Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

Filter by
Sorted by
Tagged with
7 votes
3 answers
624 views

Do I understand (below) why Q = dP is easy while finding d is hard

As we all know for discussion of Dual_EC_DBRG, the point on an elliptic curve Q can be calculated from P and some (large) integer d $Q = dP$ And we know that knowledge of Q and P is not sufficient ...
Jeffrey Goldberg's user avatar
7 votes
2 answers
19k views

With OpenSSL and ECDHE, how to show the actual curve being used?

Using openssl s_client -host myserver.net -port 443 I can see the cipher negotiated is indeed using ECDHE for session key ...
oberstet's user avatar
  • 447
7 votes
3 answers
3k views

Timing Attacks on ECDSA, ECDHE, AES and SHA2

Are there any known timing attacks (both practical and theoretical) on any implementations of the following? ECDSA (I'm aware of this one - are there any applicable to prime fields?), ECDHE (again, ...
Chris Smith's user avatar
  • 1,192
7 votes
2 answers
2k views

Can SRP be used with Elliptic Curves?

I'm sure it can, because SRP (secure remote protocol) can be implemented everywhere where Diffie-Hellman works, but I need a proof to put this aspect into Wikipedia. Edit: ok, can it be at least ...
Smit Johnth's user avatar
  • 1,691
7 votes
1 answer
6k views

What are the differences between ephemeral-static ECDH and static-static ECDH?

As I know ECDH can be used with a fixed public key. I read there are two types of static ECDH, ephemeral-static ECDH, and static-static ECDH. What are the differences between these two types?
Aymn Alaney's user avatar
7 votes
1 answer
23k views

ECC key size and signature size

My understanding of ECDSA signature length is that it depends on the key size. So for instance, if a "prime256v1" is used, the signature length will be 64 because (n/8)*2 and for "secp384r1" it will ...
Ryu's user avatar
  • 223
7 votes
2 answers
5k views

Invalid curve attack: finding low order points

Background Here's a description of page 182 of "Guide to Elliptic Curve Cryptography" by Hankerson, Menezes and Vanstone. Here's a quote from that page: The main observation in invalid-...
Max Mikhaylov's user avatar
7 votes
1 answer
8k views

Understanding BLS12-381 Curve

I have some basic understanding of ECC - but pretty far from advanced concepts. I've been reading about BLS12-381 curve here and here, but I can't seem to fully understand it. The things that I think ...
irakliy's user avatar
  • 969
7 votes
1 answer
1k views

Can multiple public keys lead to the same shared secret in X25519?

I have no mathematical knowledge about this, but I just read in RFC 7748 the following: Designers using these curves should be aware that for each public key, there are several publicly computable ...
yuzi's user avatar
  • 73
7 votes
2 answers
4k views

Should we use IANA groups 14 (MODP), 25, and 26 (ECP)?

By looking at SonicWall Knowledge Base article Key exchange (DH) Groups Supported - Site to Site VPN: It appears that our firewall supports DH group 25, and 26. Almost everywhere I've seen, they've ...
wahmedBW's user avatar
7 votes
2 answers
1k views

Is there a good reason not to mention that ECC is weaker than RSA on a quantum computer?

In most papers and other documents I see people are considering an ECC key of 256 bits equivalent to an RSA key of 3072 bits, which is true on a classical computer. But the amount of qubits required ...
indolas's user avatar
  • 71
7 votes
2 answers
3k views

Is Curve25519 vulnerable to private key exposure in the case of a bad RNG?

I'm really excited by what I've learned of advancements in elliptic-curve cryptography. Curve25519 seems to be a great choice at this point in time, but if I recall correctly, some elliptic curve ...
Naftuli Kay's user avatar
7 votes
3 answers
2k views

Why are elliptic curves better than cyclic groups?

The set of points of an elliptic curve over a finite field is isomorphic to the direct product of two cyclic groups (i.e. $E(F_{p^n}) \cong Z_{s} \times Z_{t})$. What is the advantage of representing ...
user1992284's user avatar
7 votes
2 answers
4k views

How to create an EC point from a plaintext message for encryption

It seems that ElGamal encryption is also possible for Elliptic Curve cryptography. However, that requires the user to convert the message to a point on the curve. What strategies are there to derive a ...
Maarten Bodewes's user avatar
7 votes
1 answer
2k views

ECIES/ ECDHE/ EC-ElGamal encryption comparison

I need to choose an encryption system, so I am trying to understand the differences between the existing options. I always find that people compare ECIES (Elliptic Curve Integrated Encryption Scheme) ...
SaliaMun's user avatar
  • 127
7 votes
2 answers
509 views

Difference on montgomery curve equation between EFD and RFC7748

There is a subtle difference between the 2 implementations for a Montgomery curve defined from the 2 following links https://hyperelliptic.org/EFD/g1p/auto-montgom-xz.html A = X2+Z2 AA = ...
Pierre's user avatar
  • 426
7 votes
2 answers
2k views

libsodium x25519 and Ed25519 small order check

Studying libsodium implementation of x25519 and Ed25519 I saw that it performs an small order check comparing given inputs with a hard coded blacklist of values. Is this list exhaustive or it is a ...
user3368561's user avatar
7 votes
1 answer
2k views

What are the coordinates of a generator point?

