication in the fastest way possible (but still with a good curve) on a GPU. I'm specifically looking to implement it based on https://github.com/Chair-for-...
0
votes
1answer
72 views

Is it possible to generate ECDSA signature without nonce?

I am newbie to cryptography and my college has given me this ECDSA. I know that you have to divide result of: h(m)+r.priv in order to generate signature. But is it possible to generate signature ...
2
votes
0answers
18 views

extracting a public key from an Ed25519 private key with OpenSSL? [migrated]

Ed25519 private keys can be generated by doing openssl genpkey -algorithm ed25519 -outform PEM -out private.pem. My question is... using OpenSSL is there a way to ...
3
votes
2answers
105 views

Is using a cofactor to find a base point only for performance reasons?

For elliptic curve cryptography, the procedure to find a base point that generates a subgroup with order $n$ is: Calculate the order $N$ of the elliptic curve (using Schoof's) Choose $n$. $n$ must be ...
0
votes
1answer
48 views

How to prove that an elliptic curve point is smaller or greater than half of the curve's order?

Is it possible to tell if a point on an elliptic curve is less than half of the curve's order? If I have a point $𝐴 = [a]𝐺$ on a curve with prime order q, is there an efficient way to know that $a &...
2
votes
1answer
124 views

Is the STARK Curve a SafeCurve?

SafeCurves defines criterias for choosing safe curves in elliptic-curve cryptography. STARK Curve defines a Stark-friendly elliptic curve that can be used with ECDSA. I was wondering: Is the STARK ...
1
vote
1answer
50 views

How to use ECDSA test vectors?

I would like to verify my system by running ECDSA NIST test vectors, but I am not getting expected output. I am able to calculate signature, but it is not right or at least "r" and "s&...
3
votes
1answer
84 views

Is there any "exception-free" coordinates system for Weierstrass curves?

I'm referencing RFC-6090 for an attempt at implementing ECC in my spare-time project. In the RFC, pseudo-code examples are given to illustrate how to handle points-at-infinity in point arithmetic, and ...
2
votes
1answer
41 views

How to determine whether a point is at infinity in homogenous coordinates?

I'm implementing ECC in my spare time project. I'm referencing RFC-6090 for point arithmetic algorithm over homogeneous coordinates. In Appendix F subsection 2, there are 5 case labels when ...
2
votes
1answer
57 views

Are the FIPS 186-5 and ANSI X9.142-2020 definitions of ECDSA consistent?

FIPS 186-4 Digital Signature Standard defers to ANSI X9.62-2005 for the specification of ECDSA, with additional requirements set out in Chapter 6 and Appendix D. However, X9.62-2005 has since been ...
1
vote
0answers
33 views

Is it possible to recover the private key if the same message is signed twice with different nonce? [duplicate]

Sorry if this question is misguided, I'm a software developer and not a cryptographer. Let's say I have a public key, and 2 signed messages. Signed message 1: ...
0
votes
1answer
54 views

OpenSSL: How to convert ec private key(32byte raw key) to pem type private key?

I have a 32 byte octet string ec private key. And I want to convert this to pem type private key. I use the secp256r1 curve. How can I do that? Is any command or method for that?
1
vote
2answers
54 views

Is it possible to verify that the output of an executable came from its unaltered control flow?

I suppose an executable could contain a key which signs its output, but that key could be extracted and used to sign other data. Is it possible to verify that the output of an executable is the direct ...
4
votes
1answer
123 views

Why is Montgomery Ladder fast on Montgomery Curves?

