Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

Filter by
Sorted by
Tagged with
3
votes
1answer
110 views

Why is the strength of an Elliptic Curve Cryptography (ECC) half the size of the prime field size?

I've looked around and couldn't find a direct answer. As a general rule, I've read from various sources (here here, and here) that the strength of an elliptical curve key is half of the size of the ...
1
vote
3answers
320 views

Is the curve25519 algorithm a special(implementation) one of ECDH?

It's the first time for me to learn about Key Exchange Protocol. And I thought that in both ECDH and DH there is a necessary step to share some public infomation(the common parameters) to each sides ...
1
vote
0answers
32 views

short signature for EC

i'm building a low-power wireless sensor network in which each slave node has a public/private ECC key pair -- generated by the node itself during manufacturing.... the slave node is also provisioned ...
0
votes
1answer
50 views

How to calculate the order of the subgroup?

Given a curve with points over GF(p), a subgroup of prime order q and a co-factor h. How do I calculate the size of q which is ...
0
votes
1answer
61 views

Security strength EC signature for variable message size

I am implementing a system using some sort of 32bytes OTC (One-Time Code) and signing it with ECDSA to get verification of a public key owner. The key I'm using is ...
1
vote
1answer
27 views

Cost model for different curve models

Is there a cost model for each curve model and their conversions? For example: Take the curve models: Projective, Completed, Extended, Affine. Is there a table which shows how many multiplications, ...
3
votes
0answers
150 views

How does post quantum key exchange in OpenSSH 8 work?

OpenSSH 8 supports a post quantum KEX, namely sntrup4591761x25519-sha512@tinyssh.org It says in its description that it is basically NTRU + ECC X25519. However, I have tried but cannot understand how ...
0
votes
0answers
32 views

How to exchange a common key to a group of person using Elliptic-curve Diffie–Hellman (ECDH)? [duplicate]

In ECDH, when two persons want to share private keys, they first select a point $G$ on the elliptic curve and after that, each of them picks a random integer $a$ and $b$, respectively, and multiply ...
-1
votes
2answers
106 views

How to find at least one private key from a large list of compressed public keys secp256k1

Not long ago I saw a discussion on the Bitcoin Talk forum: https://bitcointalk.org/index.php?topic=5060735.msg50736695#msg50736695 Please give advice and working methods? Is it possible to find at ...
1
vote
1answer
59 views

Check if two ed25519 points are equivalent

How to check if two points are equivalent given their projective coordinates (XYTZ)? For example if I do unproject() of a point to pass from XYTZ to XY coordinates and then I come back to XYTZ ...
0
votes
1answer
28 views

montgomery reduction multiplicative identity

How do you figure out the multiplicative and additive identity with respects to R? I pick some R such that gcd(R, N) = 1 where N is the size of the group. Given some field element x in the group, I ...
0
votes
1answer
59 views

Computing a sextic twist

Let $(x,y) \in E'_{\mathbb{F}_{p^2}}$ be a point of the sextic twist. I am currently trying to compute: $\psi : (x, y) \leftarrow (\mu^2x,\mu^3y)$ with $\mu \in \mathbb{F}_{p^{12}}$ the root of $(Y^...
3
votes
0answers
74 views

Doubt in computing $g^\frac{1}{\delta+x}$ where $x \in \mathbb{Z}$

I was going through Zero Knowledge Set Membership and came across the following: Given $x \in \mathbb{Z}$ and $g$ is the generator of a multiplicative group $\mathbb{G}$ how do we compute $g^\frac{1}{...
0
votes
0answers
41 views

Regarding the isogeny path problem

Given two elliptic curves, it is hard to calculate an isogeny of large degree between them. Does this only apply to supersingular isogenies or to ordinary ones as well? Additionally, is the mapping ...
1
vote
1answer
40 views

ECDSA over $\mathbb{F}_{p^n}$ for $n>1$. How to calculate $r$ and $s$

I'm having some trouble understanding how to calculate $r$ and $s$ as specified in the wikipedia page for ECDSA (https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm) We can see ...
1
vote
1answer
111 views

Simple math ECDSA example

I'm trying to setup an ECDSA math example using just integer math and multiply (no EC). The purpose is just to help people understand why this works with out the added complication of understanding ...
2
votes
0answers
41 views

Security strength of JPBC Type A curve compared to SecP curve

I recently encountered some problems when learning about the JPBC library. Does the curve generated by (J)PBC using the method typeAcurvegenerator(160,512) and the ...
2
votes
1answer
63 views

Share secret non-interactively in a verifiable way

In an application, I need to share a secret (random number) with a Group of known receivers over a public channel (a Blockchain) but each receiver needs to be able to check that the others received ...
1
vote
0answers
111 views

How do pairings behave on G2/twist points off the prime order subgroup?