I'm browsing through Curve25519 code, the generator point of it is $G=9$. I would like to know how can I get $x$ and $y$ coordinates of this generator point. Is there any standard way of ...
sg777's user avatar
  • 367
7 votes
1 answer
2k views

Why Elliptic curve cryptography are not popular in practice

RSA and ElGamal can be implemented using the technique of Elliptic curves. I am confused on why the it seems that Elliptic curves are not so popular in cryptographic applications since they provide ...
Faith's user avatar
  • 445
7 votes
1 answer
1k views

Why do the discriminant and primality of the group order of an elliptic curve affect security?

In a book about cryptography and elliptic curves, there was a mention that not all curves are secure, and a statement than in order to pick a secure curve the curve must satisfy 3 requirements. The ...
KMG's user avatar
  • 403
7 votes
1 answer
2k views

Ed25519 PKCS8 private key example from IETF draft seems malformed

Malformed PKCS8 Key Algorithm Identifiers for Ed25519, Ed448, X25519 and X448 for use in the Internet X.509 Public Key Infrastructure § 10.3. Examples of Ed25519 Private Key states the following: <...
neubert's user avatar
  • 2,937
7 votes
4 answers
6k views

Can elliptic curve (25519) be used to encrypt file?

This is probably a simple question, but I haven't been able to see it stated anywhere. Is it possible to directly encrypt a file (of any length) with some form of EC using the 25519 curve. I know it'...
user543's user avatar
  • 73
7 votes
4 answers
2k views

Elliptic curve parameters

What's the meaning of "160-bit curve" in an elliptic curve? Or 192, 224, 256, etc. And what is the standard for selecting this number of bits? Why they don't say "100-bit curve"?
zahra's user avatar
  • 113
7 votes
2 answers
4k views

How do I unpack the x and y values from the BITSTRING in a DER ECDSA public key?

In ASN.1, the X and Y values for a 256-bit elliptic curve key are stored as a single 66-byte ASN.1 BITSTRING. Are the values just the first and second half of this bitstring? The private key is an ...
joeforker's user avatar
  • 561
7 votes
2 answers
897 views

Besides key and ciphertext sizes what are other advantages of elliptic curve versions of various protocols?

There are elliptic curve variants of Diffie-Hellman, ElGamal, DSA and possibly other protocols/algorithms. I know that these elliptic curve variants have smaller key and ciphertext sizes which will ...
mikeazo's user avatar
  • 38.6k
7 votes
1 answer
1k views

Is there an algorithm to check if an elliptic curve is secure?

As I understand it elliptic curves are of the form $y^2 = x^3 + ax + b$ Where $a$ and $b$ are the curve parameters. However not all parameters will give a curve suitable for crypto purposes. Is there ...
user1028028's user avatar
7 votes
2 answers
2k views

What's the point and use of 512-bit-style elliptic curves?

There is a plethora of elliptic curves that are close to the 256-bit security level (i.e., fields and groups of approximately 512 bits). Examples are Curve448, P-521, Brainpool-P512. The standard ...
Ruben De Smet's user avatar
7 votes
2 answers
2k views

Difficulty of Reversing Elliptic Curve

In ECC, it is apparently easy to verify the final point given the starting point and the number of hops. But it is difficult to compute the number of hops given just the starting point and the final ...
Alex G's user avatar
  • 81
7 votes
1 answer
4k views

How can Shor's Algorithm be applied to ECC?

I have not found a specific answer to this question on here. Shor's algorithm can be used to factorize a large (semi)prime $N$ by reducing the task to period-finding of a function $f(x)=x^a$ mod $N$. ...
indiscreteLog's user avatar
7 votes
1 answer
1k views

Does the backdoor in Dual_EC_DRBG work like that?

From what I read, the backdoor in Dual_EC_DRBG operates by using related $P$ and $Q$ points. Did I understand the idea correctly? Dual_EC_DRBG works by multiplying the $P$ point with the seed ...
Mark's user avatar
  • 835
7 votes
1 answer
695 views

Is SHA-1 safe for signing ECDHE parameters?

Is using the SHA-1 algorithm insecure for hashing the ephemeral ECDH public key in the signed_params structure? There are some worrying articles about using SHA-1: ...
wilson's user avatar
  • 71
7 votes
2 answers
1k views

ECDSA signature verifiable 1-way transformations

Alice signs a message $m$ with her private key, yielding a signature ($r$,$s$). I want to prove to someone else that I have this signature, but I don't want them to have the knowledge of what ($r$,$s$...
Christophe Biocca's user avatar
7 votes
1 answer
2k views

X9.62 Multiplying an elliptic curve point by a number

I'm currently trying to implement ecdsa and the first problem i met -- multiply an elliptic curve point by a number. As far as i understand X9.62 gives some recommendation for doing it but i haven'...
ted's user avatar
  • 255
7 votes
1 answer
5k views

Difference between Pure EdDSA (ed25519) and HashEdDSA (ed25519ph)

My question refers to EdDSA as specified in RFC 8032. I get from the RFC that ed25519 and ed25519ph are two different instances of EdDSA mainly differing in the fact that that in the case of ed25519ph ...
grees's user avatar
  • 391
7 votes
2 answers
833 views

Goofs that could creep in ECDSA signature verification?

