# Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

1,900 questions
Filter by
Sorted by
Tagged with
1 vote
57 views

### Working with Paillier and ECDSA - Order issue

I'm trying to implement two party computation for ECDSA signing using Paillier cryptosystem. But my problem is that the order of Paillier is different from the order of the curve (secp256k1 in my case)...
• 113
1 vote
31 views

### How is point addition for points of elliptic curve in $\mathbb{F}_p$ carried out technically? [duplicate]

From a very basic introduction text to elliptic curve cryptography point arithmetic is derived from "standard analysis": The (negative) sum of $P_1$ and $P_2$ is defined as the Point $P_3$, ...
• 1,447
1 vote
72 views

### Minimal, secure and reasonably efficient P384 implementations

For a project I'm working on, I need to implement ECDSA over the NIST P-384 curve (AKA secp384r1). For what it's worth, the choice of curve is beyond my control in ...
• 111
1 vote
62 views

### How to safely and randomly iterate a key derived from Scrypt?

I'm developing a way to deterministically generate private keys for arbitrary elliptic curves based on some user-input (a brain-wallet). Currently, I'm using the Scrypt password hashing algorithm with ...
• 13
1 vote
39 views

### Implementation size of post quantum schemes

I was comparing classical schemes with post-quantum schemes. Therefore I was interested in the round three candidates of the NIST standardization process. So far I know, that those post-quantum ...
• 1,682
43 views

### Paper that specifies how to define number ranges inside the ECC with varying equations

I am looking for a textbook or published paper that provides specific information on how to configure an ECC. I came across it several years ago and now cannot find it. Does anyone know the source? ...
• 27
1 vote
36 views

### What’s the relationship between P-256 and Dual EC DRBG?

It is said that Dual EC DRBG has a backdoor given the values of the curve. Hence some people do not trust it. With that in mind, some people also distrust NIST P-256 Curve. Why? Is it purely because ...
1 vote
83 views

### Distribution of elliptic curves with rank 2?

An elliptic curve defined over a finite field is either cyclic, or a direct sum of two cyclic groups. In cryptography, we use exclusively the former. I was wondering if there is any result on how ...
• 89
71 views

### Can form of elliptic curve digital signature equation be simpler?

I am curious why equations for signing/validating with ECDSA have forms they have. Is it possible to use simpler equation that have same properties. For example, this is an equation I found in the ...
1 vote
311 views

### Elliptic Curve - distinguish between two points after multiplication

If $P$ and $Q$ are two points on an elliptic curve of large prime order, given $P, Q$, and a point $R$ which is either (a) $nP$ or (b) $nQ$, is it possible to determine if $R$ is of form (a) or form (...
• 11
1 vote
78 views

### Schnorr based ZK scheme

TL;DR: This ABSOLUTELY does not work and presents a huge security risk. Posting it anyways in case there are other threats I missed or to dissuade any other person who comes up with this idea. Hi! I’m ...
• 35
1 vote
29 views

### What is an advantage of the Charles--Lauter--Goren hash function?

What is an advantage of the Charles--Lauter--Goren hash function (based on isogenies of elliptic curves) among other provably secure collision-resistance hash functions ? I heard that it is slower.
126 views

183 views

### Strauss-Shamir trick on EC multiplication by scalar

I'm studying ECDSA, and almost all somewhat detailed articles talk about using Strauss-Shamir trick on the verification step. Then I searched, and found this explanation (more like a stating) for the ...
• 43
172 views

### Curve448 - Can Ed448 key material be reused for X448?

Currently I am facing a situation in which Ed448 key pairs (private + public key) are available and the system should be extended by a Diffie-Hellman (ECDH) operation. First of let me summarize what I ...
• 33
1 vote
30 views

### Differing result between doubling and addition in extended twisted Edwards coordinates [closed]

While coding for Edwards curve, I noticed that, the addition formula and the doubling formula return what seems to be different result. I took the adding and doubling formula from both RFC-8032 and ...
• 7,103
1k views

### Can there be identical elliptic curve groups of points from different irreducible polynomials in binary extension fields?

Let $E$ be an elliptic curve over a binary extension field $GF(2^m)$, with constructing polynomial $f(z)$ be an irreducible, primitive polynomial over $GF(2)$, and let $G(x_g,y_g)$ be a generator ...
64 views

### Comparing the performance of ECC/RSA with post quantum protocols

I wanted to compare the performance of different cryptographic systems. There is a pretty good paper comparing the 3rd round finalists of the NIST competition. I was wondering if there are good ...
• 1,682
27 views

### Multiplicities of poles of a divisor of a rational function w.r.t. an elliptic curve

I am reading Sec 5.8.2 in the textbook Introduction to Mathematical Cryptology (Hoffstein, Pipher and Silverman), a precursor to introducing the structure of Weil pairing. It first defines a rational ...
• 249
647 views

• 121
13 views

### Distributing the Master Public Key in Identity-based Encryption systems

I was just wondering how the private key generator should publish the master public key inside of an IBE system. This key is needed for all devices in the network to derive the public key of receiving ...
149 views

### Invalid point attack on quadratic twist of Elliptic Curve when -1 is a quadratic residue

I'm replicating an invalid point attack on ECC using Short Weierstrass curves. For this I have written a "dumb" implementation that does not validate points are on the curve before going ...
1 vote
26 views

### cryWhat algorithm are Trezor One and Trezor T using to sign messages? [closed]

My knowledge of cryptography is beyond shallow, and I have a problem I cannot solve. Trezor wallets have two message signing formats: "Trezor" and "Electrum". I have a method in my ...
• 111
2k views

### I don't see how a ECDH is useful

I'm having a hard time understanding the usefulness of using an ECDH over traditional asymmetric encryption. Both parties have to exchange public keys to compute the ECDH, so why wouldn't they just ...
• 143
1 vote
90 views

### Is f(G) uniform under the described condition in ECDSA?

In ECDSA, $f(G)=r$, where $r$ is the $𝑥$-coordinate of group element $G$. Now it is known that $f(G)$ is not uniform(Why isn't $f(G)$ uniform in ECDSA?). Then in which range $f(G)$ is uniform? Let \$\...
• 717
183 views

### Can one find the GCD of two points on a curve?

Mathematically is it possible to find the GCD of two points on a prime curve, one of them not being the order as you do in Extended Euclidean Algorithm?
• 41
1 vote
227 views

### Shor's algorithm and ECDSA in Bitcoin - why is finding the private key still difficult when we know the base point?

I'm learning about Shor's algorithm and how it can be applied to break ECDSA. I've clearly missed something basic here - I thought I understood that the challenge ECDSA presented was to find the ...
• 13