Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

236 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
2
votes
0answers
77 views

How hard is it to link a hardened BIP32 child public key to it's parent public key?

The BIP32 spec says this in the security section: ...
2
votes
0answers
72 views

Elliptic curve of order $p = 2q + 1$

Does anyone know an example of an Elliptic Curve of caracteristic $p$ ($E_p$) that has a point generator $G$ that generates a subgroup of order $q$, with $p$, $q$ being prime numbers and $p = 2q + 1$?
2
votes
0answers
34 views

About the scalar multiplication on Koblitz curve in FIPS PUB 186-4 (2013)

In FIPS PUB 186-4, the computation of scalar multiplication on Koblitz curves is given in p.106~109. In p.109, step 11.3, $(r_0,r_1)$ is updated with $(r_1+\mu\,r_0/2,-r_0/2)$. But under ...
2
votes
0answers
79 views

Shamir three-pass protocol Elliptic Curve

I want to know how I can implement this protocol. I know how Shamir three pass protocol operates without elliptic curve, but I don't know how I can perform it with elliptic curve. I read about this ...
2
votes
0answers
105 views

Trying to understand Keybase's key model and replacing PGP with device keys

I am exploring Keybase and I thought it was merely a wrapper for gpg and connecting its public key with social accounts (e.g. github, twitter, etc...). But after reading the very short and unclear ...
2
votes
0answers
123 views

Security of an Elliptic Curve Public Key with a “Small” x-coordinate

Consider an elliptic curve over a finite field $F_p$ with $p$ prime and order $n$. Let $Q$ be a generator for the field. Given a public key point $P = aQ$, suppose we have an algorithm that finds an ...
2
votes
0answers
58 views

Security strength of JPBC Type A curve compared to SecP curve

I recently encountered some problems when learning about the JPBC library. Does the curve generated by (J)PBC using the method typeAcurvegenerator(160,512) and the ...
2
votes
0answers
68 views

ECC - complex multiplication and key agreement

I'd like to ask three questions - 2 of them regard CM method. The last is regarding the ECC domain parameters generation on the fly, see https://eprint.iacr.org/2015/647.pdf What role has ...
2
votes
0answers
356 views

Proving that a point on elliptic curve is smaller than half of group's order

Let's say I have an elliptic curve where generator $G_1$ has prime order $q$. Let's also say I have committed to a point $A_1 = a \cdot G_1$. Could I use the scheme below to prove that $a < \frac{q}...
2
votes
0answers
63 views

Proving key equivalence across different elliptic curves

We can use the technique described in this answer to prove key equivalence across two elliptic curves of different order. I'm wondering if modifying the technique as described below would compromise ...
2
votes
0answers
494 views

j-invariant of an elliptic curve

Given an elliptic curve $(E/\mathbb{K})$ where $char(\mathbb{K}) \ne 2,3$ defined by the Weierstrass equation $y^2=x^3+ax+b$. The $j$-invariant is $j=1728 \frac{4a^3}{4a^3+27b^2}$. I want to ...
2
votes
0answers
56 views

Is my way safe to remove SSL CA Cert by DHT and PoW NodeID for a decentralized system?

To implement a decentralized system, I wrote a TLS like P2P net stack. The main idea is removing CA Cert from the whole system by using a DHT for Naming and Key Exchange. I am not a crypto expert, so ...
2
votes
0answers
205 views

Creating ECC Signature - Is “R” necessary in calculating “S”

After going through the mathematical proof in confirming ECDSA, it doesn't seem apparent to me that "R" is necessary in calculating "S" for the signature. In other words, what's the problem with ...
2
votes
0answers
228 views

What standards of ECC point compression exist?

The method that I used before to decode EC point from public key led me in a dead end. So I just want to know what yet I could try. I've got a public key that I don't know how to decode and I am ...
2
votes
0answers
186 views

Is EC El Gamal the only option?

This question is related to the question I asked here. I'm looking for encryption scheme with the following properties: Given $m$ is a 256-bit value, $pub_a$ and $pub_b$ are public keys, and $priv_a$ ...
2
votes
0answers
68 views

Asymmetric encryption property required in an authentication protocol

We want to choose an asymmetric encryption scheme for use as follows: A device holds its private key, with the corresponding public key known and trusted by all. The device also holds a small $b$-bit ...
2
votes
0answers
744 views

What ECDSA key is used to sign the ECDHE key exchange?

