Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

Filter by
Sorted by
Tagged with
2
votes
1answer
63 views

Finding subgroup in elliptic curve over finite field $ \mathbb{F}_{11}$

For elliptic curve $ y^2 = x^3 +3x+7$ I found the finite group $ E(\mathbb{F}_{11})= \left\{ \mathcal{O}, (1,0),(5,2),(5,9),(8,2),(8,9),(9,2),(9,9),(10,5),(10,6) \right\}$. I have to find a ...
1
vote
0answers
48 views

Elliptic Curve (Point Counting)

I am studying elliptic curves in particular point counting. If I have coordinates P and 2P, is there a way to calculate the total points in between P and 2P using either curve parameters or algorithm? ...
0
votes
0answers
27 views

Pair-friendly elliptic curves vs non friendly

Group law operations on pair-friendly elliptic curves are slower than in non friendly elliptic curves, but how much slower? Can't seem to find a performance comparison between the two for a given ...
1
vote
1answer
132 views

Authentication protocol for communication with Arduino Uno

I am using an ECDH key exchange to establish a shared secret between an Arduino Uno and an Android device. For this purpose I am using this library and more specifically Curve25519. This is the ...
0
votes
0answers
37 views

Generalized Schnorr's signature variations

I'm working on an ECC-based system. There's a Schnorr's signature, by which the prover may prove a knowledge of a preimage (i.e. scalar, private key) of an EC point (i.e. public key). It can be ...
1
vote
1answer
51 views

Does ECC's cofactor affects ECC's private key selection?

I am doing a project using ECDH with Curve25519. I use mbedtls library, in the implement, I realize that the private key of Curve25519 is clear 3 last bit, or it is divide by 8 and the cofactor of ...
3
votes
2answers
566 views

Brute forcing an elliptic curve encrypted key

I've been reading about ECC, and what I've established so far (correct me if I'm wrong) is that: pubKey = privKey * G where G is some special point on the secp256k1 curve. Doesn't this mean we ...
1
vote
1answer
83 views

Elliptic Curve vs RSA key length comparison

I'm new to ECC. From this website (GlobalSign Elliptic Curve Cryptography) a 256 elliptic curve key pair provides as much security as a 3072 bit RSA key pair. My question is: how do experts come to ...
4
votes
1answer
151 views

Is double encryption really a bad idea? Are meet-in-the-middle attacks practical at all?

Meet-in-the-middle attacks are used to justify that attacks on ECC and double encryption will have complexity of $O(\sqrt{n})$ for ECC and $O(2^{n+1})$ for double encryption complexity instead of $O(n)...
2
votes
1answer
338 views

ECDSA where the group order is larger than the hash size?

According to wikipedia, when generating a signature for ECDSA, you do the following (among other things): Calculate $e=\operatorname{HASH}(m)$, where $\operatorname{HASH}$ is a cryptographic ...
1
vote
0answers
57 views

is forward secrecy irrelevant for non-streaming applications?

I asked a question yesterday about the Keybase key model and got no answers, unfortunately. Let me rephrase the question to make it clearer: in the case, if 2 users just want to send each other low-...
2
votes
1answer
642 views

Using Montgomery ladder to calculate the coordinates

In one of my assignments I need to solve the problem below: For a Montgomery curve $3y^2 = x^3+x^2+x$ over ${\mathbb{F}}_{11}$ and point $P = (9,8)$, compute the $x$ coordinate of $3P$ using the ...
1
vote
0answers
44 views

Trying to understand Keybase's key model and replacing PGP with device keys

I am exploring Keybase and I thought it was merely a wrapper for gpg and connecting its public key with social accounts (e.g. github, twitter, etc...). But after reading the very short and unclear ...
-2
votes
1answer
65 views

ECDSA multiplication vs exponentiation

In Elliptic Curve Digital Signature Algorithm (ECDSA) I often see 2 different written equations of it: Elliptic curve point multiplication by a scalar, $Q_{A}=d_{A}\times G$, source Modular ...
0
votes
0answers
38 views

Where can I find standardized implementations of lightweight cryptographic ciphers?

