Questions tagged [elliptic-curves]
Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.
2,125
questions
17
votes
4
answers
31k
views
How does one calculate the scalar multiplication on elliptic curves?
I found this example online:
In the elliptic curve group defined by
$$y^2 = x^3 + 9x + 17 \quad \text{over } \mathbb{F}_{23},$$
what is the discrete logarithm $k$ of $Q = (4,5)$ to the base $...
17
votes
2
answers
4k
views
Does the elliptic curve (EC) cryptosystem outperform RSA and DL cryptosystems?
Throughout the literature, it is stated that EC cryptosystems outperform RSA and Discrete logarithm cryptosystems, but I cannot understand how ECC would be more efficient than RSA and DL in terms of ...
- 245
17
votes
3
answers
5k
views
What does the special form of the base point of secp256k1 allow?
The popular ECC parameters secp256k1 are documented in SEC2 as using curve $y^2\equiv x^3+a\cdot x+b\pmod p$ with $a=0$, $b=7$, $p=2^{256}-2^{32}-\mathtt{3d1_h}$, base point $G$ with the apparently ...
- 138k
17
votes
1
answer
3k
views
Edwards / Montgomery ECC with Weierstrass Implementation?
So let's assume I want to perform Ed448 or Ed25519 digital signatures or want to perform a DH key-exchange. Assume further that those curves (Curve448 or Curve25519) are required.
But the problem is, ...
- 45.7k
17
votes
2
answers
3k
views
Why Elliptic Curves?
What is the benefit of using elliptic curves over the standard finite field, when the cyclic subgroup we consider of the EC's solution group is just isomorphic to some integer residue class of prime ...
- 551
17
votes
1
answer
4k
views
What are the advantages of a static ECDH key?
What are the advantages of using "static-ephemeral ECDH" over "ephemeral-ephemeral ECDH"?
- 171
17
votes
2
answers
26k
views
What curve and key length to use in ECDSA?
I'm developing a client/server system in Java which is not interacting with third-party software, so I don't have to worry about compatibility.
At a certain point, I need the client and server to ...
- 347
17
votes
2
answers
4k
views
Can one reduce the size of ECDSA-like signatures?
Using $n$-bit ECDSA, a signature has a size of $2·n$. It is possible to recover the public key from this signature, which shows that there is a publicly visible redundancy in the signature.
Is ...
- 24.8k
16
votes
3
answers
10k
views
Are all possible EC private keys valid?
I usually generate a key pair using OpenSSL or Bouncy Castle.
I'm using curve secp256k1.
The 256bit private keys look fairly random.
Do all values of "private ...
- 639
16
votes
2
answers
5k
views
How do I get the equivalent strength of an ECC key?
I know how to calculate the comparable symmetric strength of an RSA modulus: calculate the running time for a field sieve. This is how NIST gives approximate symmetric sizes for asymmetric algos in ...
- 497
16
votes
1
answer
4k
views
Difference between “ECDH with cofactor key” and “ECDH without cofactor key”?
I need to use “ECDH with a cofactor key” for generating symmetric key. I have a fair idea on how ECDH works, but I don’t understand the cofactor part.
What is the difference between ”ECDH with a co-...
- 191
15
votes
2
answers
3k
views
When adding two points on an elliptic curve, why flip over the x-axis?
Every introduction to elliptic curves that I've read hasn't explained this.
If you have two points P and Q on an elliptic curve, to find P+Q, you draw a straight line through the points, find the ...
- 161
15
votes
4
answers
2k
views
Are any of the major asymmetric ciphers distinguishable (EG, RSA, ECC)?
Related to "Is it possible to derive the encryption method from encrypted text?".
Given ciphertexts generated by any of the major asymmetric ciphers (RSA, ElGamal, ECC, etc..) can these ciphertexts ...
- 2,266
15
votes
1
answer
674
views
Logjam on Elliptic Curves?
I think we're all aware of the Logjam attack.
From now on we know that re-using primes for DH is a bad idea.
But we also say that elliptic curves are safe from the attack (relying on the NFS), ...
- 45.7k
15
votes
1
answer
2k
views
How to generate own secure elliptic curves?
I know that the algorithm used to generate the Brainpool curves and the NIST curves is published. The algorithm should be this one (RFC5639 Appendix A). From what it looks like it's rather slow to ...
- 45.7k
15
votes
1
answer
2k
views
When do ECC patents end?
As the topic says, since when can ECC cryptography be freely used?
Is it not widely used because of patents? There is no alternative to it on embedded devices and smart cards.
Just to mention: I am ...
- 1,691
14
votes
2
answers
2k
views
Can I still use insecure curves/ciphers for time relevant encryption?
