Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

Filter by
Sorted by
Tagged with
0
votes
2answers
114 views

How to encrypt with elliptic curve cryptography (ECC)?

I need to ask this, as I am not allowed to comment and don't quite understand an existing answer because I don't have a cryptography background and never looked into how ECC works. Why can't you ...
0
votes
0answers
20 views

Can we use HMQV in an asynchronous setting?

Following the HMQV paper, to perform a key-exchange, Alice ($\hat{A}$) and Bob ($\hat{B}$) perform the following: $\hat{A}$ generates the long-term key pair ($sk_A= a$, $pk_A =g^a$) and the ephemeral ...
1
vote
0answers
38 views

Non-interactively share secret with group without revealing to generator?

Imagine someone knows a set of $n$ ECC public keys $\mathcal R = \{K_1, K_2, ... K_n\}$ but they don't know the corresponding private keys $k_1$, $k_2$ ... $k_n$. They wish to create a public key $sG$ ...
1
vote
1answer
113 views

Which hash algorithms are suitable for use with Elliptic-curve cryptography

I try to use Elliptic-curve cryptography system first time really, so i confused about it. this is the scenario: First i want to hash a message then, sign it. i use javascript so i try to follow this ...
7
votes
1answer
176 views

Is this a safe way to prove the knowledge of an ECDSA Signature?

I think that I've found a good solution to prove the knowledge of an ECDSA signature without revealing it. In short terms it consists in generating an ECDSA signature using the point $R$ as generator, ...
1
vote
0answers
40 views

How many 2-torsion points in an elliptic curve?

N torsion points have the structure ker([n]) ≅ Zn×Zn , so ker([2]) ≅ Z2×Z2 , gives us 3 2-torsion points. but ker([4]) ≅ Z4×Z4 ,this means we have 5 subgroup of order 4 . In each subgroup , there is ...
3
votes
1answer
75 views

Are there any special points on an elliptic curve which would weaken security?

So, according to the elliptic curve discrete logarithm problem: $$A=[r]B$$ In which $A$ and $B$ are points on the curve, and r is the scalar. It is trivial to compute $A=[r]B$ if $r$ is known, but ...
1
vote
1answer
61 views

OID for Ed25519

I am working on a code generating Edwards curve (Ed25519) keys in a HSM using PKCS#11 API. In the public key template the CKA_EC_PARAMS uses an OID to specify the curve. The encoding for Ed25519 is ...
0
votes
1answer
63 views

A multi-target attack on 128-bit ECDSA private keys

I'm thinking about doing this as a project, but I'm not sure how I'm supposed to proceed. So I have an 128-bit ECDSA, which would provide about 128 bits of security (if we do not use special methods ...
-1
votes
2answers
76 views

Does the private key in ECDSA have to be an integer?

In ECDSA, the public key $P$ is computed via the private key $k$ and the generator point $G$: $P=[k]G$ The scalar $k$ (private key) has to be an integer. However, I am wondering - does the private ...
0
votes
1answer
58 views

Find Points of order 2 on elliptic curve [closed]

Suppose there is an elliptic curve $E:y^2=x^3+(p-1)\cdot x\bmod{p}$ with $p>3$. The question is: What are the points that have an order of 2?
1
vote
2answers
97 views

Curve25519 function, scalar multiplikation

This is the main paper for Curve25519. In section 2: Specification there is a important theorem. In this theorem Bernstein defines the function $X_0 : E(F_{p^2}) \rightarrow F_{p^2}$. First Question:...
0
votes
1answer
34 views

implications of shor's algorithm on $F_{2^m}$ elliptic curves and GHASH

The security of elliptic curves depends on the difficulty of the discrete logarithm problem. Should Shor's Algorithm ever prove viable then elliptic curves would cease to offer any useful security ...
1
vote
0answers
32 views

Determining order of the group for an elliptic curve defined over a finite field

I need to find out the order of the group for an elliptic curve. See the image for the question. The inequality condition after simplification leads to $-2 \sqrt{p} \leq m \leq2 \sqrt{p}.$ Also, the ...
2
votes
1answer
82 views

Families of elliptic curves

I was reading this paper about elliptic curves and I saw this graphic: This paper is pretty new (november 2018) and I was wondering, whether these are all known ecc-families or not. The key point is, ...
4
votes
0answers
72 views

Inverse Public Key Proof

Alice has a private key, $x$, and a public key $P = [x] \cdot G$ in a group of order $n$. Alice would like to also publish her inverse public key (inverted modulo the group order) $P_{inv} = [x^{-1} \...
0
votes
0answers
111 views

How to multiply Elliptic curve point $S = (7 + 257 \times u, \space 258 + 21845 \times u) (\bmod 257^2 )$ on curve $y^2 = x^3 + 23\times x + 11$?

