Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

204 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
1
vote
0answers
782 views

inverse of scalar multiplier in ECC

I am learning to use ECC. i got into situation where i have $Q=abG$, where $G$ is the generator of the finite field formed on EC using a prime $p$ modulus and $a$ , $b$ are random numbers. now suppose ...
1
vote
0answers
133 views

$\phi$ function in Dual_EC_DRBG

I am trying to understand the operation of the Dual_EC_DRBG. I'm reading the formal specification (SP 800-90) and can't seem to find a definition of the $\phi$ function used throughout the definition ...
1
vote
0answers
199 views

About Elliptic Curve ElGamal, 3 simple problems I have trouble with

In Elliptic Curve ElGamal, why are a=b=1 always legal for primes whose lengths are no shorter than 11(2) bits long? Is there any reason why the Point at Infinity can always be encoded as (0,0)? ...
1
vote
0answers
179 views

How fast can a wrong decryption key be detected using ECC?

When can a decryption function detect that the ECC key I use for decryption is incorrect? Is it possible to do that during initialization, or does the complete message have to be decrypted to do that?
0
votes
0answers
26 views

Where can I find references to the theory behind PBC library?

I don't know if this is the right place to ask this type of question. Anyway, I'm using PBC library for a project, but I'm a very newbie for what concerns pairing based cryptography. Then I ask some ...
0
votes
0answers
133 views

Fast Extended Euclidean Algorithm in Harley's elliptic curves point counting method

Could you help me with Harley's norm computation algorithm that is based on the Fast Extended Euclidean Algorithm that was suggested by Harley in an email to NMBRTHRY list in 2002 and that described ...
0
votes
0answers
36 views

Elliptic curve group inverse addition in OpenSSL

I am using group P-256 on OpenSSL with C++. My understanding was that, if you have a point $xP$ and then calculate (xP)^(-1) with EC_POINT_invert(group, xP_inv, ctx), then when I calculate: xP + (xP)^(...
0
votes
0answers
23 views

How to estimate the computation overhead of ECDSA?

I am using ECDSA as a digital signature scheme. Using Charm, I got the timing for the multiplication, exponentiation, and pairing operations; they take 0.005, 9, and 4.4 ms respectively. I want to ...
0
votes
0answers
30 views

Can Pedersen commitment be used in pairing groups?

For bilinear groups: $(p,\mathbb{G}_1,\mathbb{G_2},\mathbb{G}_T,e,g_1,h_1,g_2,h_2)$, where $\mathbb{G}_1,\mathbb{G_2},\mathbb{G}_T$ are groups of prime oder $p$. $g_1,h_1$ are generators of $\mathbb{G}...
0
votes
0answers
20 views

Can we use HMQV in an asynchronous setting?

Following the HMQV paper, to perform a key-exchange, Alice ($\hat{A}$) and Bob ($\hat{B}$) perform the following: $\hat{A}$ generates the long-term key pair ($sk_A= a$, $pk_A =g^a$) and the ephemeral ...
0
votes
0answers
111 views

How to multiply Elliptic curve point $S = (7 + 257 \times u, \space 258 + 21845 \times u) (\bmod 257^2 )$ on curve $y^2 = x^3 + 23\times x + 11$?

First of all I'm not good at English. Hope you will understand my question. In the paper 'Lifting and Elliptic Curve Discrete Logarithms' by Professor J. H. Silverman I found this example. Example ...
0
votes
0answers
32 views

When connecting via SSH, does the Diffie-Hellman key exchange take place over an unencrypted TCP session or does encryption occur before the exchange?

I'm a cybersecurity student and I'm eager to understand the basic processes of an SSH session. I wrote down the stages to the best of my ability but need help understanding what happens right after ...
0
votes
1answer
87 views

ECCS: Elliptic Curve Cryptography Cramer Shoup

Introduction I know how to do Cramer-Shoup with cyclic groups. But how do I do it in elliptic curve cryptography (ECC)? Cramer-Shoup with cyclic groups Following was taken from Wikipedia: https://...
0
votes
0answers
51 views

MOV attack on ellipic curves with the correct dlog in the finite field, but wrong dlog in the EC group

I'm following this description of the MOV attack: https://people.cs.nctu.edu.tw/~rjchen/ECC2009/19_MOVattack.pdf (slide 6/8) by implementing it. However, sometimes the computed dlog $k$ (which is ...
0
votes
0answers
76 views

Partially Repeated Roots of Classical Modular Polynomial

So I was trying to compute a normalized model of elliptic curve as described here. Consider $p$= ...
0
votes
0answers
30 views

