# Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

1,504 questions
Filter by
Sorted by
Tagged with
151 views

### Converting raw ECC private key into ASN.1 DER encoded key

I created a random integer array of 32 bytes to use as my private key for secp256k1 curve. ...
75 views

### Excluding specific factors for Pohlig-Hellman

I want to use Pohlig-Hellman and BSGS to solve the discrete log of an Elliptic Curve which has a composite order generator. The ...
51 views

I'm following this description of the MOV attack: https://people.cs.nctu.edu.tw/~rjchen/ECC2009/19_MOVattack.pdf (slide 6/8) by implementing it. However, sometimes the computed dlog $k$ (which is ...
98 views

293 views

### Understanding example of ECDSA P256

I am new to cryptography, I found the below Example on a nice website, but I am not able to understand the most of the terms used (H:Hash, K:Random number,E=?, Kinv=?,Rx=?=RY?,R=Private key?,D?,S? ...
45 views

### Standard for asymmetric encryption based on elliptic curves

Most parts of public key cryptography has established standards which are in turn used in a large amount of real world applications. There is PKCS#1 for RSA based encryption and signatures and there ...
75 views

### Montgomery Ladder with affin/projective Coordinates

So I'm trying to understand why the montgomery arithmetic is fast and what the montgomery ladder is. With this Post i understood the basic affin arithmetic and Ladder. So this is not really faster ...
43 views

### What are the extended homogeneous coordinates in the EdDSA specification?

According to the EdDSA specification from the IETF: For point addition, the following method is recommended. A point (x,y) is represented in extended homogeneous coordinates (X, Y, Z, T), with x = ...
85 views

### Construction of secure Elliptic Curve subgroup over a much larger field

How can we construct an Elliptic Curve subgroup of cryptographic interest out of an Elliptic Curve over a much larger finite field, including the familiar $\Bbb F_p$ for prime $p$? The Discrete ...
85 views

### Current situation of bilinear pairing protocols

The bilinear pairings are considered as the key enabler for many novel cryptographic protocols, such as three-party one round DH[1], shorter signatures and certificateless (ID-based) crypto[3] , which ...
233 views

### 521-bit ECC keys are the same strength as RSA 15,360-bit keys

521 bit ECC uses key sizes 7.5 times smaller than the RSA standard while offering encryption that is magnitudes more secure. An RSA 2048-bit key's secure enough for banking, but a 521-bit ECC key is ...
69 views

### How to Reduce a Quaternion Ideal into Power Smoothness?

(TL;DR) How exactly do we reduce a quaternion ideal into another powersmooth one? Given a supersingular elliptic curve, it is known that its endomorphism ring is non-commutative. Specifically, there ...
44 views

### Elliptic Curve Point at Infinity [duplicate]

Let's take into account the curve SECP256K1. My questions are: What exactly is the "point at infinity"? Is there more than one "point at infinity" How can I identify if my EC generated x and y are ...
53 views

### Using ECDH for authentication

I've found this method for using ECDH for asymmetric encryption. Is there a similar method for using ECDH (rather than the more usual ECDSA, let's say my hardware can do ECDH but not ECDSA) to ...
99 views

### Attack on Weierstrass Elliptic Curve

I have a naive question(as non specialist in this field). While reading Weierstrass Curve description,I found that it turns into 2 periodic tori on 2D complex plane. Is is it possible to create ...
58 views

### Understanding the groups used in bilinear Ate-pairing

The bilinear ate pairing $e:G_1\times G_2 \rightarrow G_T$ is defined over the following groups: \begin{aligned} & G_1 = E(\mathbb{F}_p)[r] \cap Ker(\pi_p-[1]), \\ & G_2 = E(...
117 views

### Curve25519 Specification

The Curve25519 is defined over the prime $2^{255}-19$ with $A = 486662$, so that the curve equation is: $y^2 = x^3 + 486662x^2 + x$ I'm trying to understand, why the parameters are what they are. ...
179 views

