The Stack Overflow podcast is back! Listen to an interview with our new CEO.

# Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

1,302 questions
Filter by
Sorted by
Tagged with
67 views

### Why we cannot brute force Elliptic Curve private key? [duplicate]

I am learning ECC, I am confused a bit how it works for now. To my understanding, G is the starting point, k is how many times you apply the dot operation. And <...
40 views

### ECDSA public key point uniqueness [duplicate]

I'm new to ECDSA and there is something I still not sure about. If I have a classic Certificate Authority server that delivers PEM certificates containing public key with ECDSA, I can retrieve the ...
46 views

### Efficient calculation of point coordinates with elliptic curves over binary field

I'm trying to find an efficient algorithm to calculate the $y$ coordinate of a an elliptic curve point given its $x$ coordinate, for elliptic curves over fields of the form $2^m$ with polynomial ...
1k views

### Elliptic curve cryptography related key attacks [closed]

This question is an extension of Families of public/private keys in elliptic curve cryptography As described above, bitcoin "type 2" deterministic wallets use a root private/public key pair, where ...
80 views

### Calculation of the order of the cosets used in defining the Tate Pairing

I'm working through Pairings for Beginners by Craig Costello, and am trying to understand the preamble to the Tate pairing. (See p. 70 ff., section 5.2 of of the PDF.). I'm having trouble following a ...
111 views

### How do pairings behave on G2/twist points off the prime order subgroup?

$\newcommand{\F}{\mathbb{F}}$ Consider the ate pairing defined on a curve $G_1 = E(\F_q)$ and $G_2 = E'(\F_{q^r})$ where $E'$ is a twist of $E$ with the twisting isomorphism defined over $\F_{q^r}$. ...
1k views

### Can you help me understand this toy example of ECDSA signing and verification? [closed]

I'm a complete newbie to ECC. but I was trying to get my feet wet with (what I thought would be) a TRIVIAL/EXTREMELY SIMPLE example of ECDSA signing and verification (that I could check by hand). I'd ...
54 views

### Why public key has two parts in my secure messaging client similar to signal

I am working on a Golang code similar to Signal protocol. I need to modify it. I am confused on tripartite Diffie-Hellman handshake part of code, i.e. why public key has two separate parts as compared ...
57 views

### Points on elliptic curve [closed]

I am making a program using the library cryptopp using curve secp521, in which at the end of that program I get n*Point Because I am writing that program I know that what is the value of 'n'. So, I ...
116 views

### Why do Edwards curves protect against side-channel attacks?

From Wikipedia: One of the attractive feature of the Edwards Addition law is that it is strongly unified i.e. it can also be used to double a point, simplifying protection against side-channel ...
61 views

### What is the possibility of collision of trailing 160 bits of Keccak_256, for any two differing public-keys as pre-images?

Earlier today I was answering a question on the ethereum SE site that analyzed the potential for more than one private key on curve secp256k1 (which maps to a distinct public key) to control the same ...
4k views

### Are all possible EC private keys valid?

I usually generate a key pair using OpenSSL or Bouncy Castle. I'm using curve secp256k1. The 256bit private keys look fairly random. Do all values of "private ...
628 views

### What does the special form of the base point of secp256k1 allow?

The popular ECC parameters secp256k1 are documented in SEC2 as using curve $y^2\equiv x^3+a\cdot x+b\pmod p$ with $a=0$, $b=7$, $p=2^{256}-2^{32}-\mathtt{3d1_h}$, base point $G$ with the apparently ...
71 views

Elliptic curves are usually defined over prime rings (fields), but what if we chose a ring of composite order? Let $n = pq$ for $p,q$ large primes. Say I have elliptic curve $y^2 = x^3 + ax + b$ over ...
80 views

### RSA vs Elliptic Curves

I am currently reading about how more efficient and ''light'' is ECC compairing to RSA as far as key generation is concerned. My question is simple, why does RSA continue to be used today (ex.SSL) ...
74 views

### Learning elliptic curve cryptography for specific application

I would like to develop a protocol for specific purpose. This protocol will utilize asymmetric cryptography in which one private key can be paired with numerous public keys: messages encrypted with ...
103 views

69 views

### “Dave Check” for a tweakable P-256 ECDH KDF

I have two devices with hardware tokens that contain P-256 private keys, and which allow me to compute ECDH shared secrets with arbitrary public keys. I need to build a tweakable key derivation ...
76 views

### Using public-key signature instead of having API key

I am designing an application that will need an API key. At first I believed that generating a long, random token would be secure enough (say 32 chars string that includes 0-9, a-z and A-Z), and then ...
375 views

### Is the curve25519 algorithm a special(implementation) one of ECDH?

It's the first time for me to learn about Key Exchange Protocol. And I thought that in both ECDH and DH there is a necessary step to share some public infomation(the common parameters) to each sides ...
75 views

### P256 Key size and validation [duplicate]

Given a public key on the P-256 Curve is it correct to say that the public key is 64 bytes long ie. (x,y)? Secondly is the private key 32 bytes long? if so, how is the private key generated and why ...
93 views

### Discrete logarithms on elliptic curves

In many examples of attacks on public key cryptography, examples of the form $a ^ x = b$ are used, but I can not understand the correlation between this and the multiplication of the generator point ...
248 views

### Why do elliptic curves require fewer bits for the same security level?

I'm studying the basics of cryptography and I didn't understand why elliptic curves use fewer bits. For example, finite-field Diffie-Hellman needs at least 1024 bit and it's a DLP, but elliptic ...
33 views

