Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

Filter by
Sorted by
Tagged with
2
votes
0answers
22 views

Using (EC)DH to generate a signature

Say I have access to a system that is limited to performing (EC)DH, followed by key derivation to produce a secret key. This secret key can e.g. be used to generate a MAC. Is it possible to generate a ...
0
votes
0answers
5 views

Have someone replaced Curve25519 in NaCL library? [migrated]

I am using NaCL library and I like it but I wonder if it is possible to replace Curve25519 with different stronger Curve if stronger encryption is needed. I do understand that new library would be ...
3
votes
1answer
312 views

Ed25519 key generation

the following rfc describes the key-pair generation mechanism for Ed25519; the first two steps are as follows: Hash the 32-byte private key using SHA-512, storing the digest in a 64-octet ...
37
votes
1answer
29k views

Explaining weakness of Dual EC DRBG to wider audience?

I have an audience of senior (non-technical) executives and senior technical people who are taking the backdoor in Dual_EC_DRBG and considering it as a weakness of Elliptic curves in general. I can ...
6
votes
1answer
281 views

What exactly could be accomplished with a backdoor in Dual_EC_DRBG?

Assume that some entity really holds the private key corresponding to the recommended/dubious constants of Dual_EC_DRBG. According to this presentation, they would be able to reconstruct the internal ...
48
votes
5answers
16k views

Who uses Dual_EC_DRBG?

Recent news articles have suggested that the NSA may be involved in trying to influence the cryptography in public standards or commercially deployed software, to enable the NSA to decrypt the ...
4
votes
2answers
275 views

In Elliptic Curve, what does the point at infinity look like?

We know that for each point $P$ in curve $E$ there exists a minimum scalar $k$ such that $k*P$ equals the point at infinity. And the book Cryptography Theory and Practice by Douglas R. Stinson only ...
0
votes
1answer
42 views

How to represent the point-at-infinity(Elliptic Curves) in code? [duplicate]

I am writing code for Elliptic Curve Cryptography. I have a class class EllipticCurvePoint. ...
11
votes
1answer
2k views

Difference between “ECDH with cofactor key” and “ECDH without cofactor key”?

I need to use “ECDH with a cofactor key” for generating symmetric key. I have a fair idea on how ECDH works, but I don’t understand the cofactor part. What is the difference between ”ECDH with a co-...
4
votes
1answer
127 views

Hash multiset to point on elliptic curve where $A = 0$

I want to hash a multiset to a point on the elliptic curve $y^2 = x^3 + 3$ over a finite field of some 254-bit prime order, where $P = 3 \pmod 4$. Moreover, I want this hash to be incremental, in that ...
-3
votes
0answers
42 views

How to convert hex public key to RSA format [closed]

I have the following hex uncompressed pub key which I have been experimenting with, I know its in ECC format, my aim is to convert to an RSA-like key. preferably in 1028 bit size, any help on how to ...
0
votes
0answers
33 views

How to implement EC public key encryption [closed]

I've been studying asymmetric algorithm and trying to encrypt an EC public key, to work just like RSA. found out possible schemes with ElGamal or IES, but the implementation methods I found are not ...
-1
votes
0answers
46 views

Does knowing that the exponent has a certain form help solving elliptic curve? [closed]

Given a elliptic curve with a cyclic subgroup of order $P$ and a generator $g$. $g,P,\varphi(P)$ is known by the attacker. Two group values $n$ and $m$ are given. So there exists an exponent $i$ ...
5
votes
1answer
439 views

Does the backdoor in Dual_EC_DRBG work like that?

From what I read, the backdoor in Dual_EC_DRBG operates by using related $P$ and $Q$ points. Did I understand the idea correctly? Dual_EC_DRBG works by multiplying the $P$ point with the seed ...
2
votes
0answers
37 views

What are some use cases for white-box digital signatures?

There were 2 papers published in the last year, that describe 2 different white-box identity-based digital signature schemes: White-Box Implementation of the Identity-Based Signature Scheme in the ...
2
votes
1answer
67 views

Is it possible to derive the recipient's public key from libsodium's crypto_box?

Libsodium has "crypto_box_seal" which according to the documentation is used to "anonymously send messages to a recipient given its public key.", which hides the sender. But Is it possible for Eve to ...
6
votes
1answer
2k views

Can SRP be used with Elliptic Curves?

