Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

Filter by
Sorted by
Tagged with
6
votes
1answer
322 views

Default algorithm for scalar multiplication of elliptic curve points by the MIRACL Library

What is the default algorithm used by the MIRACL-Library [1] for elliptic curve cryptography systems to perform scalar-point multiplication with curves of Weierstrass form satisfying the equation : $y^...
6
votes
3answers
685 views

Safe curves in Weierstrass form?

I would like to implement a protocol using elliptic curves. I'm thinking of using MIRACL so using curves in their Weierstrass form is preferable as it they are supported by this framework. I don't ...
6
votes
1answer
320 views

How can I use Weierstrass curve operations with a=-3 for implementing operations for a=0?

I am working with golang's elliptic library. It implements functions on Weierstrass elliptic curves with $a=-3$. I need to make my own library that allows me to handle curves with $a=0$. I understand ...
6
votes
1answer
204 views

Elligator-2 against curves over Fq, q mod 4 = 3

It appears that the conditions for applicability of Elligator-2 against many of the SaveCurves curves, where $q \mod 4 = 3$ will inevitably poke a hole in the bit-string set over $(0, 1, .. (q-1)/2)$. ...
6
votes
0answers
231 views

Index calculus over elliptic curve over function field

According to my understanding there are some pretty solid seeming roadblocks to carrying out an index calculus on an elliptic curve over a finite field. The general strategy is to take points over $E(\...
5
votes
2answers
880 views

Raw curve25519 public key points

I'm trying to understand curve25519, and ECC public points. I'm playing with Minisign, to better understand the fundamentals of ECC. Minisign uses curve25519 and outputs public keys as base64 ...
5
votes
2answers
133 views

How sensitive to change are elliptic curve formulae In layman's terms?

Take for example a curve from a recent question such as #25519:- $$y^2 = x^3 + 486662x^2 + x$$ It's considered "safe". What are are the implications of amending it very slightly to:- $$y^2 = x^3 + ...
5
votes
2answers
2k views

Why is Diffie Hellman used alongside public keys?

I just read this post here: Why do we need asymmetric algorithms for key exchange? that asserts that in public key cryptography when asymmetric keys are used to secure communications, for parties to ...
5
votes
2answers
2k views

Why must an elliptic curve group for ECC have prime order?

What is the deeper reason, a group must have prime order for usage in cryptography?
5
votes
1answer
1k views

What is an elliptic curve cofactor?

As the title says, I have some doubts about the term "cofactor" used to describe elliptic curves. AFAIK, it's a factor of the curve order, but why is it explicitly specified in some parameter lists ...
5
votes
1answer
4k views

ECDH or RSA more secure for symmetric key wrapping?

Suppose a message is encrypted with a symmetric block cipher with a random key. RSA is often used to wrap the symmetric key using the recipient's public key. In this case, the size of the message is ...
5
votes
2answers
651 views

Can we use elliptic curve cryptography in wireless sensors?

Can we use elliptic curve cryptography in wireless sensors? If so, how do you map points to message characters?
5
votes
2answers
230 views

How to get an optimal strategy in computing isogenies for SIDH/SIKE

How to get a strategy $(s_1,...,s_{t-1})$ as mentioned in section 1.3.7 of SIKE spec? If possible, can anyone give me an example? And why do we need to compute all leaf point? I though we just need ...
5
votes
1answer
390 views

Can two elliptic curve point multiplications have a same resulted point?

Is it possible for $aG \equiv bG$, with $a, b$ are scalars and $G$ is a point on the curve?
5
votes
1answer
513 views

ECDSA key recovery - floating point values

I'm currently attempting to recover an ECDSA key. I have $m$, $m'$ and signatures $(r, s)$, $(r', s')$, and I know that $k$ is constant, the curve is NIST P-192 and the hash function of the. As such,...
5
votes
2answers
845 views

Why is 2048-bit RSA always paired with 320-bit ECC?

You may already have noticed that most smart cards ship with 2048-bit RSA support and 320-bit ECC over GF(p) support. You may have already asked yourself "why exactly 320-bit?". Now I remember having ...
5
votes
1answer
589 views

Why doesn't this replay attack work on ECDSA?

I've just started working with elliptic curves and ECSDA in particular, so my understanding of the underlying math isn't great. The thing I'm currently stuck on is trying to understand why replay ...
5
votes
1answer
390 views

Elliptic Curve Cryptography

I have been trying this for a while. But I couldn't get it. How can I determine the point of intersection of the tangent line at (0, 0) on the curve $y^2 + y = x^3 + x^2$ ?
5
votes
1answer
1k views

In elliptic curve cryptography, how is “A dot A” computed?