Can Ciphers that are known to be insecure because their keysize is considered too small still be used in appliances that have a tight decryption timeframe?
In particular I am looking at ECC2K-130.
ecc-...
- 378
14
votes
1
answer
23k
views
ECDSA Signature R|S to ASN1 DER Encoding question
I am trying to test my understanding on ECDSA Signature r|s to ASN.1 DER Encoding for NIST P-256. I have r|s and when I convert ...
- 153
14
votes
1
answer
1k
views
What the X stands for in the front of Elliptic curve names like X25519
I have seen Curve25519 and X25519, Curve448 and X448. I've seen a small note in this answer
(Historical note: Originally, X25519 was called Curve25519, but now Curve25519 just means the elliptic ...
- 47.5k
14
votes
1
answer
2k
views
Is pairing based cryptography ready for productive use?
I'm currently testing one among those many interesting cryptographic protocols based on bilinear maps.
It's quite hard to understand the underlying fundamentals, especially since there are several ...
- 295
14
votes
7
answers
9k
views
Generate Elliptic Curve Private Key from User Passphrase?
I'd like to generate a private elliptic curve key from user input like pass phrase. Is the best way to do this with a key derivation function like PBKDF2? Is there a better way?
Edit (based upon @...
- 283
14
votes
1
answer
3k
views
Trying to better understand the failure of the Index Calculus for ECDLP
So I'm going to give you guys my understanding and then if you would be so kind as to tell me where I'm off the mark (hopefully I'm not completely wrong).
So basically the index calculus for the ...
- 303
14
votes
2
answers
6k
views
Is it safe to reuse a ECDSA nonce for two signatures if the public keys are different?
We denote the s value of an ECDSA signature $(r, s)$ on a message $m$ as:
$s=\frac{H(m)+xr}{k}$
Assume two ECDSA signatures sharing the same nonce $(r, s_1) , (r, s_2)$ on two messages $m_1, m_2$, ...
- 2,266
13
votes
1
answer
6k
views
Curve25519 over Ed25519 for key exchange? Why?
I've been reading up on the Signal Protocol (in this PDF) and it seems to be using Curve25519 for ECDH and EdDSA (with Ed25519) for signatures.
My question is why not use only Ed25519?
This ...
- 324
13
votes
3
answers
3k
views
How are points on an elliptic curve discretized?
I'm a working programmer (read: a person without a maths degree) trying to get a better grasp on elliptic curves specifically in the context of elliptic curve cryptography (though to be clear, this is ...
- 133
13
votes
2
answers
893
views
What motivated the creation of RSA and ECDH?
Recently I've been learning about cryptography and so far I am loving it. However, there are some things I do not comprehend.
As far as I know, RSA was published in 1979 while New Directions on ...
- 151
13
votes
2
answers
4k
views
Why do public keys need to be validated?
For some curves it's necessary to validate the public-key of the other side before running an elliptic-curve Diffie-Hellman key-exchange. Apparently if you don't validate the public key, small ...
- 24.8k
13
votes
1
answer
10k
views
Why are ed25519 keys not recommended for encryption?
Was wondering why there is no straightforward way of using ed25519 keys for encryption.
Then I found this: https://github.com/indutny/elliptic/issues/108
There it is stated that it's unlike RSA not ...
- 153
13
votes
1
answer
3k
views
Why are Jacobian Coordinates used?
I couldn't find this explained in another question, but is there an actual reason as to why Jacobian coordinates are used for elliptic curves? Do they provide some sort of advantage in terms of ...
- 415
13
votes
2
answers
2k
views
Is it safe to reuse ECDH asymmetric keys for authentication?
Alice, Bob, and Carol each generate ECDH keypairs. Alice and Bob establish a communication channel and negotiate an AliceBob secret.
The question is: Is it safe for Alice and/or Bob to reuse their ...
13
votes
3
answers
26k
views
Using ECDSA keys for encryption
I know that ECDSA is used for signature only, but I wonder if I can use the public/private Elliptic Curve keys for encryption too.
I have ECDSA SSH public keys and I wonder if I can use them to ...
- 343
13
votes
1
answer
1k
views
Can I use signature(hash(message)) instead of signature(message)?
Background:
We use the TweetNaCl crypto library by Bernstein (tweetnacl.cr.yp.to) et al and we would like to stick to it. However, we have the need to sign large messages and the library does not ...
- 375
13
votes
2
answers
2k
views
Verifiably deterministic ECDSA signatures?
ECDSA signatures depend on parameter k that is chosen by the signer. As a result, there are many signatures for the same private key d and message m.
What I want to achieve is a deterministic ...