I'm sure it can, because SRP (secure remote protocol) can be implemented everywhere where Diffie-Hellman works, but I need a proof to put this aspect into Wikipedia. Edit: ok, can it be at least ...
0
votes
2answers
71 views

Diffie-Hellman Primitives in SP800-56A

I wonder if someone can give an explain about the different between two Diffie-Hellman Primitives defined in SP800-56A, CH5.7.1 5.7.1.1 Finite Field Cryptography Diffie-Hellman (FFC DH) Primitive 5.7....
0
votes
3answers
696 views

addition on finite elliptic curves

I tried to calculate the sum of two Points on an elliptic curve in a finite field. The Curve is defined as following: $$y^2 \equiv x^3 + x \mod 257$$ So the curve parameters are $a = 1,b = 0,p = 257$...
0
votes
2answers
449 views

Given an elliptic curve, how do I calculate the order of the points manually, when we don't know about the curve's points?

So basically all I can do is use Lagrange's Theorem and figure which factors of the group order are in line, then start trying each of these using the Double-and-Add-Algorithm until I get $\mathcal{...
2
votes
3answers
2k views

Scalar Multiplication on Elliptic Curves

In the elliptic curve: $y^2 = x^3 + 20x + 13 \bmod{2111}$. Using the point $P=(3, 10)$ I am wondering how to multiply this point by the scalar $57$? I realize I can write $57*P$ as $2^5*P + 2^4*P + ...
0
votes
2answers
222 views

Problem on Elliptic Curve Point Doubling

Given an elliptical curve e.g. from “Understanding Cryptography” by Parr & Pelzl §9.2 Example 9.5: $y^2 = x^3 + 2x + 2~~~~ mod~17$ And given a primitive $P = (5, 1)$, the book indicates: We ...
146
votes
4answers
45k views

Should we trust the NIST-recommended ECC parameters?

Recent articles in the media, based upon Snowden documents, have suggested that the NSA has actively tried to enable surveillance by embedding weaknesses in commercially-deployed technology -- ...
2
votes
1answer
247 views

An efficient SPEKE protocol with curve25519

SPEKE is a very simple and elegant PAKE protocol. I think one of the reasons why PACE was invented and is now the ICAO protocol is that SPEKE was patented. Fortunately, the SPEKE patent expired in ...
4
votes
2answers
636 views

How can I find the generator of a composite group and $Z_p*$?

I was doing some research on elliptic curves. I know how to find the generator of $Z_p$ (this is a prime group). But I came across the term $Z_p*$ (group containing elements that relatively prime to $...
0
votes
0answers
5 views

Get X.509 Certificate ECDH private and public key on Android (Java/Kotlin) [migrated]

I'm currently trying to implement a ECDH algorithm in my android app. But I'm facing an issue, I would like to store the private and public key in Android KeyStore. However in order to achieve this I ...
0
votes
0answers
58 views

Is it possible to distinguish ECC private key from the random values

I have a list of the random values (each 65 bytes long). One of the items is a private key which is used to sign the data: ...
1
vote
1answer
39 views

Ensure Data Integrity In An ECDH Key Excange

Been playing around with the inner workings of onion routing and I have a problem. If I wanted to send the 2nd node of a relay network an ephemeral ECC public key, it has to go through node 1, so that ...
5
votes
1answer
409 views

Can multiple public keys lead to the same shared secret in X25519?

I have no mathematical knowledge about this, but I just read in RFC 7748 the following: Designers using these curves should be aware that for each public key, there are several publicly ...
1
vote
1answer
31 views

Cost model for different curve models

Is there a cost model for each curve model and their conversions? For example: Take the curve models: Projective, Completed, Extended, Affine. Is there a table which shows how many multiplications, ...
6
votes
2answers
3k views

Complete Set of Test-Vectors for ECDSA secp256k1

Although there are several implementations of ECDSA secp256k1 public available over the internet (the most popular being OpenSSL), it seems that there are no complete set of test-vectors available. ...
0
votes
1answer
579 views

Is there any place where I can find test vectors for point addition and doubling of ECC?