$\newcommand{\F}{\mathbb{F}}$ Consider the ate pairing defined on a curve $G_1 = E(\F_q)$ and $G_2 = E'(\F_{q^r})$ where $E'$ is a twist of $E$ with the twisting isomorphism defined over $\F_{q^r}$. ...
1
vote
1answer
107 views

Converting EdDSA Keys to EC-KCDSA keys

I'm trying to create BIP32 like key derivation for EKCDSA by riding over a BIP32-EdDSA derivation Can anyone tell me if there is a glaring problem with my conversion technique? ...
0
votes
1answer
59 views

Question on using endomorphism on secp256k1 and negative results

I have read section 3.5 (algorithm 3.7) in "Guide to Elliptic Curve Cryptography", and have been trying to implement endomorphism on secpt256k1 to speed up calculating $kP$ by changing it into 2 point ...
2
votes
1answer
44 views

Lenstra's ECM Algorithm - field requirement

In Lenstra's ECM algorithm, $\#E(\mathbb{F}_{p})$ is required to have small prime factors. Why is this so? I understand that the p-1 method is efficient for factoring N with small factors. The ECM ...
1
vote
1answer
169 views

Generating a random point on an elliptic curve over a finite field

I have coded an implementation of elliptic curves in order to apply some of the ECC algorithms. However, in most of them, Alice needs to choose a point P on a given curve. What is the general ...
2
votes
1answer
211 views

Can you tell me why doing scalar multiplication of a point on a Elliptic curve over a finite field gets to a point at infinity?

I am reading Programming Bitcoin. The author said: Another property of scalar multiplication is that at a certain multiple, we get to the point at infinity (remember, the point at infinity is the ...
2
votes
1answer
148 views

Why is encryption slower than decryption in elliptic curve cryptography (ECC)?

While performing encryption using public key and decryption using the private key, I am always finding that encryption takes more time than decryption in elliptic curve cryptography (ECC). It's the ...
0
votes
1answer
49 views

Book request about elliptic curves, RSA and DSA

I understand that this question can be hardly downvoted, but so be it if someone gives me really useful references :) I wanna learn difference (deeply) between RSA, DSA, and ECC, especially I am ...
-1
votes
1answer
131 views

What are the inverse operations in elliptic curve cryptography?

Public-private key cryptography is based on inverse operations that use separate input. In elliptic curve cryptography, what are those inverse operations?
0
votes
0answers
37 views

Explanation of Gallant-Lambert-Vanstone method / Endomorphism speedups [duplicate]

Can someone explain how the Gallant-Lambert-Vanstone method works (or which literature explains it)? It is also unclear to me how the Frobenius endomorphism can be used in some cases for a speedup. ...
2
votes
1answer
108 views

Are there shortcuts for computing ECC Point multiplication?

I'm trying to learn about elliptic curve cryptography. Let's say you have point $P$ and 256 bit number $n$ and you want to compute $nP$. It sounds like computing additions one at a time is not ...
0
votes
1answer
81 views

How to multiply two Public Keys in Elliptic Curve in Go

I am working on a messaging client similar to Signal. I am stuck on implementing Tripartite Diffie-Hellman handshake in which three DH exchanges are combined to authenticate both parties and produce ...
7
votes
2answers
634 views

Does secp256k1 have any known weaknesses?

I am wondering whether there are any properties of the curve which would technically make it easier to attack than any other curves of 256 bits in size. I have heard that being a Koblitz curve, it ...
0
votes
1answer
54 views

Why public key has two parts in my secure messaging client similar to signal

I am working on a Golang code similar to Signal protocol. I need to modify it. I am confused on tripartite Diffie-Hellman handshake part of code, i.e. why public key has two separate parts as compared ...
3
votes
1answer
141 views

ECDSA signing process

I am trying to learn how ECDSA works. I do not have a background in maths, but have been following a guide which has built me up from finite fields, elliptic curves. I am unable to figure out how a ...
0
votes
1answer
87 views

Why is it better to add and double points on an elliptic curve using projective space?