Point-halving/solving quartic equations over the elliptic curve E(Z_N)/ring Z_N where N = pq

I am wondering whether there are any results/whether there is any knowledge about the following problem: Given a univariate polynomial (say, a quartic) equation defined over $\mathbb{Z}_N$, is it ...
0
votes
0answers
33 views

Is it possible to “convert” to a curve

Assuming I have a 2 black boxes Box A: generates a private key and use it to sign whatever data I sent it (using secp256r1). It also returns the corresponding public key Box B: gets a public key, and ...
0
votes
0answers
81 views

Interactive ECDHE Authentication With Numeric Code

Trying to simplify my question, keeping only core concepts. Proposed solution: Both user devices generates ECDHE key pairs. Send pub keys to each other. Generate shared secret. Device that requests ...
0
votes
0answers
57 views

Elliptic curves over extensions of 64-bit fields

Are there any standard (or at least well-know) elliptic curves over $F_{p^4}$ where $p$ is a ~64-bit prime? I know Microsoft has FourQ curve which works over $F_{p^2}$ where $p$ is a 127-bit prime, ...
0
votes
0answers
55 views

Generate such an Elliptic Curve

I have a basic question. Is there a way to define an Elliptic Curve over (binary) Finite Field of order $q=2^m$ such that by taking the points from $(0, Y_0)$ and $(1, Y_1)$ then maps them to $(q - 1, ...
0
votes
0answers
23 views

Lifting point to quadratic twisted curve

How to lift point to it’s quadratic twisted curve? I use secp256k1. Is the diiscrete log still same? Thanks before
0
votes
0answers
47 views

BIP32 Extended Key to EC Private and Public Key Pair

We are working on an application in Android using Java. In our project, we used to generate EC key pairs (of size 384 bits) using SpongyCastle - an old Android version of Bouncy Castle. The problem ...
0
votes
0answers
37 views

What is the best way to encrypt whole partitions with Ed448-Goldilocks?

I like crypto, but I'm a bioanalytical chemistry person by trade. I like this algorithm and was wondering if I could use it to encrypt partitions like a MBR that prompts a passphrase, like BitLocker.
0
votes
0answers
63 views

Can knowing the ephemeral key recover the private key in ECDSA

If the attacker - some guy who really, really wants to steal bitcoins - somehow finds the ephemeral key used in an 256-bit ECDSA signature, can he recover the private key? If so, would knowing the ...
0
votes
0answers
50 views

Generalized Schnorr's signature variations

I'm working on an ECC-based system. There's a Schnorr's signature, by which the prover may prove a knowledge of a preimage (i.e. scalar, private key) of an EC point (i.e. public key). It can be ...
0
votes
0answers
44 views

Where can I find standardized implementations of lightweight cryptographic ciphers?

I am working on a project that requires encrypting messages with different ciphers. I am looking for the following ciphers: PRESENT, CLEFIA, LEA, Hill cipher, Affine cipher, Elliptic Curve ...
0
votes
0answers
27 views

Compute shared public keys

I want to compute, in a distributed way, the following shared public keys on an elliptic curve: $(xG, x^2G,...,x^nG)$, being $x$ a secret scalar that no single party knows, $G$ the public ...
0
votes
0answers
75 views

Is it possible to distinguish ECC private key from the random values

I have a list of the random values (each 65 bytes long). One of the items is a private key which is used to sign the data: ...
0
votes
0answers
35 views

Is there an O(1) in space complexity k-of-n signature scheme?

I was looking in depth into Schnorr signatures recently, and while they are very attractive for their ability to be aggregated, this only works for n-of-n ...
0
votes
0answers
68 views

Modifying Elliptic Curve Parameters

For context, I was watching this bit of the video: which goes over this source code. The piece is about elliptic curve cryptography and how it works. I want to use some of this knowledge to make my ...
0
votes
0answers
49 views

The ECC private key is generated with 0x00 at the beginning.(prefix)

I created a private key using the prime256v1 curve. My purpose is to get a 32 byte private key. However, the private key is preceded by 0x00, resulting in 33 bytes. Why is this happening? The only ...
0
votes
0answers
41 views

How to get a random point of a specific EC group with cofactor Not-Equal 1?

