Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

242 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
1
vote
0answers
29 views

Schnorr Protocol Implementation - Sometimes Fails on Curve25519

I am implementing the Schnorr Protocol in python and am having reliability issues when using some curves. I am wondering if this is an issue with my logic, or some implementation issue. I am using ...
1
vote
0answers
44 views

Is this good way of Elliptical curve point mapping

Mapping a bit string $L$ to elliptical curve point in say prime field $\mathbb Z_p$. A simple way would be to use an integer mapping function that maps $L$ to a number $\{1, q\}$ where $q$ is the ...
1
vote
0answers
63 views

How does one go about implementing a range proof?

I've attempted to find a solution to this problem, but for the life of me I am unable to. I am attempting to solve whether a point an elliptic curve of prime order is between 2 points, given a ...
1
vote
0answers
65 views

SafeCurves verification script

The SafeCurves project provides a Sage script to verify the SafeCurves criteria for given curves, https://safecurves.cr.yp.to/verify.html According to the description, the script works simply as: $ ...
1
vote
0answers
68 views

Elliptic curve subgroup with $p$ elements in field of characteristic $p$

Are there any elliptic curves defined over a finite field $\mathrm{GF}(p^k)$ with a subgroup of order $p$ where the discrete log (and preferably DDH) problem is hard? Elliptic curve with prime ...
1
vote
0answers
50 views

Schoofs Algorithm

I studied Schoofs Algorithm described by Washington. On page 125 he says that we could write $y'/y$ as a function of $x$, which makes sense since earlier on the page he denotes $y'= r_{2,j}(x)y$. But ...
1
vote
0answers
50 views

Example for point addition using Jacobi transformation and small integers

This video explanation is great because it shows an example using small numbers, if it wasn't for that example my code would be wrong. Still: the code takes 0.5 seconds to calculate 300 point ...
1
vote
0answers
71 views

Pohlig-Hellman on ECDLP over extension field $\mathbb{F_p}^6$

Suppose there is an elliptic curve $E$ in form $y^2=x^3+b$ defined over $\mathbb{F_p}$, where $p$ is large prime. #$E(\mathbb{F_p})$ is also a large prime but #$E(\mathbb{F_p})\ne p$. ECDLP on this ...
1
vote
0answers
32 views

How do Edward curves scale better in computation time compared to Weierstrass curves?

I see people talk about Edward curves (when I discuss Ed25519) as better curves than Weierstrass for computations. Now I get that Edward curves have the nice addition formula, but if we have a ...
1
vote
0answers
41 views

Non-interactively share secret with group without revealing to generator?

Imagine someone knows a set of $n$ ECC public keys $\mathcal R = \{K_1, K_2, ... K_n\}$ but they don't know the corresponding private keys $k_1$, $k_2$ ... $k_n$. They wish to create a public key $sG$ ...
1
vote
0answers
59 views

How many 2-torsion points in an elliptic curve?

N torsion points have the structure ker([n]) ≅ Zn×Zn , so ker([2]) ≅ Z2×Z2 , gives us 3 2-torsion points. but ker([4]) ≅ Z4×Z4 ,this means we have 5 subgroup of order 4 . In each subgroup , there is ...
1
vote
0answers
34 views

Determining order of the group for an elliptic curve defined over a finite field

I need to find out the order of the group for an elliptic curve. See the image for the question. The inequality condition after simplification leads to $-2 \sqrt{p} \leq m \leq2 \sqrt{p}.$ Also, the ...
1
vote
0answers
49 views

How to maintain the width of the cipher image in ECC Image Encryption from Singh and Singh (2015)?

I am a beginner in cryptosystems and I hope I would be accepted in the community. I was trying to implement Singh and Singh (2015) ECC image encryption algorithm on Matlab. I have been able to ...
1
vote
0answers
76 views

How to Reduce a Quaternion Ideal into Power Smoothness?

(TL;DR) How exactly do we reduce a quaternion ideal into another powersmooth one? Given a supersingular elliptic curve, it is known that its endomorphism ring is non-commutative. Specifically, there ...
1
vote
0answers
56 views

How to find Y on an elliptical curve in a finite field?