I want to extensively test my implementation of point addition and doubling. I have only one test vector with me. I need more values to test. In the web, I could find test vectors only for key pair ...
14
votes
2answers
2k views

Schnorr signatures: multisignature support

Schnorr signature is mentioned as a promising upgrade to bitcoin to improve scalability. It support multisignature, several signatures can be aggregated into a single, new signature. But I fail to ...
8
votes
2answers
3k views

Ed25519 is a signature or just elliptic curve

Ed25519 is a signature or just elliptic curve? EDDSA is signature, what using curve ed25519?
0
votes
0answers
36 views

EC threshold private key's multiplicative inverse and derived-key sharing

I have two devices, and each has a private key xPriv-i. Each device computes the corresponding EC public key xPub-i, shares it, and the linear combination of the keys is the "real" public key xPub. ...
7
votes
4answers
1k views

Elliptic curve parameters

What's the meaning of "160-bit curve" in an elliptic curve? Or 192, 224, 256, etc. And what is the standard for selecting this number of bits? Why they don't say "100-bit curve"?
3
votes
0answers
87 views

ECDSA signature verification checks

From Wikipedia: Check that $Q_a$ is not equal to the identity element $O$, and its coordinates are otherwise valid. Check that $Q_a$ lies on the curve. Check that $n*Q_a = O$ Verify that $r$ and $s$ ...
0
votes
0answers
43 views

Difference in elliptic curve order and finite field size [duplicate]

Must the prime finite field, Fp, an elliptic curve is defined over always have a greater number of elements than the cardinality of an elliptic curve. For example, If I have ...
3
votes
1answer
156 views

ECIES/ ECDHE/ EC-ElGamal encryption comparison

I need to choose an encryption system, so I am trying to understand the differences between the existing options. I always find that people compare ECIES (Elliptic Curve Integrated Encryption Scheme) ...
3
votes
2answers
3k views

ECC keys vulnerable to brute force attack?

I have started learning about Elliptic Curve Cryptography (ECC). Since the key size required in ECC is relatively smaller than the key size in RSA (to provide the same encryption strength), I wonder ...
2
votes
3answers
191 views

Is RSA in decline across the board?

From what I gather from the internet (source), the recommended practice for 2019 and beyond is to avoid RSA and use ECDH and ECDSA. Is this the general case?
7
votes
1answer
3k views

How does ECDHE_RSA key exchange mechanism work?

Using Wireshark, I found these data exchanged with google.com over TLS: Client Hello possible cipher suites and possible curve types (eg. secp256r1) sent Server Hello cipher suite selected ...
4
votes
2answers
9k views

Why is there the option to use NIST P-256 in gnupg?

I am surely not an expert on the field , but I heared some people say that NIST P-256 is somehow backdoored . I don't know about the seriousness of this claim . Maybes it is just some conspiracry ...
1
vote
2answers
64 views

How does ECDSA signature verify work in EOS and ETH/BTC, compare to standard (on text book I mean)

I have been studing ECDSA signature/verify for a while. By my understanding: the standard ECDSA signature/verify process (which we find on text book) are like below: - A sender combines message and ...
1
vote
0answers
43 views

How to know if a point on a discrete elliptic curve be represented uniquely using its y-coordinate?

Let's say we have a point on an elliptic curve $p=(x, y)$ which is not the point-at-infinity. Can there be some other point $\hat{p} = (\hat{x}, y)$ that is also on the curve and that has the same y-...
0
votes
1answer
80 views

Group in the context of elliptic curve crypto [duplicate]

I understand that the discrete log problem is defined as $G^y \bmod p = x$ Speaking generally, $G$ here is a generator for the group zp*, where $G$ is able to ...
1
vote
1answer
40 views

Prevent a Man-In-The-Middle attack whilst transmitting a PSK for first time

I'm developing a network where two parties that want to join both compute ephemeral ECC keys for a key exchange, to create an encrypted connection. I plan to authenticate these keys by signing them ...
0
votes
0answers
30 views

ECC order and modulus in EC [duplicate]

This question came from security.stackexchange.com. I have an error in reasoning regarding to the calculations on elliptic curves. The basic group operations are all calculated mod p. Ok right. Then ...
0
votes
1answer
35 views

Computing inverse of BN256 G2 point in golang x/crypto/bn256 library

I'm trying to confirm a vulnerability in a signing scheme I'm helping with. To do this I need to simulate a rogue key attack on a BLS aggregate signature using the golang bn256 library https://godoc....
0
votes
1answer
45 views

ECDSA secp256k1 attacks

Are there any known and feasible ECDSA attacks on secp256k1 which can reduce the bit security of the algorithm? For example from 256 bits of security down to 192 bits?