Questions tagged [elliptic-curves]
Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.
2,128
questions
7
votes
2
answers
2k
views
Can SRP be used with Elliptic Curves?
I'm sure it can, because SRP (secure remote protocol) can be implemented everywhere where Diffie-Hellman works, but I need a proof to put this aspect into Wikipedia.
Edit: ok, can it be at least ...
- 1,691
7
votes
3
answers
1k
views
How to decide if a point on a elliptic curve belongs to a group generated by a generator $g$?
In the elliptic curve encryption scheme, there is a cyclic group generated by a base point $G$ on the elliptic curve.
Given a random point on the elliptic curve, is there a way to decide if the random ...
- 93
7
votes
1
answer
5k
views
What are the differences between ephemeral-static ECDH and static-static ECDH?
As I know ECDH can be used with a fixed public key. I read there are two types of static ECDH, ephemeral-static ECDH, and static-static ECDH.
What are the differences between these two types?
- 461
7
votes
1
answer
22k
views
ECC key size and signature size
My understanding of ECDSA signature length is that it depends on the key size. So for instance, if a "prime256v1" is used, the signature length will be 64 because (n/8)*2 and for "secp384r1" it will ...
- 223
7
votes
1
answer
1k
views
Can multiple public keys lead to the same shared secret in X25519?
I have no mathematical knowledge about this, but I just read in RFC 7748 the following:
Designers using these curves should be aware that for each public key,
there are several publicly computable ...
- 73
7
votes
2
answers
3k
views
Should we use IANA groups 14 (MODP), 25, and 26 (ECP)?
By looking at SonicWall Knowledge Base article Key exchange (DH) Groups Supported - Site to Site VPN:
It appears that our firewall supports DH group 25, and 26. Almost everywhere I've seen, they've ...
- 73
7
votes
1
answer
7k
views
Understanding BLS12-381 Curve
I have some basic understanding of ECC - but pretty far from advanced concepts. I've been reading about BLS12-381 curve here and here, but I can't seem to fully understand it.
The things that I think ...
- 969
7
votes
1
answer
19k
views
7
votes
2
answers
1k
views
Is there a good reason not to mention that ECC is weaker than RSA on a quantum computer?
In most papers and other documents I see people are considering an ECC key of 256 bits equivalent to an RSA key of 3072 bits, which is true on a classical computer. But the amount of qubits required ...
- 71
7
votes
2
answers
3k
views
Is Curve25519 vulnerable to private key exposure in the case of a bad RNG?
I'm really excited by what I've learned of advancements in elliptic-curve cryptography. Curve25519 seems to be a great choice at this point in time, but if I recall correctly, some elliptic curve ...
- 967
7
votes
3
answers
2k
views
Why are elliptic curves better than cyclic groups?
The set of points of an elliptic curve over a finite field is isomorphic to the direct product of two cyclic groups (i.e. $E(F_{p^n}) \cong Z_{s} \times Z_{t})$.
What is the advantage of representing ...
- 225
7
votes
2
answers
3k
views
How to create an EC point from a plaintext message for encryption
It seems that ElGamal encryption is also possible for Elliptic Curve cryptography. However, that requires the user to convert the message to a point on the curve. What strategies are there to derive a ...
- 91.9k
7
votes
1
answer
2k
views
ECIES/ ECDHE/ EC-ElGamal encryption comparison
I need to choose an encryption system, so I am trying to understand the differences between the existing options. I always find that people compare ECIES (Elliptic Curve Integrated Encryption Scheme) ...
- 127
7
votes
2
answers
2k
views
libsodium x25519 and Ed25519 small order check
Studying libsodium implementation of x25519 and Ed25519 I saw that it performs an small order check comparing given inputs with a hard coded blacklist of values. Is this list exhaustive or it is a ...
- 593
7
votes
1
answer
2k
views
What are the coordinates of a generator point?
I'm browsing through Curve25519 code, the generator point of it is $G=9$.
I would like to know how can I get $x$ and $y$ coordinates of this generator point. Is there any standard way of ...
- 357
7
votes
1
answer
2k
views
Can a raw ECDH shared secret be used directly for encryption?
If two parties calculate an ECDH shared secret can they (with no security weakness) use this raw value directly as an encryption key, assuming the underlying key and ECDH sizes match?
Also the ...
7
votes
1
answer
2k
views
Why Elliptic curve cryptography are not popular in practice
RSA and ElGamal can be implemented using the technique of Elliptic curves. I am confused on why the it seems that Elliptic curves are not so popular in cryptographic applications since they provide ...
- 445
7
votes
1
answer
909
views
Why do the discriminant and primality of the group order of an elliptic curve affect security?