For example, let's use secp256k1, the curve used by bitcoin, y^2 = x^3 + 7, and x=12. Over the real numbers, that calculation is trivial - I can simply use a calculator. But in a finite field, how ...
1
vote
0answers
82 views

Elliptic Curve (Point Counting)

I am studying elliptic curves in particular point counting. If I have coordinates P and 2P, is there a way to calculate the total points in between P and 2P using either curve parameters or algorithm? ...
1
vote
0answers
33 views

Pair-friendly elliptic curves vs non friendly

Group law operations on pair-friendly elliptic curves are slower than in non friendly elliptic curves, but how much slower? Can't seem to find a performance comparison between the two for a given ...
1
vote
0answers
91 views

is forward secrecy irrelevant for non-streaming applications?

I asked a question yesterday about the Keybase key model and got no answers, unfortunately. Let me rephrase the question to make it clearer: in the case, if 2 users just want to send each other low-...
1
vote
0answers
68 views

Verifying the ownership of curve25519 public keys

Let's say we have a group of users, authenticated by a server that providers the service, communicating on a secure channel (e.g. over HTTPS/TLS) and each user has a corresponding curve25519 key pair. ...
1
vote
0answers
64 views

Need help understanding SPAKE2 setup values

I am trying to write a simulation of the SPAKE2 protocol in python (just so I can get a better understanding of the protocol altogether). I am reading through the ietf draft here: Datatracker. There'...
1
vote
0answers
202 views

Using ECC CDH test vectors with ECDH when h >1

I am writing formal tests for a system with a number of crypto requirements including support for ECDSA, ECDH and HMAC. The system is required to support the following EC's: NIST curves P-224, 384, ...
1
vote
0answers
145 views

How to find kernel of isogeny from the dual isogeny

Let $E$ be a supersingular elliptic curve over $\mathbb{F}_{p^2}$, where $p = \ell_A^{e_A} \ell_B^{e_B} f \pm 1$ for some primes $\ell_A, \ell_B$. Let $R \in E[\ell_A^{e_A}]$ be a point of order $\...
1
vote
0answers
74 views

Elliptic curve discrete logarithm problem

I'd like to know what is the maximum bits of the finite field that we can solve the ECDLP in a "regular" computer in trivial time. Is there any recent data about this?
1
vote
0answers
65 views

EC threshold private key's multiplicative inverse and derived-key sharing

I have two devices, and each has a private key xPriv-i. Each device computes the corresponding EC public key xPub-i, shares it, and the linear combination of the keys is the "real" public key xPub. ...
1
vote
0answers
67 views

How to know if a point on a discrete elliptic curve be represented uniquely using its y-coordinate?

Let's say we have a point on an elliptic curve $p=(x, y)$ which is not the point-at-infinity. Can there be some other point $\hat{p} = (\hat{x}, y)$ that is also on the curve and that has the same y-...
1
vote
1answer
92 views

Ensure Data Integrity In An ECDH Key Excange

Been playing around with the inner workings of onion routing and I have a problem. If I wanted to send the 2nd node of a relay network an ephemeral ECC public key, it has to go through node 1, so that ...
1
vote
0answers
585 views

GPG implementation of ECC “Encryption” (ECDH) vs RSA

My understanding of GPG with traditional RSA keys, is that RSA is by definition can be used to both sign and encrypt. This is because RSA can be directly applied to plaintext in the following form: <...
1
vote
0answers
418 views

ECC with 512bit compatible curves

I understand that given solutions for solving a discrete logarithm problem are on the order of 𝑂(2𝑛/2), ergo, 256bit private keys based on 25519 or secp256k1 have an effective bit strength of ...
1
vote
0answers
59 views

short signature for EC

i'm building a low-power wireless sensor network in which each slave node has a public/private ECC key pair -- generated by the node itself during manufacturing.... the slave node is also provisioned ...
1
vote
0answers
67 views

ECDSA - why is the first part of the signature used in the second?

Using the terminology of https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm Why is the second part of the ECDSA signature defined as: $s = k^{-1}(z+rd_A)\text{ mod n}$ ...
1
vote
0answers
76 views

Why doesn't the JOSE suite/JWA include ECIES?

The JOSE suite specifics use of RSA-OAEP (for when one party has an RSA key) and ECDH (for when two parties have EC keys) in JWA. Why doesn't it include ECIES? It seems like a way to derive a key ...
1
vote
0answers
110 views

Reason for including the public key of the key agreement in the KDF

I found the following text when looking up KDFs: In comparison, the so-called DHAES mode in IEEE 1363a mandates to use the binary representation of the sender’s public key as an input parameter. ...
1
vote
0answers
129 views

Patterns in elliptic curve division polynomials

While looking at division polynomials of elliptic curves in relation to this and this questions, I noticed some patterns. I am wondering if anyone knows of general formulas the describe these patterns....
1
vote
0answers
56 views

Is it necessary to transmit two or three points of an elliptic curve?