I am working on a project that requires encrypting messages with different ciphers. I am looking for the following ciphers: PRESENT, CLEFIA, LEA, Hill cipher, Affine cipher, Elliptic Curve ...
1
vote
0answers
49 views

Verifying the ownership of curve25519 public keys

Let's say we have a group of users, authenticated by a server that providers the service, communicating on a secure channel (e.g. over HTTPS/TLS) and each user has a corresponding curve25519 key pair. ...
0
votes
1answer
48 views

Understanding simplification steps when solving complicated equations in Galois Field

I just encountered a problem when I tried to understand a basepoint conversion from x25519 to ed25519. I can't really wrap my head around how the value of $x$ can be the stated value below? Can ...
6
votes
2answers
454 views

How to create an EC point from a plaintext message for encryption

It seems that ElGamal encryption is also possible for Elliptic Curve cryptography. However, that requires the user to convert the message to a point on the curve. What strategies are there to derive a ...
2
votes
1answer
192 views

Public Key generation for Ed25519 vs X25519

It is my understanding that EdDSA uses a slight variant of Curve25519 (typically used for ECDH), called Ed25519. Given the same private key, are the differences between the two algorithms enough to ...
3
votes
2answers
80 views

Size of $E$ over $\mathbb{F}_p$ contains $p+1$ points

I am struggling to prove this claim: I proved that the map $x\mapsto x^3+1$ is a bijection from $\mathbb{F}_p$ to itself if we have that $p\equiv 2\bmod{3}$. We have to use this fact to prove that ...
3
votes
3answers
220 views

Is RSA in decline across the board?

From what I gather from the internet (source), the recommended practice for 2019 and beyond is to avoid RSA and use ECDH and ECDSA. Is this the general case?
2
votes
2answers
236 views

Operation on elliptic curves

Let $Y = xG$ be a point on an elliptic curve, $G$ the generator point and $x$ a scalar. Without knowing $x$, is it possible to calculate $x^nG$, being $n$ a natural number?
0
votes
0answers
27 views

Compute shared public keys

I want to compute, in a distributed way, the following shared public keys on an elliptic curve: $(xG, x^2G,...,x^nG)$, being $x$ a secret scalar that no single party knows, $G$ the public ...
1
vote
2answers
65 views

Understanding Montgomery's parameterization of elliptic curves

I'm having a bit of trouble understanding the translation of affine coordinates to projective coordinates in Montgomery curve ECM. Would be very thankful if someone could explain it by expanding the ...
25
votes
3answers
7k views

Can ECDSA signatures be safely made “deterministic”?

Using the terminology of the ECDSA Wikipedia page, ECDSA (and DSA) signatures require a random k value for each signature which ensures that the signature is different each time even if the message ...
0
votes
1answer
79 views

Can we retrieve his private key using his public key in ECC?

A paper wallet is the name given to an obsolete and unsafe method of storing bitcoin which was popular between 2011 and 2016. It works by having a single private key and bitcoin address, being printed ...
4
votes
0answers
72 views

Regarding the need to hash the shared secret in X25519 with the public keys

I was looking at the LibSodium documentation where it says [...] and to mitigate subtle attacks due to the fact many $(p, n)$ [public key - secret scalar] pairs produce the same result, using the ...
0
votes
1answer
544 views

“Probability” of an ECDSA signature

The article Elliptic Curve Digital Signature Algorithm in Bitcoin's wiki talks about signatures having probabilities (as in ...
1
vote
0answers
45 views

Need help understanding SPAKE2 setup values

I am trying to write a simulation of the SPAKE2 protocol in python (just so I can get a better understanding of the protocol altogether). I am reading through the ietf draft here: Datatracker. There'...
12
votes
3answers
909 views

What does the special form of the base point of secp256k1 allow?

The popular ECC parameters secp256k1 are documented in SEC2 as using curve $y^2\equiv x^3+a\cdot x+b\pmod p$ with $a=0$, $b=7$, $p=2^{256}-2^{32}-\mathtt{3d1_h}$, base point $G$ with the apparently ...
0
votes
1answer
82 views

Key clamping in curve25519 not evident in generated key's binary representation

I understand with curve25519 that the private key for secret.box is clamped... I understand that this clamping process to clear ...
0
votes
1answer
65 views

Is this the right way to implement ElGamal scheme over Elliptic Curves over prime field? [duplicate]

I'm fairly new to Cryptography, especially elliptic curves in general. I learned to do Point Multiplication, Scalar Multiplication and also programmatically implemented them. But I was trying to do ...
3
votes
1answer
607 views

ECDH security when no KDF is used

Let's suppose our device performs ECDH with a fixed, unknown, private key $\text{prv}$. It accepts as input any point $Q$ lying in the proper subgroup of the proper elliptic curve, then computes: $P =...
2
votes
2answers
2k views

Security of elliptic curves

How can we say an elliptic curve is secure and can be used for cryptographic applications?
0
votes
1answer
88 views

Order of subgroups formed by Elliptic Curves with a Cofactor

In this question: Why are the lower 3 bits of curve25519/ed25519 secret keys cleared during creation? The answer indicates that the order of all points on the curve over the finite field ...
22
votes
2answers
3k views

When using Curve25519, why does the private key always have a fixed bit at 2^254?