First of all I'm not good at English. Hope you will understand my question. In the paper 'Lifting and Elliptic Curve Discrete Logarithms' by Professor J. H. Silverman I found this example. Example ...
0
votes
1answer
59 views

What is the key length of shared secret by Curve 25519 ECDH

Both parties uses Curve 25519 key pairs for ECDH key exchange. What is the key length of shared secret after ECDH?
0
votes
1answer
45 views

Using ECDSA to sign a ECDiffieHellman-derived key

Assuming that Alice and Bob know the hash of each other's public key, take this method: Use ECDiffieHellman with temporary private keys each time to generate a per-session shared symmetric key Create ...
1
vote
1answer
53 views

MOV attack when $E(\mathbb{F}_q)$ is cyclic

Suppose $P\in E(\mathbb{F}_q)$ and $R=dP$. In the MOV attack, we compute $\alpha=e(P,T)$ and $\beta=e(R,T)$ and try to solve the discrete logarithm problem for $\alpha$ and $\beta$ in the finite ...
3
votes
1answer
129 views

Breaking ciphertext using a quantum computer when the public key is not available

As we know about Shor's algorithm on quantum computers it is possible to crack RSA / ECC easily if we have enough qubits. Is it possible to crack RSA / ECC on a quantum computer if we only have ...
0
votes
0answers
39 views

How to calculate the exponential inverse in elliptic curve Diffie-Hellman? [duplicate]

In Diffie-Hellman over $Z_p$, I know that if I choose a random $a$ in $Z_p$ and compute the modular inverse mod p-1, not mod p, then, with generator $g$ of my group, I can compute, for example, $(g^{...
2
votes
1answer
62 views

ECDSA Private Key from SSS

I have all of the Shamir's secret shares required to Lagrange-interpolate f(0), which represents an ECDSA private key. The field of this object is ...
1
vote
0answers
45 views

How to maintain the width of the cipher image in ECC Image Encryption from Singh and Singh (2015)?

I am a beginner in cryptosystems and I hope I would be accepted in the community. I was trying to implement Singh and Singh (2015) ECC image encryption algorithm on Matlab. I have been able to ...
0
votes
0answers
32 views

When connecting via SSH, does the Diffie-Hellman key exchange take place over an unencrypted TCP session or does encryption occur before the exchange?

I'm a cybersecurity student and I'm eager to understand the basic processes of an SSH session. I wrote down the stages to the best of my ability but need help understanding what happens right after ...
0
votes
1answer
89 views

ECCS: Elliptic Curve Cryptography Cramer Shoup

Introduction I know how to do Cramer-Shoup with cyclic groups. But how do I do it in elliptic curve cryptography (ECC)? Cramer-Shoup with cyclic groups Following was taken from Wikipedia: https://...
7
votes
1answer
461 views

Is it possible to decrypt an ECDSA private key if the same nonce is used across different private keys?

If the same nonce is used across different messages under the same private key, the private key can be easily revealed. However, let's consider another scenario. Two private keys, x1 and x2, are ...
2
votes
1answer
94 views

Converting raw ECC private key into ASN.1 DER encoded key

I created a random integer array of 32 bytes to use as my private key for secp256k1 curve. ...
2
votes
1answer
71 views

Excluding specific factors for Pohlig-Hellman

I want to use Pohlig-Hellman and BSGS to solve the discrete log of an Elliptic Curve which has a composite order generator. The ...
0
votes
0answers
51 views

MOV attack on ellipic curves with the correct dlog in the finite field, but wrong dlog in the EC group

I'm following this description of the MOV attack: https://people.cs.nctu.edu.tw/~rjchen/ECC2009/19_MOVattack.pdf (slide 6/8) by implementing it. However, sometimes the computed dlog $k$ (which is ...
3
votes
1answer
74 views

Embed message on Elliptic curve

Can anyone answer me, if I can embed a message when I convert it to ASCII value to points on Elliptic curve $E(Fp)$ , by multiplied the ASCII value with a base point B? For example, I have $E(F_{31})...
1
vote
1answer
49 views

Coefficients of Elliptic Curve over Finite Fields

When talking about elliptic curve over finite fields in ECC, we often assume that the elliptic curve can be written in the Weierstrass form $$y^2=x^3+Ax+B, \quad A,B\in \mathbb{F}_q$$. where $\...
1
vote
1answer
181 views

Understanding example of ECDSA P256

I am new to cryptography, I found the below Example on a nice website, but I am not able to understand the most of the terms used (H:Hash, K:Random number,E=?, Kinv=?,Rx=?=RY?,R=Private key?,D?,S? ...
1
vote
1answer
45 views

Standard for asymmetric encryption based on elliptic curves

Most parts of public key cryptography has established standards which are in turn used in a large amount of real world applications. There is PKCS#1 for RSA based encryption and signatures and there ...
1
vote
1answer
71 views

Montgomery Ladder with affin/projective Coordinates

So I'm trying to understand why the montgomery arithmetic is fast and what the montgomery ladder is. With this Post i understood the basic affin arithmetic and Ladder. So this is not really faster ...
0
votes
1answer
43 views

What are the extended homogeneous coordinates in the EdDSA specification?