Are there cryptographic protocols, where a party should transmit by communication channel simultaneously two or three $\mathbb{F}_q$-points of an elliptic curve over a finite field $\mathbb{F}_q$? ...
1
vote
1answer
221 views

Authentication protocol for communication with Arduino Uno

I am using an ECDH key exchange to establish a shared secret between an Arduino Uno and an Android device. For this purpose I am using this library and more specifically Curve25519. This is the ...
1
vote
0answers
126 views

Security of BLS under additional information on the secret key

Question A Is the BLS signature scheme still secure if an adversary in addition to the public key $ pk = g_2 \, sk \in \mathbb{G}_2 $ also obtains additional information on the private key $ sk $, ...
1
vote
0answers
57 views

HW wallet and multisignaters in ECC

I need to design a system where there is a secure device (a.k.a. HW wallet), with the following functionality: Deterministic key generation for key parameters (speaking simply: key ID). Never expose/...
1
vote
0answers
59 views

What does the absence of Abelian group actions on supersingular isogenies implicate?

There are no Abelian group actions on supersingular isogenies. Why does this make them secure? - motivated by De Feo's Paper on mathematics of IBS
1
vote
0answers
50 views

Preserving location privacy

What are cryptographic techniques that could be used so that if I wanna to enable a server to send message to certain nodes in a network with preserving the privacy location for them ??
1
vote
0answers
56 views

What should I change in my implementation to pass from a curve $y^2=x^3+1$ to $y^2=x^3+x$

I tried to change my implementation of pairing in curves $y^2 = x^3 + 1$ to use curves of the type $y^2 = x^3 + x$ but it didn't work. I thought the only thing I had to change in my code was the ...
1
vote
0answers
443 views

ECC Curve25519: How to generate this kind of private key? / Strange key exchange mechanism

I'm currently reverse engineering a program that uses Curve25519 key exchange in network communication. I have only a basic understanding of ECC, so maybe this thing just seems strange to me. The ...
1
vote
0answers
157 views

Implementing key mapping across different elliptic curves

From this answer I understood how to prove key equivalence across two elliptic curves. Now, I'm trying to figure out some more practical aspects of implementing this. Before jumping into questions, ...
1
vote
0answers
148 views

Elliptical Curve Cryptography benchmark test

I have built web app that implement Elliptical Curve Cryptography. During testing using data set that i chose on my own, it already run well.. But, for now, i want to test it in some benchmark test, ...
1
vote
0answers
18 views

what does the m parameter in XML Signatures for gnBasis characteristic-two curves represent?

https://www.w3.org/TR/xmldsig-core/#sec-ECParameters defines the same three characters two-field basis's that http://www.secg.org/sec1-v2.pdf#page=107 defines: GN (Gaussian Normal, I guess) TP (...
1
vote
0answers
206 views

trying to understand the elliptic curve format for XML Signatures

https://www.w3.org/TR/xmldsig-core/#sec-ECKeyValue gives the following example of an ECDSA key: ...
1
vote
0answers
44 views

Can someone give me an idea of active areas relating to pairing based cryptography, and what they involve?

Apologies if this isn't the place to ask this question. I'm an undergraduate math student and I've been reading about elliptic curves. I've learned about the Weil and Tate pairings as well as Miller's ...
1
vote
0answers
43 views

What's wrong with this construction? ECDHE+AES

Let's say I want to use ECs to do asymmetric encryption. Suppose both sides have generated EC keypairs and have exchanged their public keys. I run ECDHE, and get a derived secret. I would then either ...
1
vote
0answers
167 views

How can I split a packed Ed25519 public signing key into its X and Y coordinates?

I'm using the Curve25519 code (from http://www.dlbeer.co.nz/oss/c25519.html), and trying to convert from a public signing key (Edwards form) to a public key-exchange key (Montgomery form). There's ...
1
vote
0answers
62 views

how researchers extract encryption times when randomness is involved?

I have seen some research papers where they compare encryption/signature times on elliptic curves.But when i have implemented the algorithms and calculated encryption times but each time i get some ...
1
vote
0answers
122 views

Lower bound for the size of prime factors?

We all know classic RSA and that we should pick moduli of at least 2048-bit length to get decent (112 bit) security. Now there's also multi-prime RSA, which can yield significant speed-ups using the ...