When I look at the Montgomery Ladder algorithm, I don't find anything that is specific to the Montgomery curve. We are dealing with the points all the time i.e. we are either adding two points or ...
1
vote
0answers
63 views

how calculate 2g ,3g ,

$y^2=x^3+9x+17$ over $\mathbb{F}_{23}$, what is the discrete logarithm $k$ of $Q=(4,5)$ to the base $P=(16,5)$? One (naï­ve) way to find k is to compute multiples of $P$ until $Q$ is found. The first ...
1
vote
0answers
40 views

Deterministic $σ_i$ when implementing traceable ring signature on Curve25519

Fujisaki & Suzuki's Traceable Ring Signature paper, which allows for a signature by one private key out of a ring of public keys to sign, and for anyone to verify that one member of the ring ...
2
votes
1answer
77 views

Add a non-signer to an already-signed message

This is a follow-up to the first comment of this answer. A message is signed with the private key of $A$, $s_A$. We know $p_B$, the public key of $B$, but not $s_B$, their private key. Is it possible, ...
7
votes
1answer
272 views

Find Elliptic Curve Parameters, a and b, Given Two Points on the Curve

I am new to Elliptic Curve Cryptography and am working on a CTF challenge that uses Elliptic Curves. Currently, I am trying to find the generator, $G$, and am given the public and private keys, $P$ ...
1
vote
1answer
52 views

Which elliptic curve was used by Thunderbird OpenPGP and which bitlength?

If one looks at Account Settings > End-to-End-Encryption > Add Key and creates a new key then gets the option EC. But you can't choose the bit length nor does ...
3
votes
1answer
101 views

order of elliptic curve subgroup when curve has point (0,0)

I'm a beginner. But I understand that the order of a subgroup is a divisor of the group order. The curve $y^2=x^3+7$ over $\mathbb{Z}_7$ has eight points (7 points and the point at infinity). The ...
5
votes
2answers
206 views

Cheapest way to prove that two different private keys are known to the same person?

Say that there are two unrelated ECC keypairs ($Pub_1$, $Priv_1$) and ($Pub_2$, $Priv_2$). Alice claims that she knows both $Priv_1$ and $Priv_2$, but Bob doesn't trust her, and thinks that $Priv_2$ ...
0
votes
0answers
45 views

How to get public key and bitcoin compressed address from the coordinates (x,y) generated by ECDSA?

I have my x (0xca668a8b5f71e8724aada4b5343c28702a481787855cc42228b8fff97fe94d6a) and y (0x19dd3a603a55b3d8c5f62cbe177b9b63693fb8c91d76845bafc843a7aa19ea55) coordinates generated by ecdsa with a ...
3
votes
1answer
83 views

Is it possible to calculate multiplication inverse of a point on elliptic curve?

The title must be confusing. Imagine we have this curve: $y^2 = x^3 + 9x + 17$ over $\mathbb F_{23}$ And we know [4]P = (19 , 20) [8]P = (12 , 17) If we only have the value of $[8]P$, Is it ...
2
votes
1answer
133 views

How can I understand the math behind crypto, especially that used in blockchains / distributed ledgers?

A bit of a background about me; Computer Engineer but during my studies I didn't dive too deep into the maths, especially the crypto maths that is used to make the blockchain and cryptography work. I'...
0
votes
0answers
12 views

How to sign CAM/DENM messages using mbed LTS libray with ECDSA (EEE Std 1609.2)

I have read ETSI TS 103 097 and EEE Std 1609.2 which gives me the security data structure defined in ASN.1 notation. I want to use mbed LTS to calculate the ECDSA signature. I understand that I should ...
1
vote
1answer
233 views

What is a function on a Line or a Curve?