### Why can you use shorter keys with elliptic curve Diffie Hellman key exchange?

I am a layperson interested in how cryptography works. I would like to know why you can use shorter keys with elliptic curve Diffie-Hellman (ECDH) than with the discrete log DH key exchange. Both have ...
66 views

### Small complex multiplication field discriminant for solving ECDLP

I've seen from the SafeCurve criteria that one should try to avoid small complex multiplication field discriminant as it can speedup the discret log computation via the Polard Rho method. However, I ...
76 views

### Partially Repeated Roots of Classical Modular Polynomial

So I was trying to compute a normalized model of elliptic curve as described here. Consider $p$= ...
167 views

### When using Ristretto or Decaf with Ed25519 and Ed448, do scalars still need pruning/trimming/clamping?

Decaf is a point compression method that builds a prime-order group for (twisted) Edwards curves and Montgomery curves with cofactor $h = 4$ based on the Jacobi quartic [H2015]. The promise is to ...
33 views

### Point-halving/solving quartic equations over the elliptic curve E(Z_N)/ring Z_N where N = pq

I am wondering whether there are any results/whether there is any knowledge about the following problem: Given a univariate polynomial (say, a quartic) equation defined over $\mathbb{Z}_N$, is it ...
1k views

### Why do people criticize and mistrust the e-voting based block chain?

I am planning to implement an e-voting system based on hyperledger fabric blockchain, however, I came across many criticisms from well-known security experts like Josh Benaloh and others. The problem ...
35 views

### Is it possible to “convert” to a curve

Assuming I have a 2 black boxes Box A: generates a private key and use it to sign whatever data I sent it (using secp256r1). It also returns the corresponding public key Box B: gets a public key, and ...
217 views

### Curve25519 key exchange in detail

So I'm trying to understand how the key exchange with Curve25519 works. I read the original Paper from Bernstein "Curve25519: new Diffie-Hellman speed records", but I still got some questions. First ...
187 views

### Why is Curve25519 mostly used for key exchange?

When i studied the Applications where Curve25519 is used, i found out, that it is mostly used for the key exchange. Examples are the Signal Protocol and Threema. I know, that Curve25519 has a pretty ...
152 views

### Why the output of elliptic curve based cryptosystems is smaller than the ordinary public key cryptosystems?

I am trying to understand how much the output of elliptic curve based cryptosystems (for example elliptic curve ElGamal) is smaller than the ordinary public key cryptosystems. I know that the ...
148 views

### Elliptic Curves - Proving that the group is not cyclic

I have a question from Stinson: 7.14. The question states: Suppose that $p > 3$ is an odd prime, and $a,b$ is an element of $\mathbb Z_p$. Further, suppose that the equation $x^3 + ax + b$ is ...
761 views

### RFC6979: error in reference implementation?

If I correctly understand RFC 6979, there is an error in the ref implementation section 3.2. In the step H2, RFC specification says ...
106 views

### Difference between DER encoded signatures in JavaScript, Java, and C++

I'm trying to understand the DER-encoded signatures for the secp256k1 (ECDSA) curve better, so I have the following data array: 000102030405060708090a, which is a ...
123 views

### Symmetric versus asymmetric self encryption

I can encrypt my files with a symmetric encryption algorithm like AES, or with an asymmetric encryption algorithm like RSA or ECC (I encrypt my files with my own public key). No communication is ...
189 views

### is using secp256k1 curve for ECIES considered safe?

I read SafeCurves it indicates Secp256k1 is not SafeCurve by their standards but bitcoin and ETH use it in their blockchain. I researched more and figured out that using Secp256k1 ECDSA(singing ...
81 views

### Interactive ECDHE Authentication With Numeric Code

Trying to simplify my question, keeping only core concepts. Proposed solution: Both user devices generates ECDHE key pairs. Send pub keys to each other. Generate shared secret. Device that requests ...
61 views

### Elliptic curves over extensions of 64-bit fields

Are there any standard (or at least well-know) elliptic curves over $F_{p^4}$ where $p$ is a ~64-bit prime? I know Microsoft has FourQ curve which works over $F_{p^2}$ where $p$ is a 127-bit prime, ...