Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

Filter by
Sorted by
Tagged with
4
votes
3answers
83 views

Is it secure to compute the exponentiation and the LWE operation?

Suppose Alice and Bob have specified an elliptic curve, for example, secp256k1. Alice has a secret number $s$ (can be seen as secret key), Bob choose a point $g$ on the curve and send it to Alice. ...
1
vote
1answer
191 views

Homomorphic mapping between elliptic curve point and Zq

I'm trying to figure out how to do a mapping between elliptic curve points and Zq without breaking homomorphic properties. Sorry, I'll write the problem in multiplicative notation because it's easier. ...
1
vote
1answer
56 views

Is prime order group used in ECDSA unique?

In ECDSA, we use a prime order group $\langle G\rangle$ for cryptographical use. Assume $\#\langle G\rangle = p$. Is there another subgroup in the curve used for ECDSA whose order is also $p$?
0
votes
2answers
75 views

Wrong key length for EC public key

I have a problem with EC public key reading from smartcard using pkcs11 library. With the secp256r1 EC algorithm, I always get 65 or 67-byte length public key with different smartcards. But with the ...
2
votes
3answers
70 views

Can schnorr-signatures be used to ensure public keys are of the correct form (namely $Y= x \cdot G$)?

Assume a Schnorr-signature scheme in an elliptic curve setting with a publicly known generator base point $G$ where the the discrete logarithm is hard. That is, given $x \cdot G$, it is hard to find $...
0
votes
0answers
28 views

elliptic curve scalar addition

say there is an homomorphic cryptosystem on elliptic which allows unlimited addition and only one multiplication. So in order to same the mult operation for a later functionality, I need to add a ...
1
vote
0answers
52 views

Can the subgroup membership problem still be hard in known order subgroup?

For example: Given an elliptic curve $E$ over $\mathbb{Z}_q$, and $\#E(\mathbb{F}_q) = p^2$, where $p$ is a prime. Now given a subgroup $\langle G \rangle$ of $E$, and the order of the subgroup $\...
3
votes
2answers
251 views

Why isn't f(G) uniform in ECDSA?

In ECDSA, $f(G)=r$, where $r$ is the $x$-coordinate of group element $G$. My question is, how to prove this $f$ is not uniform? In other words, how to prove that, given a random element $G$ with ...
1
vote
2answers
71 views

How to generate a random point on an elliptic curve without knowing it's corresponding scalar private key

Given an elliptic curve with generator $G$, is it possible to generate a random point on the curve $Q = a \cdot G$ without knowing the secret value $a$ that generated it? Note that just using an $a$ ...
2
votes
0answers
29 views

what does small scalar multiplication in ECC means?

I came across this table a lot in many articles, but I didn't understand what's the difference between Scalar multiplication operation in a group based on ECC and a Small scalar point multiplication ...
2
votes
1answer
110 views

How do I multiply two points on an elliptic curve?

Tell me if there is a way to multiply two points on an elliptic curve? For example, as in secp256k1 ...
2
votes
1answer
86 views

In The Ristretto Group, do all points sampled with Elligator have the same order?

Assume the Hash-to-ristretto255 function Elligator as laid out here. Assume a random hash that is then mapped to a point in the <...
0
votes
1answer
36 views

the probability of sampling a group element that falls in the subgroup on elliptic curve

Given an elliptic curve $E$ on $Z_q$. There is a subgroup $<G>$ on $E$, and the order of $<G>$ is $p$, where $p$ is a prime. And the discrete log problem on $<G>$ is hard. Now we ...
-1
votes
1answer
76 views

How to find “k” in system of equations?

This is a $y^2=x^3+7$ elliptic curve points - $Q,G_1,G_2,G_3. k_1,k_2,k$? - secret exponents: $k_1*G_1( x_1,y_1) = Q(X,Y)$ $k_2*G_2( x_2,y_2) = Q(X,Y)$ $k*G_3( x_3,y_3) = Q(X,Y)$ How to find a $k$?...
1
vote
1answer
85 views

Modified ECIES using EC point ADD with DH key

I have questions about ECIES. ECIES Vanillia ECIES Encryption side (Alice's side) In "vanilla" ECIES when Alice wants to send Bob an encrypted message: Alice uses some Elliptic Curve, e.g. <...
1
vote
0answers
25 views

what is the probability for an adversary to find the new key after adding new entropy in a group where computational diffie hellman is hard?