### Is there an O(1) in space complexity k-of-n signature scheme?

I was looking in depth into Schnorr signatures recently, and while they are very attractive for their ability to be aggregated, this only works for n-of-n ...
2k views

### After ECDH with Curve25519, is it pointless to use anything stronger than AES128?

Is the following reasoning correct: After ECDH with Curve25519, the resulting shared secret will be an EC public key with a bit strength of 128 bits. This public key would then be hashed (let's say ...
287 views

### Sextic twist of BN pairing parameters vs security

I've previously asked questions on BN pairing parameters. Here's one more. In the BN construction, one is working in a subgroup of a curve over an extension field $\mathbf{F}_{p^{12}}$ for some ...
83 views

### Is that possible to calculate modular inverse of a point on elliptic curves?

Imagine that you are given a point $P$ so that $P=a\times G$. If you have no knowledge of $a$ is that possible to calculate point $I$ so that $I$ is the modular inverse of $P$? We know that over ...
94 views

### Is there any asymmetric encryption algorithm for eliptic curve(secp256k1) without AES? [duplicate]

I am looking for asymmetric encryption using SECP256K1. But all over the internet, I see that it also requires AES encryption. Instead of generating an AES secret key, is it possible to encrypt using ...
669 views

### Is it safe to reuse a ECDSA nonce for two signatures if the public keys are different?

We denote the s value of an ECDSA signature $(r, s)$ on a message $m$ as: $s=\frac{H(m)+xr}{k}$ Assume two ECDSA signatures sharing the same nonce $(r, s_1) , (r, s_2)$ on two messages $m_1, m_2$, ...
116 views

### Talking TLS with EC cryptography and the secp256k1 curve [duplicate]

How reasonable would it be to speak TLS over the secp256k1 curve? My initial experiments show that OpenSSL supports it (albeit with special flags, see below): Running an OpenSSL client against an ...
36 views

### ECDSA dA multiplication algorithm [duplicate]

I was looking at this question and i can`t understand this part: QA = dA G = 5 (5,1) = (9,16) I saw that algorithm used for this was Double-and-add algorithm but i didn't get it. Can ...
563 views

### ECDSA: Why is SigningKey shorter than VerifyingKey

Total Crypto Noob here. I was wondering why in ECDSA the Signing Key is so much (half of) shorter than the Verifying key? Lets look at some python code: ...
53 views

### Elliptic Curve Cryptography messages vs keys encryption [duplicate]

I have read a few tutorials about ECC implementaiton in C. What I am confused is this: Can I encrypt messages with ECC and without the use of any other algorithm, like AES, RSA or should I use them ...
56 views

### ECDH for more than two parties

With classic diffie-hellman it's possible do it with more than two parties. Is this applicable to elliptic curve diffie hellman? I'm guessing not. With ECDH you have a scalar number as the private ...
1k views

### Pollard's kangaroo attack on Elliptic Curve Groups

Let's say I've intercepted some bits of a Diffie-Hellman private key: $x = n \mod r$. I can get the remaining bits by doing a kangaroo search. This algorithm works over $\mathbb{F}_p$. Can it be ...
59 views

### GPG implementation of ECC “Encryption” (ECDH) vs RSA

My understanding of GPG with traditional RSA keys, is that RSA is by definition can be used to both sign and encrypt. This is because RSA can be directly applied to plaintext in the following form: <...
50 views

### How to use Montgomery arithmetic for elliptic curves (FIAT cryptography)

Let us consider the source code for curve P-256 from BoringSSL. This source code can be found here. This source code uses the FIAT generated implementation for field arithmetic. This implementation ...
55 views

### CSR signature using elliptic curve [closed]

We've been asked to generate a certificate signing request using elliptic curve and we can't use any third-party library as it's an embedded application with very limited resources). We are used to ...
37 views

### Is ECC multiplication over real number also one-way? [duplicate]

ECC multiplication over GF(p) is clearly one-way. How about ECC over real number? Is ECC division over real number also practically impossible?
948 views

### Raw curve25519 public key points

I'm trying to understand curve25519, and ECC public points. I'm playing with Minisign, to better understand the fundamentals of ECC. Minisign uses curve25519 and outputs public keys as base64 ...
28 views

### ECDHE Key with KDF Necessary [duplicate]

Is it necessary to pass a ECDH generated key to a KDF? According to the python cryptography documentation, it is stated that For most applications the shared_key should be passed to a key ...
67 views

### Point doubling with only one coordinate

In many source codes that implement ECDH, there is a function that multiplies the base point of that curve with a constant. This function usually takes as arguments the constant and just one ...
287 views

### Difference between Pure EdDSA (ed25519) and HashEdDSA (ed25519ph)

My question refers to EdDSA as specified in RFC 8032. I get from the RFC that ed25519 and ed25519ph are two different instances of EdDSA mainly differing in the fact that that in the case of ...
212 views

### Representations of secret keys on Curve25519

https://tools.ietf.org/html/draft-josefsson-tls-curve25519-06#appendix-A.2 gives the following as a secret key / public key combo: ...
148 views

### ECDSA signing process

I am trying to learn how ECDSA works. I do not have a background in maths, but have been following a guide which has built me up from finite fields, elliptic curves. I am unable to figure out how a ...
67 views

### Secure Communication

Focus: I have to design a secure keep alive communication protocol and was wondering if it was necessary to sign the ciphertext after the session key has been generated as an attacker will not know ...
How does performing scalar multiplication on an elliptic curve compare to exponentiation in a multiplicative group modulo a prime? I.e. on a given elliptic curve of size $|t|$, what's the complexity ...