What are goofs that could creep in ECDSA signature verification, perhaps with focus on curves based on prime-order $\mathbb Z_p$, specifically P-256 aka secp256r1? Is it possible to construct test ...
fgrieu's user avatar
  • 142k
7 votes
1 answer
1k views

Why does anyone use elliptic curves for a CSPRNG?

I saw Martijn Grooten's talk on elliptic curves at BSides London this year, and it helped me understand how elliptic curve crypto works, especially in the case of Diffie-Hellman (ECDH). He also ...
Polynomial's user avatar
  • 3,527
7 votes
1 answer
5k views

How does ECDHE_RSA key exchange mechanism work?

Using Wireshark, I found these data exchanged with google.com over TLS: Client Hello possible cipher suites and possible curve types (eg. secp256r1) sent Server Hello cipher suite selected ...
user2781994's user avatar
7 votes
2 answers
4k views

Understanding elliptic curve encryption [closed]

I'm having a hard time understanding the elliptic curve encryption. One thing thing I don't understand is listing all the points on the curve mod p. Suppose I have the following elliptic curve: $y^2 = ...
SilverTear's user avatar
7 votes
2 answers
1k views

Endomorphism ring of a Elliptic Curve and $j$ invariant

I am reading Schoof's 1995 paper, Counting points on elliptic curves over finite fields, page 236, Proposition 6.1(i). I am trying to understand page 238 (second paragraph) of the proof: if the ...
student's user avatar
  • 83
7 votes
1 answer
3k views

ECDSA security using same per-message secrets $k$ but different signing keys

I know that when I have a ECDSA keypair and use it twice with the same $k$ to sign different messages then the private key can be recovered. If I now have multiple ECDSA keypairs and sign a message ...
Markus Knecht's user avatar
7 votes
1 answer
277 views

CSIDH - l ideal generators

I am trying to study the CSIDH algorithm. I have some beginner background in elliptic curves and I have been following Andrew Sutherland's lectures (https://math.mit.edu/classes/18.783/2019/lectures....
honzaik's user avatar
  • 452
7 votes
2 answers
2k views

Why does Smart's attack only work on anomalous curves?

Nigel Smart's attack solves the discrete logarithm problem in linear time. It requires the curve, however, to be anomalous, i.e. to have a trace of Frobenius equal to one or, equivalently, to be of ...
Rufus Anton's user avatar
7 votes
1 answer
564 views

Which attacks are possible against raw/textbook elliptic curve?

A quick question, we know that raw RSA is a no go. To solve this we have different PKCS standards forcing structure on the input messages. For EC the story is something else. For signatures we have ...
Anonymous's user avatar
  • 431
7 votes
1 answer
1k views

Elliptic curves for ECDSA

I'm trying to implement parameters generation for ECDSA according to SEC1 v2.0: ...
ted's user avatar
  • 255
7 votes
1 answer
616 views

What does Shor's algorithm tell us about the complexity class of RSA and the DLP?

If quantum computers operate in BQP and (using Shor's algorithm) they are able to factor large integers and break the discrete log problem, what does that tell us about the complexity class of these ...
Sebastian's user avatar
  • 461
7 votes
1 answer
3k views

ECC considered secure in OpenSSL?

If I perform the following command: openssl ecparam -list_curves using my OpenSSL version (1.0.1f), it spits out the following supported curves: ...
rudezorp's user avatar
7 votes
1 answer
539 views

Is it important to defend against key substitution attack in ECDSA?

When planning a file signature scheme (basically, just to sign all files content). Is it obligatory to defend against ECDSA key substitution attack? ISO/IEC 14888-3:2018 NOTE 5 states: The ...
catpnosis's user avatar
  • 635
7 votes
1 answer
688 views

Proving that the least significant bit of an elliptic curve discrete logarithm is $0$

Suppose I have a secret value $a$ which maps to a public point on an elliptic curve $A = a \cdot G$, where $G$ is a generator of the elliptic curve of prime order $q$. Can I prove to someone that the ...
irakliy's user avatar
  • 969
7 votes
1 answer
437 views

Sextic twist over BN elliptic curves

I am struggling to understand how to perform a sextic twist over a BN elliptic curve. This is what I understood so far: Let's consider a BN elliptic curve: $$ E: y^2=x^3+b $$ And let's consider a ...
Baham91's user avatar
  • 71
7 votes
1 answer
173 views

How important is hardware based crypto in Quantum-safe TLS in mobile devices?

Microsoft Research published an approach to Quantum-safe TLS here, namely RLWE-ECDSA-AES128-GCM-SHA256. One highlight is that when it's used with ECC, there is only a slight performance hit. ...
makerofthings7's user avatar

1
3 4
5
6 7
44