# Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

2,128 questions
Filter by
Sorted by
Tagged with
2k views

### Can SRP be used with Elliptic Curves?

I'm sure it can, because SRP (secure remote protocol) can be implemented everywhere where Diffie-Hellman works, but I need a proof to put this aspect into Wikipedia. Edit: ok, can it be at least ...
1k views

### How to decide if a point on a elliptic curve belongs to a group generated by a generator $g$?

In the elliptic curve encryption scheme, there is a cyclic group generated by a base point $G$ on the elliptic curve. Given a random point on the elliptic curve, is there a way to decide if the random ...
5k views

### What are the differences between ephemeral-static ECDH and static-static ECDH?

As I know ECDH can be used with a fixed public key. I read there are two types of static ECDH, ephemeral-static ECDH, and static-static ECDH. What are the differences between these two types?
22k views

### ECC key size and signature size

My understanding of ECDSA signature length is that it depends on the key size. So for instance, if a "prime256v1" is used, the signature length will be 64 because (n/8)*2 and for "secp384r1" it will ...
1k views

### Can multiple public keys lead to the same shared secret in X25519?

I have no mathematical knowledge about this, but I just read in RFC 7748 the following: Designers using these curves should be aware that for each public key, there are several publicly computable ...
3k views

### Should we use IANA groups 14 (MODP), 25, and 26 (ECP)?

By looking at SonicWall Knowledge Base article Key exchange (DH) Groups Supported - Site to Site VPN: It appears that our firewall supports DH group 25, and 26. Almost everywhere I've seen, they've ...
7k views

### Understanding BLS12-381 Curve

I have some basic understanding of ECC - but pretty far from advanced concepts. I've been reading about BLS12-381 curve here and here, but I can't seem to fully understand it. The things that I think ...
19k views

### ECDSA private key format

Here's a sample ECDSA private key (I don't use it for anything): ...
1k views

### Is there a good reason not to mention that ECC is weaker than RSA on a quantum computer?

In most papers and other documents I see people are considering an ECC key of 256 bits equivalent to an RSA key of 3072 bits, which is true on a classical computer. But the amount of qubits required ...
3k views

### Is Curve25519 vulnerable to private key exposure in the case of a bad RNG?

I'm really excited by what I've learned of advancements in elliptic-curve cryptography. Curve25519 seems to be a great choice at this point in time, but if I recall correctly, some elliptic curve ...
2k views

### Why are elliptic curves better than cyclic groups?

The set of points of an elliptic curve over a finite field is isomorphic to the direct product of two cyclic groups (i.e. $E(F_{p^n}) \cong Z_{s} \times Z_{t})$. What is the advantage of representing ...
3k views

### How to create an EC point from a plaintext message for encryption

It seems that ElGamal encryption is also possible for Elliptic Curve cryptography. However, that requires the user to convert the message to a point on the curve. What strategies are there to derive a ...
2k views

### ECIES/ ECDHE/ EC-ElGamal encryption comparison

I need to choose an encryption system, so I am trying to understand the differences between the existing options. I always find that people compare ECIES (Elliptic Curve Integrated Encryption Scheme) ...
2k views

### libsodium x25519 and Ed25519 small order check

Studying libsodium implementation of x25519 and Ed25519 I saw that it performs an small order check comparing given inputs with a hard coded blacklist of values. Is this list exhaustive or it is a ...
2k views

### What are the coordinates of a generator point?

I'm browsing through Curve25519 code, the generator point of it is $G=9$. I would like to know how can I get $x$ and $y$ coordinates of this generator point. Is there any standard way of ...
2k views

### Can a raw ECDH shared secret be used directly for encryption?

If two parties calculate an ECDH shared secret can they (with no security weakness) use this raw value directly as an encryption key, assuming the underlying key and ECDH sizes match? Also the ...
2k views

### Why Elliptic curve cryptography are not popular in practice

RSA and ElGamal can be implemented using the technique of Elliptic curves. I am confused on why the it seems that Elliptic curves are not so popular in cryptographic applications since they provide ...
909 views

### Why do the discriminant and primality of the group order of an elliptic curve affect security?

In a book about cryptography and elliptic curves, there was a mention that not all curves are secure, and a statement than in order to pick a secure curve the curve must satisfy 3 requirements. The ...
2k views