In a book about cryptography and elliptic curves, there was a mention that not all curves are secure, and a statement than in order to pick a secure curve the curve must satisfy 3 requirements.
The ...
- 403
7
votes
1
answer
2k
views
Ed25519 PKCS8 private key example from IETF draft seems malformed
Malformed PKCS8 Key
Algorithm Identifiers for Ed25519, Ed448, X25519 and X448 for use in the Internet X.509 Public Key Infrastructure § 10.3. Examples of Ed25519 Private Key states the following:
<...
- 2,895
7
votes
4
answers
6k
views
Can elliptic curve (25519) be used to encrypt file?
This is probably a simple question, but I haven't been able to see it stated anywhere. Is it possible to directly encrypt a file (of any length) with some form of EC using the 25519 curve.
I know it'...
- 73
7
votes
4
answers
2k
views
Elliptic curve parameters
What's the meaning of "160-bit curve" in an elliptic curve? Or 192, 224, 256, etc. And what is the standard for selecting this number of bits?
Why they don't say "100-bit curve"?
- 113
7
votes
2
answers
4k
views
How do I unpack the x and y values from the BITSTRING in a DER ECDSA public key?
In ASN.1, the X and Y values for a 256-bit elliptic curve key are stored as a single 66-byte ASN.1 BITSTRING. Are the values just the first and second half of this bitstring?
The private key is an ...
- 551
7
votes
2
answers
895
views
Besides key and ciphertext sizes what are other advantages of elliptic curve versions of various protocols?
There are elliptic curve variants of Diffie-Hellman, ElGamal, DSA and possibly other protocols/algorithms. I know that these elliptic curve variants have smaller key and ciphertext sizes which will ...
- 38.5k
7
votes
1
answer
1k
views
Is there an algorithm to check if an elliptic curve is secure?
As I understand it elliptic curves are of the form $y^2 = x^3 + ax + b$
Where $a$ and $b$ are the curve parameters. However not all parameters will give a curve suitable for crypto purposes. Is there ...
- 719
7
votes
2
answers
2k
views
What's the point and use of 512-bit-style elliptic curves?
There is a plethora of elliptic curves that are close to the 256-bit security level (i.e., fields and groups of approximately 512 bits). Examples are Curve448, P-521, Brainpool-P512.
The standard ...
- 2,330
7
votes
1
answer
4k
views
How can Shor's Algorithm be applied to ECC?
I have not found a specific answer to this question on here.
Shor's algorithm can be used to factorize a large (semi)prime $N$ by reducing the task to period-finding of a function $f(x)=x^a$ mod $N$.
...
- 740
7
votes
1
answer
1k
views
Does the backdoor in Dual_EC_DRBG work like that?
From what I read, the backdoor in Dual_EC_DRBG operates by using related $P$ and $Q$ points.
Did I understand the idea correctly?
Dual_EC_DRBG works by multiplying the $P$ point with the seed ...
- 825
7
votes
1
answer
674
views
Is SHA-1 safe for signing ECDHE parameters?
Is using the SHA-1 algorithm insecure for hashing the ephemeral ECDH public key in the signed_params structure?
There are some worrying articles about using SHA-1:
...
- 71
7
votes
2
answers
1k
views
ECDSA signature verifiable 1-way transformations
Alice signs a message $m$ with her private key, yielding a signature ($r$,$s$).
I want to prove to someone else that I have this signature, but I don't want them to have the knowledge of what ($r$,$s$...
7
votes
1
answer
2k
views
X9.62 Multiplying an elliptic curve point by a number
I'm currently trying to implement ecdsa and the first problem i met -- multiply an elliptic curve point by a number.
As far as i understand X9.62 gives some recommendation for doing it but i haven'...
- 255
7
votes
1
answer
4k
views
Difference between Pure EdDSA (ed25519) and HashEdDSA (ed25519ph)
My question refers to EdDSA as specified in RFC 8032.
I get from the RFC that ed25519 and ed25519ph are two different instances of EdDSA mainly differing in the fact that that in the case of ed25519ph ...
- 391
7
votes
2
answers
2k
views
Difficulty of Reversing Elliptic Curve
In ECC, it is apparently easy to verify the final point given the starting point and the number of hops. But it is difficult to compute the number of hops given just the starting point and the final ...
- 81
7
votes
2
answers
814
views
Goofs that could creep in ECDSA signature verification?
What are goofs that could creep in ECDSA signature verification, perhaps with focus on curves based on prime-order $\mathbb Z_p$, specifically P-256 aka secp256r1? Is it possible to construct test ...
