Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

Filter by
Sorted by
Tagged with
0
votes
0answers
11 views

Point-halving/solving quartic equations over the elliptic curve E(Z_N)/ring Z_N where N = pq

I am wondering whether there are any results/whether there is any knowledge about the following problem: Given a univariate polynomial (say, a quartic) equation defined over $\mathbb{Z}_N$, is it ...
4
votes
3answers
945 views

Why do people criticize and mistrust the e-voting based block chain?

I am planning to implement an e-voting system based on hyperledger fabric blockchain, however, I came across many criticisms from well-known security experts like Josh Benaloh and others. The problem ...
0
votes
0answers
28 views

Is it possible to “convert” to a curve

Assuming I have a 2 black boxes Box A: generates a private key and use it to sign whatever data I sent it (using secp256r1). It also returns the corresponding public key Box B: gets a public key, and ...
0
votes
2answers
110 views

Why is Curve25519 mostly used for key exchange?

When i studied the Applications where Curve25519 is used, i found out, that it is mostly used for the key exchange. Examples are the Signal Protocol and Threema. I know, that Curve25519 has a pretty ...
7
votes
3answers
4k views

Can curve25519 keys be used with ed25519 keys?

Can curve25519 keys be used with ed25519? I'd prefer to use ed25519, but there isn't a fast java version. For my application, I'd like to use curve25519 until I can get a faster ed25519 for java. ...
1
vote
1answer
70 views

Curve25519 key exchange in detail

So I'm trying to understand how the key exchange with Curve25519 works. I read the original Paper from Bernstein "Curve25519: new Diffie-Hellman speed records", but I still got some questions. First ...
0
votes
2answers
64 views

Why the output of elliptic curve based cryptosystems is smaller than the ordinary public key cryptosystems?

I am trying to understand how much the output of elliptic curve based cryptosystems (for example elliptic curve ElGamal) is smaller than the ordinary public key cryptosystems. I know that the ...
0
votes
1answer
64 views

Elliptic Curves - Proving that the group is not cyclic

I have a question from Stinson: 7.14. The question states: Suppose that $p > 3$ is an odd prime, and $a,b$ is an element of $\mathbb Z_p$. Further, suppose that the equation $x^3 + ax + b$ is ...
8
votes
2answers
2k views

Does secp256k1 have any known weaknesses?

I am wondering whether there are any properties of the curve which would technically make it easier to attack than any other curves of 256 bits in size. I have heard that being a Koblitz curve, it ...
8
votes
1answer
736 views

RFC6979: error in reference implementation?

If I correctly understand RFC 6979, there is an error in the ref implementation section 3.2. In the step H2, RFC specification says ...
1
vote
1answer
42 views

Difference between DER encoded signatures in JavaScript, Java, and C++

I'm trying to understand the DER-encoded signatures for the secp256k1 (ECDSA) curve better, so I have the following data array: 000102030405060708090a, which is a ...
1
vote
1answer
63 views

Symmetric versus asymmetric self encryption

I can encrypt my files with a symmetric encryption algorithm like AES, or with an asymmetric encryption algorithm like RSA or ECC (I encrypt my files with my own public key). No communication is ...
3
votes
1answer
77 views

is using secp256k1 curve for ECIES considered safe?

I read SafeCurves it indicates Secp256k1 is not SafeCurve by their standards but bitcoin and ETH use it in their blockchain. I researched more and figured out that using Secp256k1 ECDSA(singing ...
1
vote
1answer
468 views

How do I convert an elliptic key signature r and s value into a signature byte array?

I have an existing system that signs an arbitrary binary blob with an ECDSA key. The output of this is an r and s value. I now need to verify this signature on another system. On this other system ...
2
votes
1answer
142 views

Is this distributed random oracle scheme safe?

This question comes from an issue raised in another question: Non interactive threshold signature without bilinear pairing (is it possible)? Is the proposed random oracle model safe when trying to ...
6
votes
1answer
472 views

Can Pohlig-Hellman encryption be done over elliptic curves?

Following a bunch of questions on the topic of Pohlig-Hellman encryption. I was wondering if this could be trivially adapted to be done over elliptic curves just like we create EC-DH instead of DH. ...
3
votes
1answer
504 views

32-bit or 16-bits elliptic curves

I would like test vectors for 32-bit or 16-bits elliptic curves like $[p, a, b, G, n, h]$ , to test the Pohlig-Hellman algorithm in order to attack ECDLP over a finite prime field $F_p$. Does ...
6
votes
1answer
1k views

Key exchange using ECDH vs ECIES?