I was just reading Ars Technica's primer on ECC. Somewhere near the middle of the second page, the author introduces the "dot" operation that takes an elliptic curve and two other known points, giving ...
5
votes
1answer
2k views

inverse problem about scalar multiplication on elliptic curve

Let $E$ be an elliptic curve over a finite field $F_p$. Given $n$ be a positive integer and $Q$ be a point on $E$, assume that $Q=nP$, how can we find this $P$? We can assume that $n|p-1$. If $n$ is "...
5
votes
2answers
3k views

How do I unpack the x and y values from the BITSTRING in a DER ECDSA public key?

In ASN.1, the X and Y values for a 256-bit elliptic curve key are stored as a single 66-byte ASN.1 BITSTRING. Are the values just the first and second half of this bitstring? The private key is an ...
5
votes
1answer
629 views

Can Microsoft's SIDH (Supersingular Isogeny) keypairs be reused for encryption? If not, why?

I was considering using Microsoft's SIDH implementation for post-quantum public-key encryption because of its relatively small key size. I realized however, thanks to Issue #4, that it might not be as ...
5
votes
1answer
131 views

What are the problems with Diffie-Hellman groups 3 and 4 (RFC 2409 + RFC 2412)?

In RFC 2409 and RFC 2412 Diffie-Hellman groups 3 and 4 were defined. These are groups over elliptic curves based on Galois Fields with and elements respectively. I know that these sizes are ...
5
votes
1answer
743 views

BN-Curves for 256-bit symmetric security

I'm just studying the purpose of BN-Curves and I am interested in a setting for a 256-Bit security. So could you tell or link me to any information about this? are BN-Curves efficient for this ...
5
votes
2answers
191 views

Why is elliptic curve parameter $a=-3$ somehow special

Considering the equation of the elliptic curves over $GF(p)$ $y^3 = x^2+ax+b$ , why is there some magic in using $a=-3$ ? In some well known curves (e.g. P-256) only $b$ is specified, while $a$ ist ...
5
votes
1answer
1k views

Key exchange using ECDH vs ECIES?

I'm a beginner to ECC crypto programming. Does any one explain to me the difference with using ECDH for shared key exchange and use of ECIES by encrypting shared key with the public key of the ...
5
votes
4answers
1k views

Elliptic curve parameters

What's the meaning of 160 bit Curve in Elliptic curve ? or 192 or 224 or 256 and etc. And What is the standard for selecting this number of bit ? why they don't say 100 bit curve?
5
votes
1answer
2k views

Montgomery Ladder vs Double-and-Add

I would like to know what (if any) are the advantages of using Montgomery Power ladder over the Double-and-Add-Always algorithm. I think that firstly, Monty would be slightly faster than DoubleAndAdd. ...
5
votes
2answers
1k views

Safe elliptic curve point addition using projective coordinates: How do I tell if the points are the same?

I am trying to implement elliptic curve point addition in hardware for NIST p256 and p384 curves. I have noticed the following issue with the suggested NIST routines: Consider routine 2.2.7 of http://...
5
votes
1answer
415 views

Why is a simple hash into $G_2$ for (certain) pairing based crypto not possible?

In the paper Pairings for Cryptographers we read about what the authors call a type 2 pairing in which we have a "pairing friendly curve $E$ over $\mathbb{F}_q$ with embedding degree $k>1$ and ...
5
votes
1answer
2k views

With TLS and ECDHE, how does curve selection work?

Given that a TLS client and server have already agreed upon ECDHE for session key establishment, how does the selection of the actual elliptic curve ("domain parameters") being used for deriving the ...
5
votes
1answer
2k views

Possible ECC backdoor and its impact on Internet traffic

In a recent article, Bruce Schneier suggested that he prefers classic discrete log crypto over ECC because "I no longer trust the constants. I believe the NSA has manipulated them through their ...
5
votes
1answer
171 views

Difference between Pure EdDSA (ed25519) and HashEdDSA (ed25519ph)

My question refers to EdDSA as specified in RFC 8032. I get from the RFC that ed25519 and ed25519ph are two different instances of EdDSA mainly differing in the fact that that in the case of ...
5
votes
1answer
191 views

Intersection of two elliptic curves

Is it possible to find points that are on two elliptic curves, and how? More precisely, I'm looking for coordinates $(x,y)$ that satisfy the defining equations of two elliptic curves on prime fields $...
5
votes
1answer
1k views

Understanding BLS12-381 Curve

I have some basic understanding of ECC - but pretty far from advanced concepts. I've been reading about BLS12-381 curve here and here, but I can't seem to fully understand it. The things that I think ...
5
votes
1answer
310 views

How can I generate a Koblitz curve?