- 138k
7
votes
1
answer
1k
views
Why does anyone use elliptic curves for a CSPRNG?
I saw Martijn Grooten's talk on elliptic curves at BSides London this year, and it helped me understand how elliptic curve crypto works, especially in the case of Diffie-Hellman (ECDH). He also ...
- 3,527
7
votes
1
answer
5k
views
How does ECDHE_RSA key exchange mechanism work?
Using Wireshark, I found these data exchanged with google.com over TLS:
Client Hello
possible cipher suites and possible curve types (eg. secp256r1) sent
Server Hello
cipher suite selected
...
- 173
7
votes
2
answers
4k
views
Understanding elliptic curve encryption [closed]
I'm having a hard time understanding the elliptic curve encryption. One thing thing I don't understand is listing all the points on the curve mod p. Suppose I have the following elliptic curve: $y^2 = ...
- 171
7
votes
2
answers
1k
views
Endomorphism ring of a Elliptic Curve and $j$ invariant
I am reading Schoof's 1995 paper, Counting points on elliptic curves over finite fields, page 236, Proposition 6.1(i). I am trying to understand page 238 (second paragraph) of the proof: if the ...
- 83
7
votes
1
answer
3k
views
ECDSA security using same per-message secrets $k$ but different signing keys
I know that when I have a ECDSA keypair and use it twice with the same $k$ to sign different messages then the private key can be recovered.
If I now have multiple ECDSA keypairs and sign a message ...
- 213
7
votes
1
answer
4k
views
What is the difference between “secp…” and “sect…”?
The National Institute of Standards and Technology (NIST) recommended elliptic curve domain parameters to have names such as “secp…” and “sect…”.
For example: “secp224k1” and “sect571k1”.
What is ...
- 189
7
votes
1
answer
256
views
CSIDH - l ideal generators
I am trying to study the CSIDH algorithm. I have some beginner background in elliptic curves and I have been following Andrew Sutherland's lectures (https://math.mit.edu/classes/18.783/2019/lectures....
- 392
7
votes
2
answers
2k
views
Why does Smart's attack only work on anomalous curves?
Nigel Smart's attack solves the discrete logarithm problem in linear time. It requires the curve, however, to be anomalous, i.e. to have a trace of Frobenius equal to one or, equivalently, to be of ...
- 71
7
votes
1
answer
524
views
Which attacks are possible against raw/textbook elliptic curve?
A quick question, we know that raw RSA is a no go. To solve this we have different PKCS standards forcing structure on the input messages.
For EC the story is something else. For signatures we have ...
- 431
7
votes
1
answer
1k
views
Elliptic curves for ECDSA
I'm trying to implement parameters generation for ECDSA according to SEC1 v2.0:
...
- 255
7
votes
1
answer
604
views
What does Shor's algorithm tell us about the complexity class of RSA and the DLP?
If quantum computers operate in BQP and (using Shor's algorithm) they are able to factor large integers and break the discrete log problem, what does that tell us about the complexity class of these ...
- 461
7
votes
1
answer
3k
views
ECC considered secure in OpenSSL?
If I perform the following command:
openssl ecparam -list_curves
using my OpenSSL version (1.0.1f), it spits out the following supported curves:
...
- 71
7
votes
1
answer
477
views
Is it important to defend against key substitution attack in ECDSA?
When planning a file signature scheme (basically, just to sign all files content). Is it obligatory to defend against ECDSA key substitution attack?
ISO/IEC 14888-3:2018 NOTE 5 states:
The ...
- 625
7
votes
1
answer
653
views
Proving that the least significant bit of an elliptic curve discrete logarithm is $0$
Suppose I have a secret value $a$ which maps to a public point on an elliptic curve $A = a \cdot G$, where $G$ is a generator of the elliptic curve of prime order $q$.
Can I prove to someone that the ...
- 969
7
votes
1
answer
388
views
Sextic twist over BN elliptic curves
I am struggling to understand how to perform a sextic twist over a BN elliptic curve. This is what I understood so far:
Let's consider a BN elliptic curve:
$$
E: y^2=x^3+b
$$
And let's consider a ...
- 71
7
votes
1
answer
173
views
How important is hardware based crypto in Quantum-safe TLS in mobile devices?
Microsoft Research published an approach to Quantum-safe TLS here, namely RLWE-ECDSA-AES128-GCM-SHA256.
One highlight is that when it's used with ECC, there is only a slight performance hit.
...
- 2,601
7
votes
1
answer
652
views
Encoding scalar values to points on Ed25519
I'm interested exploring key derivation and threshold signature protocol that require point arithmetic (addition) on the private scalar values and $S$ values of the signatures in ed25519.
...
- 171