I have a server using TLS1.2 with an ECDSA certificate using secp256r1. The algorithms being used to connect to my browser are TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 as I expect from my server ...
2
votes
0answers
122 views

Group signature Elliptic curve

I have been doing some research in group and ring signature literature. I am trying to find a ring/group signature which provide the following propriety: Anonymity for the signer Verifiable by a ...
2
votes
0answers
249 views

What pairings are used in PBC and charm-crypto with the proposed elliptic curves?

I'm implementing a pairing-based signature scheme using Charm Crypto and PBC, and I'm struggling to understand the relationship between the curves proposed for use with pairings and the pairings ...
2
votes
0answers
375 views

Frey-Rück Attack (FR-Reduction) - Tate Pairing

I am trying to understand the Frey-Rück attack and found different ways of a possible implementation. Since I am not yet very familiar with the Tate-Lichtenbaum pairing and the theory of divisors I ...
2
votes
0answers
56 views

Efficiently formatting data so that each byte is critical

I'm experimenting with implementing a Fair Exchange Protocol that assumes there is a trusted third party to provide a hash-checksum of the two files for each missing byte, (so that the exchange can ...
2
votes
0answers
275 views

How are Zhang-Safavi-Susilo signatures short?

ZSS signatures have been introduced by Fangguo Zhang, Reihaneh Safavi-Naini, and Willy Susilo: An Efficient Signature Scheme from Bilinear Pairings and Its Applications, in proceedings of PKC 2004. ...
2
votes
0answers
86 views

Is discrete log as hard when given same challenge in both pairing groups, in the case of BN curve and its sextic twist

This is a special case of the question Generalization of the DL-assumption in bilinear group pair, that wasn't answered. Suppose $G_1$ is a BN curve over $F_q$. That is the set of elements $(x,y)\in ...
2
votes
0answers
206 views

Finding the largest gap between the x coordinates of all points on an elliptic curve

Till now all we know is Hasse's theorem, which states that $|\#E(p)-(p+1)| \leq 2\sqrt{p}$, where $\#E(p)$ is the total number of points in $E_p(a,b)$. Is there any other theorem which defines ...
2
votes
0answers
580 views

Feasible attacks on ECRSA cryptosystem

In ECRSA cryptosystem, I want to know the feasible attacks. For illustrations we have two prime $p$ and $q$ such that $p \equiv 2 \pmod 3$, $q \equiv 2 \pmod 3$ and generate key pair as follows: $$n = ...
2
votes
0answers
253 views

Boneh/Franklin Identity based encryption with Tate pairing

Boneh/Franklin developed an identity based encryption scheme based on the Weil Pairing. This algorithm has also been standardised in IEEE P1363.3 . I know that this algorithm can also be implemented ...
2
votes
0answers
260 views

Can we break ECDLP with this machine?

Let $P$ and $Q$ are two points of NIST elliptic curve $E$ (defined over $F_{2^m}$ with prime $m$) and $k$ is a private key such that $k.P=Q$. Also we have a machine that is able to leak some ...
2
votes
0answers
320 views

How to compute projective coordinate Z in elliptic curve cryptography?

I was working on affine coordinates and struggling with the computation time taken for operations and then I was advised to use projective coordinates so that mul-inverse operation can be avoided Can ...
2
votes
0answers
63 views

Construct points with the same discrete logarithm

Assume we have an elliptic curve $E$ with a Tate (or Ate,...) pairing $G_1 \times G_2 \mapsto G_T$ Now the task is to find $g_1, g_1' \in G_1$ and $g_2, g_2' \in G_2$ such that the discrete logarithm $...
2
votes
0answers
394 views

RSA_DH vs ECDH implementation

In ECDH protocol is possible, naturally, to use the same algorithm for calculate a secret key for both communication parties (Alice and Bob for example). It is possible to design also a same algorithm ...
2
votes
0answers
145 views

Generating interactive, secure multiple ECC key pairs deterministically

In Elliptic Curve Cryptography (ECC) assuming user A has a private public key pair of $S$, $P$ accordingly with generator point $G$ which as we know is: $$P=S*G$$ Assuming that user A wants to ...
2
votes
0answers
376 views

Type G Bilinear Pairings

I was reading PBC and its implementations for finding pairing parameters. I am particularly interested in implementing a BLS signature scheme with 20-byte (160-bit) signatures ("short signatures"). So,...
2
votes
0answers
208 views

Hardware Implementation of Pairing over BN curves

I am in the middle of FPGA based Hardware architecture design for the computation of Pairing (particularly R-ate Pairing) over BN curves. Where, the point addition, and point doubling should be ...
2
votes
0answers
110 views

Reliability of a single-pass deniable authentication protocol?

