# Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

1,900 questions
Filter by
Sorted by
Tagged with
76 views

### Show me all the steps and methods used to get from a system of 4 linear equations to solve for X1 and X2

I am looking at an answer to a previous question and I would like more detail about how the answer was arrived at but I am not allowed to comment as I am a new user with low points. I am therefore ...
1 vote
1k views

### What is a good and bulletproof private key for ECC curves?

I am quite new to cryptography low-level mathematic details, though had worked in the crypto area for 2.5 years before. So if I am wrong about any of below part, please correct me without a facepalm ...
97 views

### Elliptic Curve Key Compression

I have an elliptic curve y2 = x3 -x + 3 over a finite field of 127. I am trying to compress a point using the X9.62 standard. I know for the key compression you are supposed to check if the y value is ...
1 vote
47 views

### How to derive Edwards Point Addition formula

Deriving the addition equation for a Weierstrass curve is simple and straightforward (I started with this video that covers the simple case. If you know the basic derivative rules you can find the ...
1k views

### How are curve names constructed?

I started with the question: Brainpool curves exist in a variant ending in ..r1 and ..t1. What does it mean? But there are also "secp.." and "sect.." just like NIST's "..r1&...
105 views

### Why the trace of the Elliptic curve should be positive?

In https://eprint.iacr.org/2014/130.pdf , has been suggested to select the positive trace. What is the reason for this? What happened if we select the negative trace? Is there any security problem for ...
1 vote
101 views

### How do we compute the CM discriminants without factoring?

In ECC, there is a parameter known as CM discriminants. Suppose that the trace of the curve is $t$ in $Z_p$. The amount of $s^2$ is the largest square dividing $t^2-4p$ then $\frac{t^2-4p}{s^2}$ is a ...
122 views

### CSIDH - l ideal generators

I am trying to study the CSIDH algorithm. I have some beginner background in elliptic curves and I have been following Andrew Sutherland's lectures (https://math.mit.edu/classes/18.783/2019/lectures....
• 143
139 views

### Asymmetric cryptosystems based on curves besides elliptic curves

Elliptic curve cryptography (ECC) has been gaining a lot of popularity recently because of its security. I tend to find the process of encoding plaintext using ECC particularly interesting so I was ...
67 views

### Making commitment scheme on elliptic curves perfectly binding

So, the question is, a commitment scheme on elliptic curve is given. Initialisation phase: There is an elliptic curve EC, generator point $G$ over $GF(p)$, which creates a group, and random prime ...
162 views

### Is it safe to implement elliptic curve Diffie Hellman with secp256k1

I need to implement X3DH Key Agreement Protocol according to Signal specification, in the document they suggest using either X25519 or X448 curves. I assume those curves have been chosen for this ...
• 121
1 vote
81 views

### What's the difference between Optimal ate pairing and R-ate pairing?

I compare the algorithm description of Optimal ate pairing and R-ate pairing, it turns out to me that the formulas are the same. So I'm a little confused, what's the difference between them? or is it ...
1 vote
588 views

### How to calculate the order of secp256k1?

The elliptic curve secp256k1 is defined as $y^2 = x^3 + 7$. The prime for the field is set to: ...
• 113
32 views

### (Non)security of algebraically derived EC keys

I recently had a situation where I needed to derive a secondary Curve25519 private key from an existing one programmatically. The obvious solution was to use a KDF, but I wondered at the time about ...
1 vote
128 views

### Verifying result of (EC-)Diffie-Hellman

I received a public key by JSON. For the example, I have 4 keys: 2 public keys and 2 private keys. ...
• 119
62 views

### what does "product of two cyclic groups" mean

I am reading "Elliptic curve cryptosystems" and the link is here（https://www.ams.org/journals/mcom/1987-48-177/S0025-5718-1987-0866109-5/S0025-5718-1987-0866109-5.pdf）. I don't understand ...
139 views

### Asymmetric encryption scheme with the shortest output for encrypting 1 byte of information

Imagine that one needs to periodically encrypt very short messages (i.e., a boolean Yes/No, a single byte, or 3-4 bytes in the worst case). We assume that there is no session, and we just need to ...
140 views

### ECC Point Addition on Jacob coordinate -- Not Commutative?

I have a python script that does the ECC point addition (code paste below), it simply performs the P =Q1+Q2 on Jacob coordination. However, when doing some regression tests, I found that if I exchange ...
• 111
82 views

### Why is the cofactor of the twisted Edwards curve equal to 8?

While The cofactor of the Edwards curve is chosen $4$ in standards, the cofactor of the twisted Edwards curve is chosen $8$. I can't understand the reason for this. Can we choose cofactor $4$ for the ...
3k views

### Why are NIST curves still used?

I'm relatively new to the world of crypto (But as far as the math goes, I am familiar with the inner workings. I used to rarely use it for privacy, but now I use it for many things). Anyway, I was ...
• 203
280 views

### How to calculate the n in n-bit security of a crypto algorithm?

I think I'm likely missing the term because searching for this is coming up with not so precise results. I'm looking to calculate the n-bit security of say Paillier vs ElGamal vs EC ElGamal, when I ...
• 155
1 vote
87 views

### How to determine whether a point is greater than n/2?

How can we determine if a private key associated with a point, on an EC, is less than or greater than 1/2 $n$, where $n$ is the order?
709 views

### How to determine if a point is just a point or a valid public key?

In ECC, specifically over finite fields, in my mind there must be other points that exist that still yield $y^2 \bmod p=x^3 + ax + b \bmod p$ to be true but are never used because the Generator Point (...
136 views

### What properties do elliptic curves possess that make them useful?

I tried to learn the algorithmic process behind ECDSA and it's pretty challenging. I'm wondering what motivation or thought process might have led to the discovery in the first place. What properties ...
• 131
252 views

### Elliptic curve bilinear pairing parameters for 80-bit security level

I am reading a paper based on elliptic curve bilinear pairing groups. The author has defined the size of private key, public key etc in terms of $|\mathbb{G}_1|, |\mathbb{G}_2|$ and $|\mathbb{G}_T|$. ...
318 views

### Digital Signatures with Curve25519 key-pair

I have a public/private key pair of Curve25519 keys used by Wireguard. How can I use this keypair to generate/verify digital signatures? Preferrably, I would like to use EdDSA/Ed25519 but I struggle ...
78 views

### Can we reverse elliptic curve function mul?

I have an elliptic curve system with only one point P. Let's say the client A and server B generate a secret R1 and R2. A is sending X1 = mul(R1, P) to B and B is sending X2 = mul(R2, P) to A then ...
46 views

### Can the result of a multiplication between an elliptic curve and a scalar not be on the curve?

As the title says, we have an elliptic curve, doesn't matter which one, say p256. We choose any scalar. Can the multiplication of a point on curve with the scalar result in a point that is not on ...
102 views

### Composite order ECC and Ristretto

I've been looking at the Ristretto group, and its really cool. I understand that, for some protocols, we need curve points to behave as if they were from a prime order curve. I have a few questions on ...
• 1,284
81 views

### Cryptographic invariant maps

In [BGK+18] in section 4, Boneh et al. write that: For any choice of ideal classes $\mathfrak{a}_1,\dots,\mathfrak{a}_n,\mathfrak{a}_1',\dots,\mathfrak{a}_n'$ in ${Cl}(\mathcal{O})$, the abelian ...
• 173
1 vote
130 views

154 views

• 419
1 vote
177 views

### Finite field Elliptic Curve line intersection

I want to find the curve points that intersects an arbirtary line, not just tangent line or a line through curve points. An example: ...
• 111
1 vote