Let's say I have an Elliptic curve group $E(\mathbb{F}_q)$ with base Point $G$ and large prime order $n$. Computational Diffie-Hellman is assumed to be hard in that group. $H: \{0,1\}^*\rightarrow \{...
1
vote
0answers
29 views

Signature algorithm for constrained environment, curve25512 already present for ECDH

I'm working in a very constrained (in code size/memory) microcontroller environment where I'll need public key signature verification. The algorithm to be used can be chosen, and there's no ...
1
vote
0answers
34 views

How hard will it be to solve an equation in elliptic curve group/ cyclic group where Discrete Logarithm is hard?

Given an Elliptic curve group $E(\mathbb{F}_q)$ where the Discrete Logarithm Problem (DLP) is hard and a base point $G \in E(\mathbb{F}_q)$ with large prime order $n$, what will be the advantage of a ...
0
votes
1answer
78 views

Adding curve25519 to tinyec

I am testing a TLS server that uses x25519 for key exchange. I am relying on Scapy-ssl_tls for building the TLS connection. However, this tool uses tinyec as its crypto library, and tinyec does not ...
2
votes
1answer
89 views

Test vectors for Ed25519

My apologies if this is obvious, but the truth is that I am confused about this. I am looking into RFC 8032 for test vectors for Ed25519, and I have some doubts concerning the information presented in ...
0
votes
0answers
21 views

EC scheme for one-way encryption

Consider this scenario: Alice and Bob need to share some secret messages. Alice is the sender and Bob is the receiver. This should be facilitated by Bob giving Alice a public key, such as in a ...
-2
votes
1answer
72 views

Seeking help to understand the arguments of Elliptic Curve Expression in SageMath [closed]

Good Day. I'm sorry for my sage code, without formulas, but I looking your help friend. ...
0
votes
0answers
19 views

Is it safe to use ECCSI-SAKKE as described on RFC6507-6508-6509?

In particular, is it safe to use them with the settings and the algorithms as they appear on the above RFCs? I am confused in various ways … just an example. In RFC6508 on page 3, the ‘E’ is defined ...
1
vote
0answers
43 views

Same Ed25519 key for signing and encryption? [duplicate]

I know this has been asked before, but it's still unclear whether this is an OK practice. The advice seems to never do this unless you have to, but I can think of some examples where this could be ...
2
votes
1answer
144 views

How is a generator found for a group, both in case of DH & ECDH?

First step in DH & ECDH is to choose a random prime $p$. Then you choose a generator $g$ for the group $\mathbb Z_p^*$. How do you find a generator? Likewise in ECDH, you would need to find a ...
1
vote
1answer
53 views

Is there any trapdoor that can solve elliptic curve subgroup membership problem?

Given an elliptic curve $E$ over a finite field q(q is a prime), and $<G>$, the cyclic subgroup of $E$, where G is the generator. Is there any trapdoor $T$, that given a random group element $P\...
0
votes
0answers
45 views

Deterministic generation of secure private keys from parent private key

is it possible to generate set of child private keys from one parent private key, generated by ECC for example, securely? So that new private key (and derive public key) could be used for encryption ...
1
vote
0answers
29 views

Schnorr Protocol Implementation - Sometimes Fails on Curve25519

I am implementing the Schnorr Protocol in python and am having reliability issues when using some curves. I am wondering if this is an issue with my logic, or some implementation issue. I am using ...
6
votes
1answer
261 views

Curve25519 Key Validation

According to the original paper of Bernstein, there is no key validation needed when using Curve25519 for Diffie-Hellman Key Exchange. However, where does this property come from? Is there any proof ...
1
vote
0answers
69 views

Converting a point in a finite field to its real (x, y) coordinate [closed]

Let curve $A: y^2 = x^3 + 7$ and curve $B: y^2 \equiv x^3 + 7 \pmod{p}$ Curve $B$ is secp256k1, assume the usual parameters for that curve. Let $k$ be any private key, and compute the corresponding ...
0
votes
1answer
42 views

Deterministic Key using a seed for ECNamedCurve

I am trying to generate deterministic keys using EC curve secp521r1 in java. I went through KDF but, couldn't find any references to use it with EC curves. I would appreciate if someone could point me ...
1
vote
1answer
75 views

Can ECDSA signature signing and verification process replaces password hashed based login system?

ECDSA or DSA in general was to sign a message or data using private key and verify it using public key, if the attacker/imposter doesn't have the private key then they couldn't sign the message ...
6
votes
3answers
311 views

Which Diffie-Hellman Groups does TLS 1.3 support? And should we use TLS 1.3 as a guide?