We got a EC group generated with point G, and the cofactor of E(G) is with the similar size of the Order. Now we need a random point of E(G) and not revealing the "logarithm" of the random point, so ...
0
votes
0answers
65 views

Isogeny of elliptic curve

If we have two elliptic curves $E$ and $E'$ and the points of both elliptic curves are same. Then all the points of $E$ map to all the points of another elliptic curve $E'$. For example $E$ has ...
0
votes
0answers
45 views

Differential representation of binary curve as a public key

Given elliptic curve $E$ over binary field $k$, a public key is the pair $(x,y)$ in $E$ and $x$ and $y$ in $k$. The differential representation of $(x,y)$ is $w = x + y$. What security implications ...
0
votes
0answers
134 views

Using division polynomials to prove that EC discrete log is even

This question is related to the other question I recently asked. I'm trying to figure out if it is possible to use division polynomials to prove that knowing $A = a \cdot G$ we can prove that $a$ is ...
0
votes
0answers
156 views

Sharing secret content with multiple recipients

I have a sender and N recipients, and am thinking of using the following scheme to send secret content to those recipients. This is similar context to a group chat or email. I am no expert in crypto ...
0
votes
0answers
61 views

Algorithm to compute DLOG for elliptic curve $E(F_p)$ with order p

I was reading about elliptic curves in this pdf. Page 55 of the pdf states that if number of points on elliptic curve #$E(F_p) = p$, then there exists a p-adic logarithmic map that homomorphically ...
0
votes
0answers
127 views

NIST ECC Curves without pairings

NIST FIPS.186-4 has standardized 5 ECC curves on field $\mathbb{F}_p$ (P-192, P-224, P-256, P-384, P-521) and 10 elliptic curves on binary fields. I need to use ECC curves without pairings for my ...
0
votes
0answers
353 views

Size of group for Elliptic curves vs RSA for equal security

For my research, I would like to compare the efficiency of a scheme when instantiated with Elliptic curves and RSA. So, I would like to know a "latest" comparison (as of 2018) on what group sizes of ...
0
votes
0answers
242 views

Compact encoding of an elliptic curve point

I'm working on a project with elliptic curve cryptography (ECC), I'm using the secp256k1 library (the one that's used in bitcoin). My goal is to create the most compact platform-independent ...
0
votes
0answers
184 views

MTI/A0: modular arithmetic or elliptic curves?

In the Handbook of Applied Cryptography (Menezes, A. J.; van Oorschot, P. C. & Vanstone, S. A.) Protocol MTI/A0 key agreement (algorithm 12.53) described as $\mod p$-protocol. The survey Overview ...
0
votes
0answers
84 views

Found weil pairing. Index Calculus method on the results of weil pairing

Consider Elliptic curve with p = 59, A = 1, B= 0, P = (25,30) and Q=(35,31). So I tried to solve this using MOV attack. The torsion point for them E[5] is R(-25,30i) where is sqroot -1 Chosen two ...
0
votes
0answers
38 views

Do most TLS 1.2 implementations express curves in a canonical form when performing EC arithmetic?

Sorry if this is a silly question, but does anyone know if the cryptographic libraries which implement TLS 1.2 for Firefox, Chrome, etc. express a given curve in a canonical form (i.e. one of ...
0
votes
0answers
198 views

processing time for multiplication and exponentiation in pairing base cryptography

I'm using the Boneh-Boyen-Shacham signature scheme and want to estimate complexity in my scheme. As reported in "Scott M., Efficient Implementation of Cryptographic pairings", if we set parameters ...
0
votes
0answers
388 views

Polynomial Inversion over Galois Field

Hello guys I am looking to calculate the Inverse of a given polynomial in Galois field I have found the little Fermat's algorithm and the Itoh-Tsujii I am getting a bit confused with both algorithm ...
0
votes
1answer
116 views

ECC public key encryption without symmetric cipher

Imagine the following scenario. A process is running in background and permanently encrypting some data. An adversary has full control of the process, e.g. it can dump the process memory any time and ...
0
votes
1answer
107 views

Elliptic Curve - X Coordinate

I am currently working on a Koblitz curve. I have found the curve has two matching groups based on the base curve point and N-1 point. My question is as follows: Is there an algorithm to determine how ...
-1
votes
0answers
41 views

Why is my ECC key not 32 bytes?

I have generated an ECC Key, Secp256k1, using a variety of means: OpenSSL, EC-Key npm, and even an online generator. Every time I write this key to a file and check the size, it is more than 32 bytes (...
-1
votes
1answer
470 views

Elliptic curve discrete logarithm problem and mini example

Consider the group E23(9,17), this the group defined by the equation y2 mod 23 = x3 + 9x + 17 mod 23. What is the discrete logarithm k of Q = (4,5) to the base P = (16,5)? the solution is: 2P = (20,...
-1
votes
1answer
70 views

Simple hexadecimal to 2s complement question

From 2.5.1 in this paper, how is $p$ = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFFFF 00000000 00000000 FFFFFFFF = $2^{384} − 2^{128} − 2^{96} + 2^{32} − 1$ ...