Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

Filter by
Sorted by
Tagged with
180 votes
4 answers
128k views

Why is elliptic curve cryptography not widely used, compared to RSA?

I recently ran across elliptic curve crypto-systems: An Introduction to the Theory of Elliptic Curves (Brown University) Elliptic Curve Cryptography (Wikipedia) Performance analysis of identity ...
Vineet Menon's user avatar
  • 2,015
162 votes
4 answers
54k views

Should we trust the NIST-recommended ECC parameters?

Recent articles in the media, based upon Snowden documents, have suggested that the NSA has actively tried to enable surveillance by embedding weaknesses in commercially-deployed technology -- ...
D.W.'s user avatar
  • 36.3k
63 votes
3 answers
29k views

Why Curve25519 for encryption but Ed25519 for signatures?

NaCl and libsodium libraries use Curve25519 for authenticated encryption (actually for sharing a key which is used for encryption) and Ed25519 for signatures. What is the purpose of using different ...
Simon's user avatar
  • 731
56 votes
2 answers
36k views

ECDSA vs ECIES vs ECDH

Recently I started studying Elliptic Curve Cryptography and I just loved it. I want to transfer some big data (like 3KB), What is the best method, ECDSA, ECIES, or ECDH (and why)? I am confused, how ...
user3160055's user avatar
55 votes
4 answers
55k views

Is secp256r1 more secure than secp256k1?

Curves secp256r1 and secp256k1 are both examples of two elliptic curves used in various asymmetric cryptography. Googling for these shows most of the top results are Bitcoin related. I've heard the ...
ripper234's user avatar
  • 1,027
52 votes
6 answers
18k views

Who uses Dual_EC_DRBG?

Recent news articles have suggested that the NSA may be involved in trying to influence the cryptography in public standards or commercially deployed software, to enable the NSA to decrypt the ...
D.W.'s user avatar
  • 36.3k
43 votes
4 answers
36k views

Basic explanation of Elliptic Curve Cryptography?

I have been studying Elliptic Curve Cryptography as part of a course based on the book Cryptography and Network Security. The text for provides an excellent theoretical definition of the algorithm but ...
user5507's user avatar
  • 1,913
42 votes
2 answers
27k views

How does recovering the public key from an ECDSA signature work?

It is possible to recover the public key from an ECDSA signature values $(r,s)$? Please explain how this works.
Jan Moritz's user avatar
39 votes
1 answer
31k views

Explaining weakness of Dual EC DRBG to wider audience?

I have an audience of senior (non-technical) executives and senior technical people who are taking the backdoor in Dual_EC_DRBG and considering it as a weakness of Elliptic curves in general. I can ...
DeepSpace101's user avatar
  • 1,697
39 votes
1 answer
17k views

ECDSA, EdDSA and ed25519 relationship / compatibility

I'm trying to understand the relationship between those three signature schemes (ECDSA, EdDSA, and ed25519) and mainly to what degree they are mutually compatible in the sense of key-pair derivation, ...
Rafael Korbas's user avatar
39 votes
1 answer
15k views

Why do the elliptic curves recommended by NIST use 521 bits rather than 512?

Wikipedia says in reference to the elliptic curves officially recommended by NIST in FIPS 186-3: Five prime fields for certain primes p of sizes 192, 224, 256, 384, and 521 bits. For each of the ...
Zack Elan's user avatar
  • 493
35 votes
4 answers
13k views

Can ECDSA signatures be safely made "deterministic"?

Using the terminology of the ECDSA Wikipedia page, ECDSA (and DSA) signatures require a random k value for each signature which ensures that the signature is different each time even if the message ...
ByteCoin's user avatar
  • 727
34 votes
4 answers
5k views

What is so special about elliptic curves?

There seems to be sources like this, this also, and some introductions that discuss elliptic curves in general and how they're used. But what I'd like to know is why these particular curves are so ...
stackuser's user avatar
  • 573
33 votes
3 answers
5k views

Why would anyone use an elliptic curve with a cofactor > 1?

In cryptography, an elliptic curve is a group based on a finite field $GF(p^k)$; this group has $n$ elements on it, and we work on a prime-sized subgroup of size $q$. We denote the value $h = n/q$ as ...
poncho's user avatar
  • 146k
32 votes
2 answers
19k views

ECDSA Compressed public key point back to uncompressed public key point

From the ECDH demo here, if I generate a private key for Alice I can get _ P = 1175846487558108474218546536054752289210804601041 Which gives the following public ...
Ian Purton's user avatar
31 votes
2 answers
4k views

When using Curve25519, why does the private key always have a fixed bit at 2^254?

When using Curve25519, the private key always seems to have a fixed bit set at position $2^{254}$. Why is that? Is there any good reason to use a fixed positioned most-significant-bit in the private ...
Trina's user avatar
  • 694
30 votes
2 answers
14k views

How to determine the order of an elliptic curve group from its parameters?