I have been given a textbook which defines the addition of two points on an elliptic curve and the doubling of a point on an elliptic curve. This textbook explains elliptic curves in projective space ...
0
votes
1answer
108 views

Convert affine to projective coordinates and vice versa in ECC?

I am working on a small project. An elliptic curve equation with y^2=x^3-3x+27 mod 43, a point $Q=(1,38)$, using point doubling method https://en.wikipedia.org/wiki/Elliptic_curve_point_multiplication#...
4
votes
1answer
661 views

Curve25519 over Ed25519 for key exchange? Why?

I've been reading up on the Signal Protocol (in this PDF) and it seems to be using Curve25519 for ECDH and EdDSA (with Ed25519) for signatures. My question is why not use only Ed25519? This ...
0
votes
2answers
690 views

How is EC key encoded in PKCS#8?

I just started working with certificates and signatures. For an application I write I need a key pair for ECDSA signatures, using the elliptic curve secp384r1 (aka NIST P-384). I produced such a key ...
4
votes
1answer
140 views

How can I exploit the structure of the secp256k1 prime for fast arithmetic?

I'm implementing logic on an FPGA (programmable chip) that does the key verification part of ECDSA on the curve secpk256k1, in which all operations are mod p where $p = 2^{256} - 2^{32} - 2^9 - 2^8 - ...
4
votes
1answer
116 views

Curve25519's Y coordinate of Basepoint origin

The paper High-speed high-security signatures by Bernstein et al. introduces the Edwards curve Ed25519. Concerning the base point $B$, it says that $B$ is the unique point $(x,4/5)∈E$ for which $x$...
0
votes
0answers
55 views

Isogeny of elliptic curve

If we have two elliptic curves $E$ and $E'$ and the points of both elliptic curves are same. Then all the points of $E$ map to all the points of another elliptic curve $E'$. For example $E$ has ...
0
votes
0answers
32 views

How does the order of a group, it's torsion subgroup and the co-factor link?

Given an elliptic curve that defines some group of non-prime order, with co-factor h. Would it then have a h-torsion subgroup? What are the implications for ECC ...
0
votes
0answers
66 views

Deterministic generation of RSA keys for IPFS / OrbitDB [duplicate]

I am in the process of working on a decentralized application using IPFS and OrbitDB. IPFS uses 2048 bit RSA keys for the Node runtime peer-id and secp256k1 for read/write access in OrbitDB. For ...
6
votes
2answers
332 views

Difference on montgomery curve equation between EFD and RFC7748

There is a subtle difference between the 2 implementations for a Montgomery curve defined from the 2 following links https://hyperelliptic.org/EFD/g1p/auto-montgom-xz.html A = X2+Z2 AA = ...
-1
votes
2answers
466 views

Can Shamir’s Trick crack the cryptographic strength of ECDSA?

Recently stumbled upon a discussion in the forum What is Shamir’s Trick used for? Are there any such examples?
0
votes
2answers
47 views

Elliptic curves - operations in larger groups - performance

According to my measurements and to this work, it seems that operations, for example scalar multiplication, are more expensive in larger groups. If I have, for example, an 80-bit elliptic curve and an ...
0
votes
2answers
147 views

Why doesn't the formula work when checking two ECDSA signatures?

There are two generated ECDSA signatures X - Private key S = ((Z + (X * R)) / K) mod n S` = ((Z` + (X * R`)) / K`) mod n G - Base point, of order n; ...
3
votes
2answers
206 views

Which hash is used when providing signature algorithm ED25519 or ED448?

From TLS 1.3 there are two signature algorithms using edDSA: /* EdDSA algorithms */ ed25519(0x0807), ed448(0x0808), All the other signature-...
1
vote
0answers
65 views

ECDSA - why is the first part of the signature used in the second?

Using the terminology of https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm Why is the second part of the ECDSA signature defined as: $s = k^{-1}(z+rd_A)\text{ mod n}$ ...
1
vote
0answers
42 views

Why doesn't the JOSE suite/JWA include ECIES?

The JOSE suite specifics use of RSA-OAEP (for when one party has an RSA key) and ECDH (for when two parties have EC keys) in JWA. Why doesn't it include ECIES? It seems like a way to derive a key ...
2
votes
2answers
124 views

ECC How do the Curve, its number of bits of security and key size affect the maximum size of ciphertext?

First of all, excuse me if this question is too noobish. I'm trying to understand how these things are relate: Curve type, its 'number of bits of security', size of the key and the maximum ciphertext ...