Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

Filter by
Sorted by
Tagged with
1
vote
1answer
139 views

Is there any way to mapping point between 2 elliptic curves?

Consider the elliptic curve $E_1: y^2 = x^3+7$ over $\mathbb F_{17}$ with the base point $G=(15, 13)$ and the second elliptic curve $E_2: y^2 = x^3+7$ over $\mathbb F_{31}$ with the same base point $...
1
vote
1answer
89 views

ECDH public keys restrictions

I know that Bob can calculate the shared DH key without knowing the private key. If he sends to Alice a public key = 1, then the the DH key would be 1. Can i achieve something like this in ECDH? where ...
5
votes
1answer
520 views

Looking at just EC Public Key parameters, how can you tell if it is invalid?

I am trying to handle when a parsers goes off the rails and reads an EC public keys wrong (just the X and Y components, I know the curve prior). Right now I check for the following (false means ...
1
vote
1answer
63 views

what motivated the design decisions of RFC 8291 ("Message Encryption for Web Push")?

Related question here. I'm reading RFC 8291, which describes a protocol to protect web push messages sent between an application server and a user agent (typically a mobile browser or other mobile ...
0
votes
0answers
137 views

Convert sr25519 key pair to Curve25519 key pair

I'm trying to implement public key encryption that support key pairs generated by different libraries: Curve25519 - libsodium cryptoBoxKeypair() Ed25519 - Google ...
1
vote
1answer
72 views

What if the bitlength of the value evaluated in Barrett reduction is greater than 2k the modulus?

For $c\equiv a \pmod n$, in Barrett Reduction, $\mu = \lfloor{\frac{2^{2k}}{n} \rfloor}$ is precomputed, where $k = \lceil{\log_2{n}} \rceil$ and the bitlength of $a$ is assumed to be less than $2k$. ...
4
votes
3answers
203 views

Order of Edwards curve and its twist

In Mike Hamburg's Ed448-Goldilocks, a new elliptic curve (eprint 2015, WECCS 2015) it is studied untwisted Edwards curves in the prime field $\mathbb F_p$ $$E_d:\,y^2+x^2\,=\,1+d\,x^2\,y^2$$ with ...
0
votes
1answer
70 views

Modified ElGamal encryption (ElGamal encryption with messages in the exponent ) is implemented in a pairing friendly elliptic curve. Is it secure?

In my scenario, I need to distinguish if the encrypted message is 0 or not. The message is encrypted by Elgamal encryption but with the message in the exponent. i.e. $(C,R)=(g^my^r,g^r)$ where $y$ is ...
0
votes
0answers
69 views

An "unsafe" curve over RSA? [duplicate]

I'm implementing a token server and considering backing them with ECDSA. The options from the library I'm using expose the NIST curves P-256, P-384, and P-521. The safe curves site does not list P-521,...
1
vote
0answers
80 views

Security of an ECDSA Adaptor Signature Implementation

I'm currently working on an implementation of ECDSA Adaptor Signatures, and part of the signature scheme calls for a NIZK proof to verify knowledge of exponent over two public keys that share a ...
2
votes
1answer
158 views

ElGamal on elliptic curves attack model (CPA,CCA1,CCA2)?

I can't find relevant literature discussing three attack models of the ECC-ElGamal algorithm (CPA, CCA1, CCA2) ECC-ElGamal algorithm: ElGamal with elliptic curves I only know that ElGamal belongs to ...
0
votes
0answers
39 views

Multiparty computation on circuits that perform group operations

I see that a lot of multiparty computation and garbling protocols are implemented for circuits like AES or SHA256. For my project, I would like to garble a circuit that performs some group operations ...
2
votes
1answer
91 views

How to select parameters for elliptic curves not found in standards (Hessian, Jacobi Intersection, Jacobi Quartic, etc)?

I am currently in the process of researching different forms of elliptic curves defined over prime fields. In many curve standards, such as NIST, Brainpool, etc, there exist a list of curve equations ...
0
votes
0answers
181 views

Why was Curve448 Selected for Standardzation but not Curve41417?

In 2014, Bernstein et al. published the Curve41417 paper, and in 2015, Mike Hamburg published Curve448. They are designed to solve the same problems that Curve25519 solved (e.g. using the Montgomery ...
1
vote
0answers
58 views

Which program/language was used to plot the point at infinity of these images? (See the images)

The code of the first image was provided by Squeamish Ossifrage in this answer. In wich language/program was plot? In JavaScript or GeoGebra? Also, I found in YouTube the image below with the point ...
1
vote
1answer
71 views

Software implementation of symmetric and asymmetric bilinear pairings

I have recently read a paper about pairings, which only implemented asymmetric bilinear pairings and it mentiond that $\eta_{T}$ pairing is the most efficient algorithm for symmetric pairings. I ...
0
votes
1answer
77 views

Why computation of $u*v^3*(u*v^7)^{(p-5)/8}$ is suggested instead of $(u/v)^{(p+3)/8}$

Working with Curve25519 I've faced with suggested form of computation square root candidate as: $uv^3(uv^7)^{\frac{p-5}{8}}$ instead of $\left(\frac{u}{v}\right)^{\frac{p+3}{8}}$. Why it is so? Or why ...
2
votes
1answer
159 views

Are GPUs inefficient for calculations on big numbers? Is RSA and EC cypto generally done on CPU only?