This is a two part question - and I'm asking as someone moving into a security role, who'll need to standardize practices going forward. (1) I'm curious whether the following 10 different DH Groups ...
3
votes
1answer
65 views

Corner cases of addition on short Weierstrass elliptic curves

I am trying to implement arithmetic over points on a short Weierstrass elliptic curve and I have trouble with corner cases of the points addition operation. Let me specify the parameters of the curve ...
1
vote
2answers
76 views

Can $y^2=x^3-x+1$ elliptic curve with $GF(3^m)$ where $m=97$ be used for Diffie Hellman key exchange?

I am new to ECC. I have just read about the elliptic curve $y^2=x^3-x+1$. I am copying the exact line The elliptic curve is super-singular $E:y^2=x^3-x+1$ in affine coordinates defined over a Galois ...
5
votes
2answers
303 views

Must a line hitting two points on the elliptic curve over a finite field hit another point by continuation?

The Arstechnica article title as "A (relatively easy to understand) primer on elliptic curve cryptography" claims this; In fact, you can still play the billiards game on this curve and dot ...
0
votes
1answer
73 views

Calculating ECDSA m or k (k or d) when s1 = s2

I recently began to look into some information about obtaining the private key $k$ when two signatures have been produced using the same $m$ and $k$. I've been using the well-publicised information ...
0
votes
1answer
106 views

Calculating the point on the curve during ECDSA signature verification

I'm confused as to how he got (62, 44) as an answer within this article: https://www.coindesk.com/math-behind-bitcoin
1
vote
1answer
94 views

Are different elliptic curves compatible?

Regarding SubtleCrypto and curves P-256, P-384 and P-521. Can I mix two different curves for key derivation? For example performing key derivation between P-256 and P-521. EDIT: Can I mix two ...
0
votes
1answer
90 views

CSIDH Squaring Fixing the Base Curve

Consider the following variants of the CSIDH squaring problem. P1. Given $sE, E$ where $s$ is a random ideal class and $E$ is a random curve (reachable from initial $E_0$), find $s^2E$ P2. Given $sE_0$...
2
votes
1answer
93 views

Problem with the signature of message using ECDSA over GF(2^m)

I'm trying to set up an ECDSA with Elliptic Curves over $\operatorname{GF}(2^m)$ with an example of toy with the following values: Using the Weierstrass equation on binary finite fields. $$E: y^2 + x*...
4
votes
2answers
142 views

Doubt on elliptic curve over a finite field and binary representation

I'm a programmer, i.e. agnostic to the mathemathics behind most of cryptographic scheme, but I'm trying to remediate. I'm writing this premise for any possible error or imprecision that I probably put ...
0
votes
1answer
103 views

Research Guidance on Elliptic Curve Cryptography [closed]

I am a freshman who want to research elliptic curve cryptography. There are a few questions I have: Firstly, I am not sure about how I should narrow down the topic. Where should I focus on? Can I ...
0
votes
0answers
29 views

Which signature is considered more secure and has less communication cost?

This article uses Elliptic Curve Cryptography, but when it comes to signing and verifying messages it is not using the ECDSA signature algorithm. In the article, they mentioned that the communication ...
1
vote
0answers
46 views

Is this good way of Elliptical curve point mapping

Mapping a bit string $L$ to elliptical curve point in say prime field $\mathbb Z_p$. A simple way would be to use an integer mapping function that maps $L$ to a number $\{1, q\}$ where $q$ is the ...
1
vote
0answers
65 views

How does one go about implementing a range proof?

I've attempted to find a solution to this problem, but for the life of me I am unable to. I am attempting to solve whether a point an elliptic curve of prime order is between 2 points, given a ...
0
votes
0answers
77 views

A card game (for mental poker or any other card game)

I thought of a way to produce trustless card game in a flexible way. One feature that I want is it should be flexible (It should work for any type of card game, though I indeed started it as a ...
0
votes
0answers
32 views

How to construct Hash function in python3? [duplicate]

In many cryptographic protocols design like this one, I have seen the statement 'Choose a Hash function for example: \begin{align} h&: \{0,1\}^*\times\mathbb G\to\mathbb Z_q^*\\ h_2&: \{0,1\}...
0
votes
0answers
49 views

Known attacks against ECC in case many multiples are known?

Suppose there's a secret value x, an elliptic curve with the (public) generator G, and a sequence of secret values ...
0
votes
0answers
19 views

CMS encryption application using Windows system certificate store

Hy! I'm looking for an application, which can make cms encryption/decryption, but with the use of the windows certificate store. I already found out, that openssl can't do it out of the box (just by ...

1
2
3 4 5
33