Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

208 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
1
vote
0answers
135 views

Using ECC CDH test vectors with ECDH when h >1

I am writing formal tests for a system with a number of crypto requirements including support for ECDSA, ECDH and HMAC. The system is required to support the following EC's: NIST curves P-224, 384, ...
1
vote
0answers
118 views

How to find kernel of isogeny from the dual isogeny

Let $E$ be a supersingular elliptic curve over $\mathbb{F}_{p^2}$, where $p = \ell_A^{e_A} \ell_B^{e_B} f \pm 1$ for some primes $\ell_A, \ell_B$. Let $R \in E[\ell_A^{e_A}]$ be a point of order $\...
1
vote
0answers
68 views

Elliptic curve discrete logarithm problem

I'd like to know what is the maximum bits of the finite field that we can solve the ECDLP in a "regular" computer in trivial time. Is there any recent data about this?
1
vote
0answers
55 views

EC threshold private key's multiplicative inverse and derived-key sharing

I have two devices, and each has a private key xPriv-i. Each device computes the corresponding EC public key xPub-i, shares it, and the linear combination of the keys is the "real" public key xPub. ...
1
vote
0answers
62 views

How to know if a point on a discrete elliptic curve be represented uniquely using its y-coordinate?

Let's say we have a point on an elliptic curve $p=(x, y)$ which is not the point-at-infinity. Can there be some other point $\hat{p} = (\hat{x}, y)$ that is also on the curve and that has the same y-...
1
vote
1answer
83 views

Ensure Data Integrity In An ECDH Key Excange

Been playing around with the inner workings of onion routing and I have a problem. If I wanted to send the 2nd node of a relay network an ephemeral ECC public key, it has to go through node 1, so that ...
1
vote
0answers
366 views

GPG implementation of ECC “Encryption” (ECDH) vs RSA

My understanding of GPG with traditional RSA keys, is that RSA is by definition can be used to both sign and encrypt. This is because RSA can be directly applied to plaintext in the following form: <...
1
vote
0answers
291 views

ECC with 512bit compatible curves

I understand that given solutions for solving a discrete logarithm problem are on the order of đť‘‚(2đť‘›/2), ergo, 256bit private keys based on 25519 or secp256k1 have an effective bit strength of ...
1
vote
0answers
52 views

short signature for EC

i'm building a low-power wireless sensor network in which each slave node has a public/private ECC key pair -- generated by the node itself during manufacturing.... the slave node is also provisioned ...
1
vote
0answers
114 views

How do pairings behave on G2/twist points off the prime order subgroup?

$\newcommand{\F}{\mathbb{F}}$ Consider the ate pairing defined on a curve $G_1 = E(\F_q)$ and $G_2 = E'(\F_{q^r})$ where $E'$ is a twist of $E$ with the twisting isomorphism defined over $\F_{q^r}$. ...
1
vote
0answers
66 views

ECDSA - why is the first part of the signature used in the second?

Using the terminology of https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm Why is the second part of the ECDSA signature defined as: $s = k^{-1}(z+rd_A)\text{ mod n}$ ...
1
vote
0answers
71 views

Why doesn't the JOSE suite/JWA include ECIES?

The JOSE suite specifics use of RSA-OAEP (for when one party has an RSA key) and ECDH (for when two parties have EC keys) in JWA. Why doesn't it include ECIES? It seems like a way to derive a key ...
1
vote
0answers
107 views

Reason for including the public key of the key agreement in the KDF

I found the following text when looking up KDFs: In comparison, the so-called DHAES mode in IEEE 1363a mandates to use the binary representation of the sender’s public key as an input parameter. ...
1
vote
0answers
102 views

Patterns in elliptic curve division polynomials

While looking at division polynomials of elliptic curves in relation to this and this questions, I noticed some patterns. I am wondering if anyone knows of general formulas the describe these patterns....
1
vote
0answers
53 views

Is it necessary to transmit two or three points of an elliptic curve?

Are there cryptographic protocols, where a party should transmit by communication channel simultaneously two or three $\mathbb{F}_q$-points of an elliptic curve over a finite field $\mathbb{F}_q$? ...
1
vote
1answer
188 views

Authentication protocol for communication with Arduino Uno

I am using an ECDH key exchange to establish a shared secret between an Arduino Uno and an Android device. For this purpose I am using this library and more specifically Curve25519. This is the ...
1
vote
0answers
116 views

Security of BLS under additional information on the secret key

Question A Is the BLS signature scheme still secure if an adversary in addition to the public key $ pk = g_2 \, sk \in \mathbb{G}_2 $ also obtains additional information on the private key $ sk $, ...
1
vote
0answers
57 views

HW wallet and multisignaters in ECC

I need to design a system where there is a secure device (a.k.a. HW wallet), with the following functionality: Deterministic key generation for key parameters (speaking simply: key ID). Never expose/...
1
vote
0answers
58 views

What does the absence of Abelian group actions on supersingular isogenies implicate?