I'm a beginner to ECC crypto programming. Can anyone explain to me the difference between using ECDH for shared key exchange and the use of ECIES by encrypting a shared key with the public key of the ...
0
votes
0answers
79 views

Interactive ECDHE Authentication With Numeric Code

Trying to simplify my question, keeping only core concepts. Proposed solution: Both user devices generates ECDHE key pairs. Send pub keys to each other. Generate shared secret. Device that requests ...
0
votes
0answers
44 views

Elliptic curves over extensions of 64-bit fields

Are there any standard (or at least well-know) elliptic curves over $F_{p^4}$ where $p$ is a ~64-bit prime? I know Microsoft has FourQ curve which works over $F_{p^2}$ where $p$ is a 127-bit prime, ...
0
votes
0answers
53 views

Generate such an Elliptic Curve

I have a basic question. Is there a way to define an Elliptic Curve over (binary) Finite Field of order $q=2^m$ such that by taking the points from $(0, Y_0)$ and $(1, Y_1)$ then maps them to $(q - 1, ...
1
vote
0answers
31 views

What are the implications of limiting the private key space with elliptic curve Schnorr signatures?

Given a curve, I am trying to limit the private key space to ultimately cut down the Schnorr signature size as follows: Assume an elliptic curve $E$ over a field $F$ with generator point $G$ and the ...
2
votes
1answer
109 views

How to Sample from Frobenius Eigenspace?

So I was implementing the $2$-point method described here[1], which requires to samples two points $P_0, P_1$ in the Frobenius eigenspace initially. It uses a method called Elligator, which seems to ...
1
vote
1answer
77 views

Why is a prime number used in ECDSA?

So I need to write a piece for school about ECDSA and how it is secure. Now I thought I had a simple question, however, I can't seem to find an answer anywhere: Why does the p in the formula need to ...
7
votes
1answer
1k views

Elliptic curves for ECDSA

I'm trying to implement parameters generation for ECDSA according to SEC1 v2.0: ...
0
votes
1answer
47 views

Is it secure to use ECDSA for any arbitrary point on the Elliptic Curve as the Generator point?

My question concerns the elliptic curve $E$ over a prime field $\mathbb F_p$. To the best of my understanding, ECDSA requires a Generator point $G$ of prime order $n$, and the $r$ and $s$ values of ...
0
votes
1answer
73 views

Elliptic Curve - X Coordinate

I am currently working on a Koblitz curve. I have found the curve has two matching groups based on the base curve point and N-1 point. My question is as follows: Is there an algorithm to determine how ...
1
vote
0answers
43 views

Security of ECC over finite fields of characteristic $p\approx2^{50\pm10}$?

What's the security of Elliptic Curve Cryptography over finite fields of word-sized characteristic $p\approx2^{50\pm10}$? We are talking about $\Bbb F_q$ where $q=p^k$ for some suitable $k$. ...
1
vote
1answer
64 views

Ensure Data Integrity In An ECDH Key Excange

Been playing around with the inner workings of onion routing and I have a problem. If I wanted to send the 2nd node of a relay network an ephemeral ECC public key, it has to go through node 1, so that ...
3
votes
1answer
242 views

What happens if no final subtraction is done in Montgomery multiplication?

I'm doing Montgomery arithmetic modulo $N = 2^{255}-19$ for the Curve25519, picking $R = 2^{256}$ for Montgomery. After multiplying two numbers $0 \leq A,B < N$ in the Montgomery representation ...
4
votes
3answers
930 views

What is the point at infinity on secp256k1 and how to calculate it?

I hear that there should be a point at infinity on secp256k1. I wounder how to calculate it and what does it even mean. I tried to calculate it as $P_{inf}=P+(-P)$ but this gives different results for ...
2
votes
1answer
232 views

Secure multi-party computation for digital signature

Is there any practical algorithm that will allow to use public key cryptography (RSA or ECC) in the following way There are N parties. Up to M are malicious adversaries (were trusted, but got taken ...
1
vote
1answer
63 views

Is there an asymetric encryption whos output size is quite equal to the input size

I want to verify, that a chunk of data which has a size of around 16 bytes is sent by me, by simply encrypting it via a private rsa key, providing the public key in the source code for the ...
5
votes
1answer
120 views

Protecting Ed448 against DPA and fault attacks

There are some papers (1, 2) describing fault attacks in EdDSA. One suggested countermeasure is to add randomness to the input of the first hash call, which outputs a scalar. This paper describes a ...
3
votes
4answers
2k views

Could a 2nd EC private key be derived from a public key?