Looking specifically at RSA and EC algorithms which imply doing operations on integers >= 256 bits (>> 64 bits), I have noticed (from my limited experience) that 99% of the software for ...
0
votes
1answer
155 views

How to compare the time of encryption, cracking and verification elliptic curve problem in the same framework?

everyone! As a beginner, I would like to ask you a question. The best algorithm known for cracking (done by anonymous snooper) this problem (Discrete logarithm problem of elliptic curve or ECDSA)is ...
0
votes
1answer
99 views

Elliptic curve in Binary Field implementation

For Elliptic curves defined over $GF(2^n)$, by adding any two points P and Q over $GF(2^n)$ we get the third point over $GF(2^n)$. In Elliptic Curve Digital Signature Algorithm (ECDSA) https://en....
2
votes
0answers
60 views

Is there any way to encrypt the path in between a small number of 3D positions?

Or more general: given two valid random cipher $c_0, c_1$ a function $D$ with $$D(c_0,c_1) = (a,b,c)$$ should exist but hard to compute (for most cases). The result $(a,b,c)$ represents the path from $...
1
vote
0answers
51 views

Combining ECC And RSA for a Web Based Chat system

I'm a building a Web application chat message system(Over TLS) and i would like to know if the following theory is correct. Sender I'm generating keyPairs using RSA and another KeyPairs using ECC. By ...
3
votes
1answer
111 views

How does sending compressed points in ECC can limit the attacker's capabilities?

While sending an EC point we mainly have two options, send it compressed or uncompressed. The uncompressed has prefix 04 and compressed has ...
1
vote
1answer
143 views

How does the security of Elliptic curve compare to normal discrete logarithm?

Intro: EC are often compared with RSA but how about a more safe version of the discrete logarithm? All 3 can be reduced to the problem: $$b = g^a \mod{P}$$ In RSA $P$ is a product of two primes. To ...
2
votes
1answer
215 views

What can we recover with an invalid curve attack

According to the "Guide to Elliptic Curve Cryptography" (page 182), it's possible to recover $d$ with an invalid curve attack. How can this value be used once recovered? For example, with ...
0
votes
1answer
110 views

What is the maximum cofactor of elliptic curve used for ECDSA?

I know that the cofactor of curve 25519 is 8. Is it the maximum factor in the existing curve used for ECDSA?
1
vote
1answer
120 views

How did this group discover m wasn't random?

In this video a group of "hackers" describe how they discovered private keys for the PS3 that was using this ECDSA algorithm by discovering that the "random" integer $m$ (or $k$ in ...
1
vote
1answer
220 views

Generate secp256k1 ECC key pair with libsodium

I'm new to crypto and I want to generate a key pair, in C, which would be the equivalent of openssl ecparam -name secp256k1 -genkey -out ec-priv.pem. I love ...
2
votes
2answers
272 views

Prime order elliptic curve groups: Generators and the reason choice

As far as I understand, the elliptic curve group based on BLS12-381 is prime order and cyclic. Thus, any group element could be used to generate all the elements of ...
0
votes
2answers
363 views

How are ECC keys stored?

I am trying to figure out what typical formats and sizes, etc. are, for storing ECC public and private keys. Some quick research turned up X9.62 (to which I don't have access) and SEC1. But then there ...
0
votes
0answers
126 views

what it means by A dot B yields C in Elliptic Curve Cryptography?

I don't understand what the dot notation is. Is it like a multiplication operation or an addition operation or what? and how is that related to the Elliptic Curve Discrete Logarithm Problem? For ...
1
vote
1answer
123 views

ecdsa nonce reuse to compute the private key, modular inverse question

I am following along some cryptography challenges:, in particular ECDSA Nonce Reuse here (second problem): https://blog.coinbase.com/capture-the-coin-cryptography-category-solutions-fe94d82165c5 I ...
1
vote
0answers
409 views

Calculating ECDSA Private Key From Multiple Signatures With Shared k (random nonce)

I've been experimenting with ECDSA signatures and with how the Sony PS3 private key was leaked. Specifically where: $$k = \frac{z_1 - z_2}{s_1 - s_2}$$ $$d_A = \frac{z_1s_2 - z_2s_1}{k(s_1 - s_2)}$$ ...
4
votes
0answers
272 views

secp256k1 scalar decomposing and prime field arithmetic

I'm currently studying the elliptic curve secp256k1 implementation. In my understanding, it has efficiently computable endomorphisms: We can find out a pair of number $\lambda$ and $\beta$ from the ...
4
votes
3answers
91 views

Is it secure to compute the exponentiation and the LWE operation?