I am reading up on Pairings using Elliptic curves & all the texts talk about functions on a Curve. I am finding it difficult to even figure out what they mean by "function on a curve" or ...
1
vote
1answer
48 views

AWS IoT - Unique Keys per each device - Data encryption

(Probably not the right board to ask. But here goes) I'm designing an IoT Solution with RPi as client and AWS as the server. On the client hardware, I have an Security Chip that can securely generate ...
1
vote
1answer
37 views

computation time of pairing operations and their securities

Suppose G1 is an elliptic group and G2 be a multiplicative group and they are of same prime order p and e is a bilinear pairing, e: G1 X G1 -> G2. The operations e(p,q)r and e(pr,q) gives equal ...
2
votes
0answers
58 views

Short Nonces in ECDSA signature generation

Recently I noticed that my device generates short-sized Nonces. Approximately $2 ^ {243} - 2^{244}$. Could it turn out that there will be a small leak of ...
1
vote
1answer
87 views

Convert secp256k1 private key to sr25519 private key

Is it possible to convert secp256k1 private key to valid sr25519 key?
4
votes
1answer
96 views

Would being able of factoring integers efficiently have some consequences over Elliptic Curve Cryptography?

Let's assume you can factor integers in a very efficient manner. Would that endanger the security of e.g. elliptic curve cryptography, or is there no link between the two ? You can often read that ...
0
votes
3answers
131 views

Two Elliptic Curve Points having the Same X coordinate

Suppose in a elliptic curve (say the curve equation is: $y^2 = x^3 -17$) with prime order $q$, we have $(x,y_1) = nP$, where $P$ is a generator and $n<\lceil{q/2}\rceil$. Can we claim that there ...
1
vote
0answers
41 views

Birational transformation from Edwards curve with not square d to Edwards curve with square d

How can I transform a complete twisted Edwards curve $ax^2+y^2 = 1+dx^2y^2$ with not square $d$ and square $a$ into an isomorphic Edwards curve $X^2+Y^2 = 1+DX^2Y^2$ with a square $-D$ i.e. $D = -r^2$?...
0
votes
0answers
36 views

Is it possible (and if so how) to make one proof for multiple private keys in ECDSA

Lets say I have a message that needs to be signed by two keys that were generated using ECDSA Is it possible to make a signature that accounts for both keys, meaning I can verify with both and see ...
2
votes
0answers
68 views

ElGamal with elliptic curves and semantic security

To encrypt a group element $P$ with public key $K$ and randomness $r$ using ElGamal on elliptic curves with base point $G$ we do the following $(c_1, c_2) = (r\cdot G; P+r\cdot K)$. When we want to ...
1
vote
1answer
87 views

Are there any public keys for which the private key can be easily derived (ECDSA)?

I know that generally it's infeasible to find the private for any given public key. But I also came across the question "Find ECDSA PrivKey to PubKey = 0", in which it was explained that the ...
0
votes
1answer
174 views

Can I know from a Bitcoin public key if the private key is odd or even?

Can I know just from a Bitcoin public key if the private key is odd or even? [moderator note] That is, can we find parity of the private key from a secp256k1 public key?For the original dump of ...
1
vote
0answers
20 views

running Project Wycheproof against crypto implementations in languages other than Java

So I guess https://github.com/google/wycheproof "tests crypto libraries against known attacks". It appears to mainly be intended for Java crypto providers but can it easily be adapted to be ...
3
votes
1answer
70 views

What is/was SEC#1 ECC public key leading octet 0x01 for?

In the SEC#1 elliptic curve cryptography standard, the encoding of the public key involve a leading octet: 00h: The public key is the point at infinity. 02h, 03h: The public key is the compressed ...
0
votes
0answers
39 views

Why does ECDSA produce a pair of values in its' signature (r,s)?

I was wondering why ecdsa generates a signature in form of a pair (r and s) and why it can't be only one value.
1
vote
2answers
932 views

What is the difference between "Elliptic Curve Function" and "Hash Functions" like SHA256?

I am reading about bitcoin and I am a little confused about "elliptic curve function" and "SHA256". Do they have the same properties? Can both be used to generate private and ...
1
vote
1answer
79 views

Multiuser encryption, singleuser decryption [duplicate]

I have an hybrid encryption (RSA, AES) for a file sharing project I am working on, where I use a single public key for encryption on the sender side and corresponding private key for decryption on the ...

1
2 3 4 5
36