I understand that the public key does not expose the private key. That is not the question. The question is: Given a EC public key, can a different, but plausible and functional private key be ...
15
votes
1answer
1k views

How to generate own secure elliptic curves?

I know that the algorithm used to generate the Brainpool curves and the NIST curves is published. The algorithm should be this one (RFC5639 Appendix A). From what it looks like it's rather slow to ...
1
vote
3answers
993 views

If its possible to derive the public key from a private key, why can't we go in reverse?

I'm looking at source code for BitcoinJ that derives a public key from the private key. ...
2
votes
0answers
61 views

Probability of a prime number of points on an elliptic curve over a prime field

Suppose we have some elliptic curve defined over $\mathbb F_p$, with $p$ a large prime. Let $n$ be the number of points on the curve. I am interested in what is currently known about the probability* ...
1
vote
0answers
46 views

How to find Y on an elliptical curve in a finite field?

For example, let's use secp256k1, the curve used by bitcoin, y^2 = x^3 + 7, and x=12. Over the real numbers, that calculation is trivial - I can simply use a calculator. But in a finite field, how ...
1
vote
1answer
93 views

Complexity of computing zk-SNARK Proofs

Disclaimer: I have no background in cryptography, and everything I'm asking about is what I've learnt from last couple of days of frantic reading on this topic. Any help is much appreciated. Q: What ...
3
votes
1answer
129 views

How to secure Elliptic Curve ElGamal encryption against known plaintext attacks?

If I have an encoding function $f(x)$ that maps a message $m$ to a point $P$ on a suitable Elliptic Curve $E$ . If I have the public key $Q$ of my recepient then I can encrypt the message as follows: ...
0
votes
0answers
20 views

Does reusing the same $R$ in Elliptic Curve ElGamal breach its security? [duplicate]

In Elliptic Curve ElGamal if I reuse the same randomness to get the same point $R$ for different messages, how can it breach its security ? Can you please illustrate with an example? Please see my ...
6
votes
1answer
86 views

Does any $x < p$ satisfy the curve equation of X25519?

I've been reading about the famous X25519, a montgomery curve from wikipedia and in that article they say that we do not have to check for point validity. Is it because that any $x < p$ satisfy ...
4
votes
1answer
114 views

Is Ed25519 really constant-time as widely implemented?

Despite the frequent claims that Ed25519 is more secure against side-channel attacks than (for instance) signatures performed over NIST P-256, I noticed that most implementations (including the ...
4
votes
1answer
144 views

Hash multiset to point on elliptic curve where $A = 0$

I want to hash a multiset to a point on the elliptic curve $y^2 = x^3 + 3$ over a finite field of some 254-bit prime order, where $P = 3 \pmod 4$. Moreover, I want this hash to be incremental, in that ...
1
vote
0answers
57 views

Elliptic curve of order $p = 2q + 1$

Does anyone know an example of an Elliptic Curve of caracteristic $p$ ($E_p$) that has a point generator $G$ that generates a subgroup of order $q$, with $p$, $q$ being prime numbers and $p = 2q + 1$?
4
votes
1answer
82 views

What is the Bilinear-map accumulator disadvantage

Bilinear-map accumulator [1] is more efficient than the RSA accumulator [2] but do you know any disadvantage for the bilinear-map accumulator when compared to RSA accumulator?
2
votes
0answers
27 views

About the scalar multiplication on Koblitz curve in FIPS PUB 186-4 (2013)

In FIPS PUB 186-4, the computation of scalar multiplication on Koblitz curves is given in p.106~109. In p.109, step 11.3, $(r_0,r_1)$ is updated with $(r_1+\mu\,r_0/2,-r_0/2)$. But under ...
2
votes
1answer
46 views

Does there exist the method of projective coordinates for the computation of scalar multiplication for Koblitz curve?

Although the computation for scalar multiplications for Koblitz curve can be efficiently executed by TNAF method, but it still need to compute the multiplicative inverse for each point addition.
4
votes
2answers
189 views

Difficulty of Reversing Elliptic Curve

In ECC, it is apparently easy to verify the final point given the starting point and the number of hops. But it is difficult to compute the number of hops given just the starting point and the final ...

1
2 3 4 5
28