There are no Abelian group actions on supersingular isogenies. Why does this make them secure? - motivated by De Feo's Paper on mathematics of IBS
1
vote
0answers
47 views

Preserving location privacy

What are cryptographic techniques that could be used so that if I wanna to enable a server to send message to certain nodes in a network with preserving the privacy location for them ??
1
vote
0answers
56 views

What should I change in my implementation to pass from a curve $y^2=x^3+1$ to $y^2=x^3+x$

I tried to change my implementation of pairing in curves $y^2 = x^3 + 1$ to use curves of the type $y^2 = x^3 + x$ but it didn't work. I thought the only thing I had to change in my code was the ...
1
vote
0answers
386 views

ECC Curve25519: How to generate this kind of private key? / Strange key exchange mechanism

I'm currently reverse engineering a program that uses Curve25519 key exchange in network communication. I have only a basic understanding of ECC, so maybe this thing just seems strange to me. The ...
1
vote
0answers
151 views

Implementing key mapping across different elliptic curves

From this answer I understood how to prove key equivalence across two elliptic curves. Now, I'm trying to figure out some more practical aspects of implementing this. Before jumping into questions, ...
1
vote
0answers
145 views

Elliptical Curve Cryptography benchmark test

I have built web app that implement Elliptical Curve Cryptography. During testing using data set that i chose on my own, it already run well.. But, for now, i want to test it in some benchmark test, ...
1
vote
0answers
18 views

what does the m parameter in XML Signatures for gnBasis characteristic-two curves represent?

https://www.w3.org/TR/xmldsig-core/#sec-ECParameters defines the same three characters two-field basis's that http://www.secg.org/sec1-v2.pdf#page=107 defines: GN (Gaussian Normal, I guess) TP (...
1
vote
0answers
183 views

trying to understand the elliptic curve format for XML Signatures

https://www.w3.org/TR/xmldsig-core/#sec-ECKeyValue gives the following example of an ECDSA key: ...
1
vote
0answers
44 views

Can someone give me an idea of active areas relating to pairing based cryptography, and what they involve?

Apologies if this isn't the place to ask this question. I'm an undergraduate math student and I've been reading about elliptic curves. I've learned about the Weil and Tate pairings as well as Miller's ...
1
vote
0answers
43 views

What's wrong with this construction? ECDHE+AES

Let's say I want to use ECs to do asymmetric encryption. Suppose both sides have generated EC keypairs and have exchanged their public keys. I run ECDHE, and get a derived secret. I would then either ...
1
vote
0answers
140 views

How can I split a packed Ed25519 public signing key into its X and Y coordinates?

I'm using the Curve25519 code (from http://www.dlbeer.co.nz/oss/c25519.html), and trying to convert from a public signing key (Edwards form) to a public key-exchange key (Montgomery form). There's ...
1
vote
0answers
62 views

how researchers extract encryption times when randomness is involved?

I have seen some research papers where they compare encryption/signature times on elliptic curves.But when i have implemented the algorithms and calculated encryption times but each time i get some ...
1
vote
0answers
115 views

Lower bound for the size of prime factors?

We all know classic RSA and that we should pick moduli of at least 2048-bit length to get decent (112 bit) security. Now there's also multi-prime RSA, which can yield significant speed-ups using the ...
1
vote
0answers
195 views

Isomorphic curve vs isomorphic curve group

It is said that if two elliptic curves $E_1, E_2$ defined over a finite field $K$ are isomorphic, then $E_1(K), E_2(K)$ groups are also isomorphic. But the converse is not true. Now, By definition, ...
1
vote
0answers
314 views

How Elliptic Curve equation is chosen?