### Ed25519 PKCS8 private key example from IETF draft seems malformed

Malformed PKCS8 Key Algorithm Identifiers for Ed25519, Ed448, X25519 and X448 for use in the Internet X.509 Public Key Infrastructure § 10.3. Examples of Ed25519 Private Key states the following: <...
6k views

### Can elliptic curve (25519) be used to encrypt file?

This is probably a simple question, but I haven't been able to see it stated anywhere. Is it possible to directly encrypt a file (of any length) with some form of EC using the 25519 curve. I know it'...
2k views

### Elliptic curve parameters

What's the meaning of "160-bit curve" in an elliptic curve? Or 192, 224, 256, etc. And what is the standard for selecting this number of bits? Why they don't say "100-bit curve"?
4k views

### How do I unpack the x and y values from the BITSTRING in a DER ECDSA public key?

In ASN.1, the X and Y values for a 256-bit elliptic curve key are stored as a single 66-byte ASN.1 BITSTRING. Are the values just the first and second half of this bitstring? The private key is an ...
895 views

### Besides key and ciphertext sizes what are other advantages of elliptic curve versions of various protocols?

There are elliptic curve variants of Diffie-Hellman, ElGamal, DSA and possibly other protocols/algorithms. I know that these elliptic curve variants have smaller key and ciphertext sizes which will ...
1k views

### Is there an algorithm to check if an elliptic curve is secure?

As I understand it elliptic curves are of the form $y^2 = x^3 + ax + b$ Where $a$ and $b$ are the curve parameters. However not all parameters will give a curve suitable for crypto purposes. Is there ...
2k views

### What's the point and use of 512-bit-style elliptic curves?

There is a plethora of elliptic curves that are close to the 256-bit security level (i.e., fields and groups of approximately 512 bits). Examples are Curve448, P-521, Brainpool-P512. The standard ...
4k views

### How can Shor's Algorithm be applied to ECC?

I have not found a specific answer to this question on here. Shor's algorithm can be used to factorize a large (semi)prime $N$ by reducing the task to period-finding of a function $f(x)=x^a$ mod $N$. ...
1k views

### Does the backdoor in Dual_EC_DRBG work like that?

From what I read, the backdoor in Dual_EC_DRBG operates by using related $P$ and $Q$ points. Did I understand the idea correctly? Dual_EC_DRBG works by multiplying the $P$ point with the seed ...
674 views

### Is SHA-1 safe for signing ECDHE parameters?

Is using the SHA-1 algorithm insecure for hashing the ephemeral ECDH public key in the signed_params structure? There are some worrying articles about using SHA-1: ...
1k views

### ECDSA signature verifiable 1-way transformations

Alice signs a message $m$ with her private key, yielding a signature ($r$,$s$). I want to prove to someone else that I have this signature, but I don't want them to have the knowledge of what ($r$,$s$...
2k views

### X9.62 Multiplying an elliptic curve point by a number

I'm currently trying to implement ecdsa and the first problem i met -- multiply an elliptic curve point by a number. As far as i understand X9.62 gives some recommendation for doing it but i haven'...
4k views

### Difference between Pure EdDSA (ed25519) and HashEdDSA (ed25519ph)

My question refers to EdDSA as specified in RFC 8032. I get from the RFC that ed25519 and ed25519ph are two different instances of EdDSA mainly differing in the fact that that in the case of ed25519ph ...
2k views

### Difficulty of Reversing Elliptic Curve

In ECC, it is apparently easy to verify the final point given the starting point and the number of hops. But it is difficult to compute the number of hops given just the starting point and the final ...
814 views

### Goofs that could creep in ECDSA signature verification?

What are goofs that could creep in ECDSA signature verification, perhaps with focus on curves based on prime-order $\mathbb Z_p$, specifically P-256 aka secp256r1? Is it possible to construct test ...
1k views

### Why does anyone use elliptic curves for a CSPRNG?

I saw Martijn Grooten's talk on elliptic curves at BSides London this year, and it helped me understand how elliptic curve crypto works, especially in the case of Diffie-Hellman (ECDH). He also ...