According to the EdDSA specification from the IETF: For point addition, the following method is recommended. A point (x,y) is represented in extended homogeneous coordinates (X, Y, Z, T), with x = ...
3
votes
1answer
82 views

Construction of secure Elliptic Curve subgroup over a much larger field

How can we construct an Elliptic Curve subgroup of cryptographic interest out of an Elliptic Curve over a much larger finite field, including the familiar $\Bbb F_p$ for prime $p$? The Discrete ...
1
vote
1answer
83 views

Current situation of bilinear pairing protocols

The bilinear pairings are considered as the key enabler for many novel cryptographic protocols, such as three-party one round DH[1], shorter signatures and certificateless (ID-based) crypto[3] , which ...
1
vote
2answers
148 views

521-bit ECC keys are the same strength as RSA 15,360-bit keys

521 bit ECC uses key sizes 7.5 times smaller than the RSA standard while offering encryption that is magnitudes more secure. An RSA 2048-bit key's secure enough for banking, but a 521-bit ECC key is ...
1
vote
0answers
69 views

How to Reduce a Quaternion Ideal into Power Smoothness?

(TL;DR) How exactly do we reduce a quaternion ideal into another powersmooth one? Given a supersingular elliptic curve, it is known that its endomorphism ring is non-commutative. Specifically, there ...
0
votes
0answers
42 views

Elliptic Curve Point at Infinity [duplicate]

Let's take into account the curve SECP256K1. My questions are: What exactly is the "point at infinity"? Is there more than one "point at infinity" How can I identify if my EC generated x and y are ...
0
votes
1answer
47 views

Using ECDH for authentication

I've found this method for using ECDH for asymmetric encryption. Is there a similar method for using ECDH (rather than the more usual ECDSA, let's say my hardware can do ECDH but not ECDSA) to ...
3
votes
0answers
96 views

Attack on Weierstrass Elliptic Curve

I have a naive question(as non specialist in this field). While reading Weierstrass Curve description,I found that it turns into 2 periodic tori on 2D complex plane. Is is it possible to create ...
3
votes
1answer
51 views

Understanding the groups used in bilinear Ate-pairing

The bilinear ate pairing $e:G_1\times G_2 \rightarrow G_T$ is defined over the following groups: \begin{equation} \begin{aligned} & G_1 = E(\mathbb{F}_p)[r] \cap Ker(\pi_p-[1]), \\ & G_2 = E(...
0
votes
3answers
115 views

Curve25519 Specification

The Curve25519 is defined over the prime $2^{255}-19$ with $A = 486662$, so that the curve equation is: $y^2 = x^3 + 486662x^2 + x$ I'm trying to understand, why the parameters are what they are. ...
2
votes
1answer
171 views

Why can you use shorter keys with elliptic curve Diffie Hellman key exchange?

I am a layperson interested in how cryptography works. I would like to know why you can use shorter keys with elliptic curve Diffie-Hellman (ECDH) than with the discrete log DH key exchange. Both have ...
1
vote
1answer
54 views

Small complex multiplication field discriminant for solving ECDLP

I've seen from the SafeCurve criteria that one should try to avoid small complex multiplication field discriminant as it can speedup the discret log computation via the Polard Rho method. However, I ...
0
votes
0answers
76 views

Partially Repeated Roots of Classical Modular Polynomial

So I was trying to compute a normalized model of elliptic curve as described here. Consider $p$= ...
5
votes
1answer
151 views

When using Ristretto or Decaf with Ed25519 and Ed448, do scalars still need pruning/trimming/clamping?

Decaf is a point compression method that builds a prime-order group for (twisted) Edwards curves and Montgomery curves with cofactor $h = 4$ based on the Jacobi quartic [H2015]. The promise is to ...
0
votes
0answers
30 views

Point-halving/solving quartic equations over the elliptic curve E(Z_N)/ring Z_N where N = pq

I am wondering whether there are any results/whether there is any knowledge about the following problem: Given a univariate polynomial (say, a quartic) equation defined over $\mathbb{Z}_N$, is it ...

1
2
3 4 5
30