I look for one-pass deniable authentication protocol with a short message payload for my project and find a solution: ...
2
votes
0answers
381 views

Defending hybrid encryption schemes against padding oracle attacks

I intend to use a generic integrated/hybrid encryption scheme for transmitting information between a client and a server. Key encapsulation: a 128-bit symmetric key is generated and asymmetrically ...
2
votes
0answers
373 views

Known vulnerabilities in (EC-)KCDSA

Does anybody know if there's known vulnerabilities in KCDSA/EC-KCDSA? I have been researching for the past few hours and I haven't found anything. Wikipedia has very limited amount of information and ...
2
votes
0answers
612 views

Where can I find examples of ECC implemented in VHDL?

I am looking into implementing ECDSA signature and ECDH key agreement in a Xilinx FPGA. All the examples I have found of VHDL implementations skip over how to construct the low level ECC primitives (...
1
vote
0answers
72 views

Calculating ECDSA Private Key From Multiple Signatures With Shared k (random nonce)

I've been experimenting with ECDSA signatures and with how the Sony PS3 private key was leaked. Specifically where: $$k = \frac{z_1 - z_2}{s_1 - s_2}$$ $$d_A = \frac{z_1s_2 - z_2s_1}{k(s_1 - s_2)}$$ ...
1
vote
0answers
47 views

Can the subgroup membership problem still be hard in known order subgroup?

For example: Given an elliptic curve $E$ over $\mathbb{Z}_q$, and $\#E(\mathbb{F}_q) = p^2$, where $p$ is a prime. Now given a subgroup $\langle G \rangle$ of $E$, and the order of the subgroup $\...
1
vote
0answers
21 views

what is the probability for an adversary to find the new key after adding new entropy in a group where computational diffie hellman is hard?

Let's say I have an Elliptic curve group $E(\mathbb{F}_q)$ with base Point $G$ and large prime order $n$. Computational Diffie-Hellman is assumed to be hard in that group. $H: \{0,1\}^*\rightarrow \{...
1
vote
0answers
25 views

Signature algorithm for constrained environment, curve25512 already present for ECDH

I'm working in a very constrained (in code size/memory) microcontroller environment where I'll need public key signature verification. The algorithm to be used can be chosen, and there's no ...
1
vote
0answers
31 views

How hard will it be to solve an equation in elliptic curve group/ cyclic group where Discrete Logarithm is hard?

Given an Elliptic curve group $E(\mathbb{F}_q)$ where the Discrete Logarithm Problem (DLP) is hard and a base point $G \in E(\mathbb{F}_q)$ with large prime order $n$, what will be the advantage of a ...
1
vote
0answers
27 views

Schnorr Protocol Implementation - Sometimes Fails on Curve25519

I am implementing the Schnorr Protocol in python and am having reliability issues when using some curves. I am wondering if this is an issue with my logic, or some implementation issue. I am using ...
1
vote
0answers
42 views

Is this good way of Elliptical curve point mapping

Mapping a bit string $L$ to elliptical curve point in say prime field $\mathbb Z_p$. A simple way would be to use an integer mapping function that maps $L$ to a number $\{1, q\}$ where $q$ is the ...
1
vote
0answers
46 views

How does one go about implementing a range proof?

I've attempted to find a solution to this problem, but for the life of me I am unable to. I am attempting to solve whether a point an elliptic curve of prime order is between 2 points, given a ...
1
vote
1answer
56 views

Using Optimal Prime Field in ECC

"Optimal Prime Field is a family of 'low-weight' prime fields that allow for efficient software implementation of all operations requiring a modular reduction, in particular the field-...
1
vote
0answers
63 views

SafeCurves verification script

The SafeCurves project provides a Sage script to verify the SafeCurves criteria for given curves, https://safecurves.cr.yp.to/verify.html According to the description, the script works simply as: $ ...
1
vote
0answers
62 views

Elliptic curve subgroup with $p$ elements in field of characteristic $p$

Are there any elliptic curves defined over a finite field $\mathrm{GF}(p^k)$ with a subgroup of order $p$ where the discrete log (and preferably DDH) problem is hard? Elliptic curve with prime ...
1
vote
0answers
47 views

Schoofs Algorithm

I studied Schoofs Algorithm described by Washington. On page 125 he says that we could write $y'/y$ as a function of $x$, which makes sense since earlier on the page he denotes $y'= r_{2,j}(x)y$. But ...
1
vote
0answers
47 views

Example for point addition using Jacobi transformation and small integers

This video explanation is great because it shows an example using small numbers, if it wasn't for that example my code would be wrong. Still: the code takes 0.5 seconds to calculate 300 point ...