When using Curve25519, the private key always seems to have a fixed bit set at position $2^{254}$. Why is that? Is there any good reason to use a fixed positioned most-significant-bit in the private ...
0
votes
1answer
90 views

Choice of finite fields for use in elliptic curves

this is maybe a basic question but I'm trying to better understand elliptic curve cryptography at a fundamental level. I understand that a finite field is required in order to define a boundary for ...
0
votes
1answer
75 views

Does the nonce really have to be hashed as part of the challenge in a Schnorr signature?

From this article: https://tlu.tarilabs.com/cryptography/digital_signatures/introduction_schnorr_signatures.html#why-do-we-need-the-nonce The article states that the challenge ...
1
vote
1answer
122 views

Why does curve25519 use a cofactor of 8?

This cofactor (as I understand it) effectively discards valid points that satisfy the curve equation over the finite field. Why would one wish to reduce the number of possible private keys, it seems ...
0
votes
2answers
92 views

Elliptic curve commitments mod p

As far as I understand secp256k1 is defined over the group p with p = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F I don't really ...
3
votes
1answer
201 views

Schnorr NIZK over Ed25519

I am trying to implement the following Schnorr non-interactive zero-knowledge protocol: https://tools.ietf.org/html/rfc8235#page-7 I'm using the libsodium 1.0.16 and GNU MP libraries. I just can't ...
0
votes
0answers
40 views

Signing with ECDSA [duplicate]

I am new to ECC. I was reading this post https://andrea.corbellini.name/2015/05/30/elliptic-curve-cryptography-ecdh-and-ecdsa/ I want to know if there is any intuition behind the following formula: $...
0
votes
2answers
146 views

The use of Elliptic Curves as part of a blockchain transaction

As I understand it, Elliptic-Curve Cryptography is used in the verification step of a transaction (i.e. when creating a digital signature), but not in the creation and security of a 'block' (when ...
1
vote
1answer
2k views

What is the recommended minimum key length for ECDSA signature

I want to identify the proportion of certificates that use unrecommend ECDSA key length for TLS certificates based on some data I collected. By looking at a standard like NIST for example, I find ...
1
vote
0answers
43 views

short signature for EC

i'm building a low-power wireless sensor network in which each slave node has a public/private ECC key pair -- generated by the node itself during manufacturing.... the slave node is also provisioned ...
1
vote
2answers
110 views

How does this formula work $(aG + bG) = (a + b) G$ in ECDSA?

Please explain how does this formula $(aG + bG) = (a + b) G$ work in ECDSA? According to the source: $a$ and $b$ are different private keys Suppose $a = 3$ $b = 4$ then the public key is $Q = aG$...
0
votes
1answer
35 views

Is it possible to execute elliptic curve encryption on small sensor-tags CC2650?

I am working on a project wherein ECC needs to be implemented on small devices, namely, CC2650 sensor-tags for authentication. The ECC implementation should be on Contiki OS. I have read some articles ...
0
votes
1answer
244 views

Is there a feasible way to generate an RSA key manually the same way as it is for an ECC one?

In elliptic curves, a private key is just a random number, and one relatively small compared to other crypto systems (256 bits for ECC vs 4096 bits for RSA for example). Suppose I don't trust ...
0
votes
1answer
140 views

No way to do ECDH with OpenSSL from the command line?

I've scoured this website and the OpenSSL wiki pages, and done numerous internet searches, and I've come to the seemingly incredible conclusion that one cannot generate an ECDH shared secret key using ...
1
vote
1answer
55 views

Elliptic curve one time signatures

This is kind of an academic question, but I wonder if it's possible to build an intentionally one-time signature scheme with elliptic curves? I assume you could do it by supplying ECDSA with ...

1 2 3 4 5 28