- 173
13
votes
2
answers
695
views
Pairing-friendly curves in small characteristic fields
There are several well-known techniques to generate pairing-friendly curves of degrees 1 to 36 on prime fields GF(p): Cocks-Pinch, MNT, Brezing-Weng, and several others.
In extension fields GF(p^n), ...
- 12.4k
12
votes
2
answers
18k
views
Why is there the option to use NIST P-256 in GPG?
I am surely not an expert on the field, but I heard some people say that NIST P-256 somehow has backdoors.
I don't know about the seriousness of this claim; maybe it's just a conspiracy theory.
If ...
- 4,415
12
votes
1
answer
7k
views
What is an elliptic curve cofactor?
As the title says, I have some doubts about the term "cofactor" used to describe elliptic curves.
AFAIK, it's a factor of the curve order, but why is it explicitly specified in some parameter lists ...
- 825
12
votes
2
answers
8k
views
Can elliptic curve cryptography encrypt with public key and decrypt with private key like RSA?
I know that RSA can be used for both, encryption and signature.
What about EC? I know about ECDSA/EdDSA, but to my knowledge it can only be used to sign.
I also know about ECDH, but it is a key ...
- 121
12
votes
1
answer
3k
views
What is the curve type of SECP256K1?
This is possibly a dumb question. I'm trying to input SECP256K1 curve parameters to a system that expects any custom curve. The form is asking for "curve type". It offers three options:
Short ...
- 265
12
votes
2
answers
8k
views
Are there any Secp256k1 ECDSA test examples available?
Are there any available test cases for testing elliptic curves like secp256k1 (Korblitz curves from http://www.secg.org/collateral/sec2_final.pdf)? For curves like P192 there are for example those ...
- 1,659
12
votes
1
answer
1k
views
Why can an elliptic curve private key be 1?
I often see in papers (e.g. this one) that for an elliptic curve with generator point $G$ and order $n$ the private key $d$ can take on any integer value in the range $[1, n)$. When $d = 1$ the ...
- 4,012
12
votes
5
answers
7k
views
What is the most secure ECC Curve?
I have for a while used Koblitz curve (sect571k1), in ECDH and ECDSA. But I have started wonder if it is the most secure. I prefer security over efficiency. So the curve doesn't have to be the most ...
- 355
12
votes
3
answers
5k
views
Smallest possible certificate for IoT device
I'm developing an IoT system that uses small nodes connected through RF. This allows messages under 250 bytes long. You can check it at https://github.com/gmag11/EnigmaIOT.
All messages are encrypted ...
- 121
12
votes
2
answers
5k
views
Can curve25519 keys be used with ed25519 keys?
Can curve25519 keys be used with ed25519?
I'd prefer to use ed25519, but there isn't a fast java version. For my application, I'd like to use curve25519 until I can get a faster ed25519 for java.
...
user7024
12
votes
4
answers
3k
views
Fast hashing into elliptic curve
Is there a fast algorithm for mapping $n$-bit numbers $s$ (for fixed $n$) into a cyclic subgroup of an elliptic curve (over a finite field) in which the Discrete Logarithm Problem is hard?
By fast, I ...
- 360
12
votes
2
answers
3k
views
How can I implement the elliptic curve MOV attack myself?
I understand and have implemented elliptic curve signatures in Python without the use of libraries like Sage, and would like to implement the MOV attack against certain weak types of elliptic curves.
...
- 121
12
votes
1
answer
3k
views
What are the differences between the elliptic curve equations?
I think we're all aware of the "classical" Weierstrass (short?) elliptic curve equation: $y^2\equiv x^3 + ax +b \pmod p$. Well known examples of these curves include the NIST's and Brainpool ones.
...
- 45.7k
12
votes
1
answer
2k
views
How many bits of entropy does an elliptic curve key of length n provide?
A FAQ for an open source project makes the claim:
Indeed, an elliptic curve key of length n provides $n/2$ bits of security.
I have two questions:
What is the practical difference between "bits ...
- 221
11
votes
4
answers
1k
views
RSA & DH at risk due to math advances, will this eventually affect elliptic curves too?
I was looking into the predictions by some researchers that RSA and Diffie-Hellman may not be secure in the next few years due to advances in math and being able to calculate the discrete logarithm ...
- 415
11
votes
2
answers
6k
views
Why must an elliptic curve group for ECC have prime order?
What is the deeper reason, a group must have prime order for usage in cryptography?
- 1,477
11
votes
2
answers
6k
views
Does secp256k1 have any known weaknesses?
I am wondering whether there are any properties of the curve which would technically make it easier to attack than any other curves of 256 bits in size.
I have heard that being a Koblitz curve, it ...
- 225