We all know the basic equation of Elliptic Curve is $y^2 \equiv x^3 + ax + b \pmod p$ How the value of the constants $a$ and $b$ are chosen? Suppose $\mathbb P\ni p \approx 2^{256}$ then what ...
1
vote
0answers
94 views

Caculated time One Point Multiplication with double and method

I am using double and add method for point multiplication in affine coordinates. How we compute 1PM in double and method? Di Wang said one point multiplication consists of repeated addition and ...
1
vote
0answers
282 views

Example of Projective Coordinates

Given the affine form of coordinates $(x,y)$ such as $(5,3)$, if I want to convert $(5,3)$ to projective coordinates $(x,y,z)$, should the form of point be $(5,3,1)$? It is triplet not a point, right? ...
1
vote
0answers
104 views

What is th purpose of m and q in elliptic curve cryptography protocols?

In crypto protocols that contains calculus on elliptic curves I can often see $\dfrac{m}{q}$$Q$ where $m$ stands for order of EC points group and $q$ is the order of corresponding subgroup of $m$. $Q \...
1
vote
0answers
65 views

Is it possible to re-generate ECPublic key from raw private key and curve params?

As per my understanding, in Elliptical curve cryptography, the EC PrivateKey is nothing but a bigInteger value. If you know the curve specs and you have this private BigInteger value (which I am ...
1
vote
0answers
134 views

Cryptographic operations for NISTP256 can be implemented using montgomery method?

I need to implement cryptographic operations starting with the curve NISTP256. I have been told to implement it using Montgomery method. I read a pfd from http://saluc.engr.uconn.edu/refs/sidechannel/...
1
vote
0answers
52 views

How to find the integer multiplicand from given two points?

I have two points on an elliptic curve $P(x_1,y_1)$ and $Q(x_2,y_2)$ and a scalar value $x$, where $P=x \cdot Q$. What is the best way that I could figure out the value of $x$? Given that I know all ...
1
vote
0answers
109 views

Where can I find a versatile PKI and library leveraging curve25519?

I note that Things that use Curve25519 provides a long list of protocols, software, and libraries that leverage curve25519, but I'm wondering if there is any such software that more fully implements a ...
1
vote
0answers
173 views

What is the hardness in Decisional Linear Assumption (DLIN)?

I had understood what does the DLIN assumption means and here is a related question. But I fail to understand the 'real hardness' in this problem. I would be grateful if someone can help me to ...
1
vote
0answers
217 views

Clarify EC point addition and multiplication

Please clarify the below doubt regarding EC point addition and multiplication: $P$-Generator Point; $a$ and $b$ are integers; $X$ and $Y$ are EC points, defined as follows: $X = (a*P) + (b*P)$ $Y = (...
1
vote
0answers
250 views

Elliptic curve point addition

I have this curve in $E(\mathbb{F}_{131})$: $$Y^2 = X^3 + X + 2$$ I want calculate the sum $P + Q$ considering that $$P= (5,1) \quad Q = (60, 49)$$ For calculating the result I use these formulas: $...
1
vote
0answers
185 views

EC based password authenticated key exchange protocol

I would like to know: What is the currently best (efficiency and security wise) known EC based password authenticated key exchange protocol? (i.e. is there any EC based protocol may be similar to DH ...
1
vote
0answers
168 views

Is there any pattern in points on EC?

I read some where in crypto.stackexchange answer (related to EC-SRP protocol) that there is pattern in points on elliptic curves, i.e. if given some points containing mix of correct and wrong points ...
1
vote
0answers
535 views

How represent message in Menezes–Vanstone elliptic curve cryptography

I ask about represent message in Menezes–Vanstone elliptic curve cryptography I now encrypt function as follow $C_1 = (M_1 * K_1) mod\ P$ $C_2=(M2 * k_2) mod\ P$ My question is about how much the ...
1
vote
0answers
117 views

DLOG in $\mathbb{F}_{p^n}^*$?

Assume that we are given an element $g\in \mathbb{F}_{p^n}^*$ and $g$ does not belong to any of the smaller subfields contained in $\mathbb{F}_{p^n}$. If the degree of $g$ is some number $q$, how much ...
1
vote
0answers
125 views

advantages of hashing over elliptic curve signatures for a proof of work protocol

I'm trying to create a proof-of-work protocol for a proof-of-concept software, and it's basically something like this: ...
1
vote
0answers
249 views

Which mathematical operations does secp256k1 point multiplication use?

To convert a bitcoin private key to a public key, the secp256k1 point multiplication math is used. Could I – theoretically – convert a private key to a public key just using the four arithmetic ...
1
vote
0answers
233 views

ECC cryptography with shorter signature when not needing high security?

I am new here and fairly new to cryptography, so if I say something wrong, let me know. I am trying to set up a system where a user can receive a temporary license key over the phone, put it into ...