Let $\quad E:\; y^2 = x^3 + ax + b \quad$ be an elliptic curve defined over a finite field $\mathbb F_q$ where $q = p^n$, $a,b \in \mathbb F_q$ and $p \neq 2, 3$. By Hasse's theorem we know that the ...
user110219's user avatar
30 votes
2 answers
5k views

What does "birational equivalence" mean in a cryptographic context?

In a recent question on using the same curve for signing and ECDH it was noted for the Ed25519 curve and Curve25519: Nitpick: the curves are birationally equivalent, not isomorphic. Now this term ...
SEJPM's user avatar
  • 45.9k
30 votes
1 answer
20k views

How strong is the ECDSA algorithm?

Some cryptographic algorithms are as strong as the size of their key is, while other have some weaknesses that limit their strength (such as SHA-1). How strong is the ECDSA algorithm, and does that ...
ThePiachu's user avatar
  • 1,679
28 votes
3 answers
39k views

How can I use SSL/TLS with Perfect Forward Secrecy?

I'm new to the field of cryptography, but I want to make the web a better web by setting up the sites that I host with Perfect Forward Secrecy. I have a list of questions regarding the setup of ...
Clay Freeman's user avatar
27 votes
3 answers
26k views

Why is the P-521 elliptic curve not in Suite B if AES-256 is?

In the NSA's document, "The Case for Elliptic Curve Cryptography" (archived), we have ...
DeepSpace101's user avatar
  • 1,697
27 votes
2 answers
8k views

Using same keypair for Diffie-Hellman and signing

Are there any security risks using a single key-pair for both key-exchange and signing? I'm mainly interested in using Curve25519 for key-exchange and Ed25519 for signing. But similar combinations, ...
CodesInChaos's user avatar
  • 24.8k
26 votes
2 answers
10k views

How does the MOV attack work?

What exactly is the MOV attack, how does it actually work, and what is it used for? It's explained briefly here and I'd like to know what it is more / what is it fully used for.
Ben's user avatar
  • 699
26 votes
1 answer
25k views

ElGamal with elliptic curves

I've searched some information on ECC, but so far I have only found Diffie-Hellman key-exchange implementations using ECC, but I don't want to exchange keys, I want to encrypt & decrypt data like ...
CriticalError's user avatar
26 votes
1 answer
13k views

How does ECDH arrive on a shared secret?

I read a brilliant, three part article on Elliptic Curve cryptography (one, two, three). It was able to explain Elliptic Curves to me in a way that didn't require a math degree to understand. The ...
Eddie's user avatar
  • 983
25 votes
2 answers
7k views

Why is it not possible to increase the size of RSA keys indefinitely?

According to this primer on elliptic curves by Ars Technica, when composite numbers get "too" big, they become easier to factorize with Quadratic Sieve and General Number Field Sieve. While this is ...
fast-reflexes's user avatar
24 votes
3 answers
15k views

How effective is quantum computing against elliptic curve cryptography?

I've been reading the Wikipedia page on Elliptic-Curve Cryptography and I came across the following. in August 2015, the NSA announced that it plans to replace Suite B with a new cipher suite due ...
Fathima Abdur Rahman's user avatar
23 votes
2 answers
18k views

Which elliptic curves are quantum resistant? [closed]

If I want to learn about quantum resistant crytography what are the best resources? Which type of elliptic curves should I be studying?
Imagin Ation's user avatar
23 votes
4 answers
6k views

EC Schnorr signature: multiple standard?

I'm working on some EC-Schnorr signature code. Reading various papers on that, it seems EC-Schnorr is not standardized as well as ECDSA. For example, I found two main differences in two main actors ...
cslashm's user avatar
  • 413
22 votes
7 answers
10k views

Current mathematics theory used in cryptography/coding theory

What are the mainstream techniques borrowed from algebraic geometry (or some other branch of mathematics) which are currently used in cryptography/coding theory? I've only heard about a small subset ...
Vicfred's user avatar
  • 441
22 votes
2 answers
7k views

Is there a feasible method by which NIST ECC curves over prime fields could be intentionally rigged?

The NIST elliptic curves P-192, P-224, P-256, P-384, and P-521, prescribed in FIPS 186-4 appendix D.1.2, are generated according to a well defined process, but using an arbitrary random-looking seed ...
fgrieu's user avatar
  • 140k
22 votes
1 answer
13k views

How many qubits are required to break RSA 2048 or 4096 with a universal quantum computer?

So in the news this week, IBM have created a universal quantum computer with 5 fully functional qubits. Logic and Moore's law dictates they will be able to scale this up to a lot more qubits within a ...
ite's user avatar
  • 231
22 votes
3 answers
10k views

Why is Curve25519 in the GPG “expert” options?

The only way to access the Curve25519 curve in GPG is through gpg --expert --full-gen-key. From my knowledge, Curve25519 is one of the most secure (and fast) ...
Richard R. Matthews's user avatar
22 votes
1 answer
3k views

Mapping points between elliptic curves and the integers

My primary question is: Is there an easy way to create a bijective mapping from points on an elliptic curve E (over a finite field) to the integers (desirably to $\mathbb{Z}^*_q$ where $q$ is the ...
PulpSpy's user avatar
  • 8,597
21 votes
2 answers
23k views

How does Diffie–Hellman differ from elliptic curve Diffie–Hellman?