Suppose Alice and Bob have specified an elliptic curve, for example, secp256k1. Alice has a secret number $s$ (can be seen as secret key), Bob choose a point $g$ on the curve and send it to Alice. ...
1
vote
1answer
215 views

Homomorphic mapping between elliptic curve point and Zq

I'm trying to figure out how to do a mapping between elliptic curve points and Zq without breaking homomorphic properties. Sorry, I'll write the problem in multiplicative notation because it's easier. ...
1
vote
1answer
97 views

Is prime order group used in ECDSA unique?

In ECDSA, we use a prime order group $\langle G\rangle$ for cryptographical use. Assume $\#\langle G\rangle = p$. Is there another subgroup in the curve used for ECDSA whose order is also $p$?
0
votes
2answers
118 views

Wrong key length for EC public key

I have a problem with EC public key reading from smartcard using pkcs11 library. With the secp256r1 EC algorithm, I always get 65 or 67-byte length public key with different smartcards. But with the ...
2
votes
3answers
92 views

Can schnorr-signatures be used to ensure public keys are of the correct form (namely $Y= x \cdot G$)?

Assume a Schnorr-signature scheme in an elliptic curve setting with a publicly known generator base point $G$ where the the discrete logarithm is hard. That is, given $x \cdot G$, it is hard to find $...
0
votes
0answers
34 views

elliptic curve scalar addition

say there is an homomorphic cryptosystem on elliptic which allows unlimited addition and only one multiplication. So in order to same the mult operation for a later functionality, I need to add a ...
1
vote
0answers
59 views

Can the subgroup membership problem still be hard in known order subgroup?

For example: Given an elliptic curve $E$ over $\mathbb{Z}_q$, and $\#E(\mathbb{F}_q) = p^2$, where $p$ is a prime. Now given a subgroup $\langle G \rangle$ of $E$, and the order of the subgroup $\...
3
votes
2answers
273 views

Why isn't f(G) uniform in ECDSA?

In ECDSA, $f(G)=r$, where $r$ is the $x$-coordinate of group element $G$. My question is, how to prove this $f$ is not uniform? In other words, how to prove that, given a random element $G$ with ...
1
vote
2answers
126 views

How to generate a random point on an elliptic curve without knowing it's corresponding scalar private key

Given an elliptic curve with generator $G$, is it possible to generate a random point on the curve $Q = a \cdot G$ without knowing the secret value $a$ that generated it? Note that just using an $a$ ...
2
votes
0answers
32 views

what does small scalar multiplication in ECC means?

I came across this table a lot in many articles, but I didn't understand what's the difference between Scalar multiplication operation in a group based on ECC and a Small scalar point multiplication ...
3
votes
1answer
309 views

How do I multiply two points on an elliptic curve?

Tell me if there is a way to multiply two points on an elliptic curve? For example, as in secp256k1 ...
2
votes
1answer
143 views

In The Ristretto Group, do all points sampled with Elligator have the same order?

Assume the Hash-to-ristretto255 function Elligator as laid out here. Assume a random hash that is then mapped to a point in the <...
0
votes
1answer
57 views

the probability of sampling a group element that falls in the subgroup on elliptic curve

Given an elliptic curve $E$ on $Z_q$. There is a subgroup $<G>$ on $E$, and the order of $<G>$ is $p$, where $p$ is a prime. And the discrete log problem on $<G>$ is hard. Now we ...
-1
votes
1answer
97 views

How to find "k" in system of equations?

This is a $y^2=x^3+7$ elliptic curve points - $Q,G_1,G_2,G_3. k_1,k_2,k$? - secret exponents: $k_1*G_1( x_1,y_1) = Q(X,Y)$ $k_2*G_2( x_2,y_2) = Q(X,Y)$ $k*G_3( x_3,y_3) = Q(X,Y)$ How to find a $k$?...
1
vote
1answer
110 views

Modified ECIES using EC point ADD with DH key

I have questions about ECIES. ECIES Vanillia ECIES Encryption side (Alice's side) In "vanilla" ECIES when Alice wants to send Bob an encrypted message: Alice uses some Elliptic Curve, e.g. <...
1
vote
0answers
29 views

what is the probability for an adversary to find the new key after adding new entropy in a group where computational diffie hellman is hard?

Let's say I have an Elliptic curve group $E(\mathbb{F}_q)$ with base Point $G$ and large prime order $n$. Computational Diffie-Hellman is assumed to be hard in that group. $H: \{0,1\}^*\rightarrow \{...

1 2 3
4
5
36