Is there the way to generate new Koblitz curves, over $\mathbb F_{2^n}$ and $\mathbb F_p$? The Certicom SEC 2 standard says: The recommended parameters associated with a Koblitz curve were chosen ...
5
votes
1answer
533 views

ElGamal with elliptic curves II

There is an encryption scheme using elliptic curves given by @tylo explained here: @tylo's answer on ElGamal with elliptic curves and here: ElGamal with elliptic curves I. The encryption idea is to ...
5
votes
2answers
3k views

How to derive a symmetric key from ECDH shared secret?

I am trying to implement the internal primitives of ECDH. Currently I'm able to multiply the receiver's public EC point with the sender's private key to arrive at the shared EC point. Next step is to ...
5
votes
1answer
793 views

Parallelized Pollard's Rho algorithm for ECDLP + Jacobian coordinates

My implementation of the parallelized Pollard's Rho algorithm is using Jacobian coordinates to avoid the costly inversion operation when performing point addition. I am wondering if there are any ...
5
votes
1answer
251 views

Is ECDSA obsolete/deprecated?

I have been reading about recommendations on the correct use of crypto as a developer and I read at least two references to the obsolescence (so to say) of ECDSA. https://paragonie.com/blog/2015/08/...
5
votes
1answer
5k views

Public-key format for ECDSA as in FIPS 186-4?

What is the public-key format for ECDSA as in FIPS 186-4, and where is it formally defined? In particular, are there variants beyond Cartesian coordinates? Is that a pair of bitstrings, or a ...
5
votes
1answer
137 views

Can elliptic curve point common factors be detected?

Consider the two EC points $X=abG$ and $Y=bG$. Is it possible for someone to examine $X$ and $Y$ to determine if there is a common factor, as long as $a$ and $b$ are randomly chosen numbers between 0 ...
5
votes
2answers
345 views

Finding the subgroup in isogeny-based cryptography

Isogeny-based cryptography is one of the newest post-quantum cryptography. Hardness of this system is based on finding isogeny between two elliptic curves. Also this is theorem: Elliptic curves are ...
5
votes
1answer
470 views

Side-channel attacks against ECDH for Weierstrass normal form curves

I hear a lot about why Montgomery curves are used in ECC, and one reason is that the same algorithm can be used to do both point addition and doubling (this is not true for the Weierstrass normal form)...
5
votes
2answers
2k views

ECC algorithm pollard's $\rho$ complexity

One of the methods to break a ECDLP is Pollard's rho algorithm. When ECDLP is defined over a finite field $F_p$, and given a relation $S=w.T$, where S and T are a member of $F_p$. Then ECDLP is to ...
5
votes
1answer
165 views

Are EC public key values evenly distributed?

At my Day Job(tm) we've encountered a bug wherein if the leading digit of the X or Y value of a public key are zero, "shit happens" (this bug is in our code - I'm not suggesting there's some problem ...
5
votes
1answer
244 views

A (current or soon-to-be) NIST-recommended alternative to ECC?

So this comes from the professional rumor-mill, and I'm wondering if anyone might either debunk or shed light on this. My understanding is ECC is generally now preferred over RSA simply due to how ...
5
votes
1answer
337 views

Implementing CD serial key system

I am trying to create a system where to unlock the application one needs to enter a serial code. I have read many articles on the theme but there are two problems bugging me. One is, If I have a ...
5
votes
1answer
1k views

What differences between Menezes–Vanstone ECC and ElGamal ECC?

After researching ECC encryption, I found that we can use ElGamal cryptosystem with elliptic curve and can we use Menezes-Vanstone cryptosystem with elliptic curve. What is the essential difference ...
5
votes
1answer
833 views

How can I find the order of the group that an elliptic curve is defined over?

I have a Weierstrass elliptic curve ($y^2=x^3+a \times x+b \mod p $) How can I find the order of the group itself? I have seen Mathematica has a GroupOrder[] ...