I didn't understand how ECDH actually works. Disclaimer: I know very little about elliptic curves. Here is how DH works: Alice and Bob agree on a prime number $P$ and a generator $G$. (They use one ...
user28432's user avatar
  • 211
21 votes
1 answer
9k views

Reasons for Chinese SM2 Digital Signature Algorithm

In the IETF RFC draft named "SM2 Digital Signature Algorithm" a signature algorithm is specified. The RFC does however not mention why this signature algorithm has been defined. Nor does it ...
Maarten Bodewes's user avatar
  • 92.4k
20 votes
1 answer
3k views

Does Curve25519 only provide 112 bit security?

In a recent mail on the IETF CFRG mailing list it was claimed that: The (currently missing) security considerations (or somewhere) should describe why Curve25519 is ok when used in contexts where ...
SEJPM's user avatar
  • 45.9k
20 votes
1 answer
5k views

Using a single Ed25519 key for encryption and signature

The libsodium documentation contains a function crypto_sign_ed25519_pk_to_curve25519 that converts an Ed25519 key into a Curve25519 one, so it can be used for both ...
user avatar
19 votes
3 answers
2k views

Can deterministic ECDSA be protected against fault attacks?

In a paper by Barenghi and Pelosi, it was described that fault attacks could be used to derive the secret key when using deterministic ECDSA as described in RFC6979 by @Thomas_Pornin Deterministic (...
Yustack's user avatar
  • 361
19 votes
2 answers
12k views

Difference between X25519 vs. Ed25519

I am reading https://en.wikipedia.org/wiki/Curve25519 and it states Also in 2018, RFC 8446 was published as the new Transport Layer Security v1.3 standard. It requires mandatory support for X25519, ...
ams's user avatar
  • 631
19 votes
1 answer
2k views

Why are elliptic curve variants of RSA "chiefly of academic interest"?

Yesterday I was thinking about elliptic curve variants of popular protocols/algorithms (ECDH, ECES[1], etc) and the thought occured that I had never seen an elliptic curve variant of RSA. My ...
mikeazo's user avatar
  • 38.5k
19 votes
1 answer
4k views

What is the relationship between p (prime), n (order) and h (cofactor) of an elliptic curve?

I am reading up on ECC and having trouble understanding how these are related. In a finite field, all point operations are taken modulo $p$. $n$ is the order of the generator $G$ — which apparently ...
SFlow's user avatar
  • 465
19 votes
1 answer
2k views

Compressing EC private keys

For reasonable security, EC private keys are typically 256-bits. Shorter EC private keys are not sufficiently secure. However, shorter symmetric keys (128-bits, for example) are comparably secure. I ...
David Schwartz's user avatar
18 votes
5 answers
6k views

Is there a situation where RSA cannot be replaced with ECC + symmetric algorithms? If no, why do we still use it?

RSA is both an asymmetric encryption algorithm and a digital signature algorithm. However, in recent years, many cryptographic protocols (TLS, for example) have moved away from the use of RSA to ...
Luke Park's user avatar
  • 562
18 votes
1 answer
26k views

Is there any difference between NIST and SECP curves in-terms of their algorithms and implementation?

I'm implementing ECDSA for NIST P-256 curve. I just want to know if the same implementation will also work for SECP curves? If it doesn't, can you point me to one or more references of algorithms for ...
abejoe's user avatar
  • 605
18 votes
1 answer
17k views

How does encryption work in elliptic curve cryptography?

So I think I understand a good amount of the theory behind elliptic curve cryptography, however I am slightly unclear on how exactly a message in encrypted and then how is it decrypted. So my ...
Ali's user avatar
  • 471
18 votes
3 answers
7k views

How does ECC go from decimals to integers?

I realise that elliptical curves are tricky, but there's one aspect that no one seems to explain. I've looked, and it's towards the beginning. This is the traverse over a red curve:- This is only ...
Paul Uszak's user avatar
  • 15.3k
18 votes
1 answer
4k views

After ECDH with Curve25519, is it pointless to use anything stronger than AES-128?

Is the following reasoning correct: After ECDH with Curve25519, the resulting shared secret will be an EC public key with a bit strength of 128 bits. This public key would then be hashed (let's say ...
knaccc's user avatar
  • 4,732
18 votes
2 answers
4k views

Schnorr signatures: multisignature support

Schnorr signature is mentioned as a promising upgrade to bitcoin to improve scalability. It support multisignature, several signatures can be aggregated into a single, new signature. But I fail to ...
Consy's user avatar
  • 367
18 votes
1 answer
4k views

How to calculate elliptic curve parameters?

I'm having a rough time understanding the math behind elliptic curves. I want to implement ECDH where user can define a, b, and p parameters of elliptic curve. How can I calculate generator base ...
marlenn's user avatar
  • 181

1
2 3 4 5
44