Search Results
| Search type | Search syntax |
|---|---|
| Tags | [tag] |
| Exact | "words here" |
| Author |
user:1234 user:me (yours) |
| Score |
score:3 (3+) score:0 (none) |
| Answers |
answers:3 (3+) answers:0 (none) isaccepted:yes hasaccepted:no inquestion:1234 |
| Views | views:250 |
| Code | code:"if (foo != bar)" |
| Sections |
title:apples body:"apples oranges" |
| URL | url:"*.example.com" |
| Saves | in:saves |
| Status |
closed:yes duplicate:no migrated:no wiki:no |
| Types |
is:question is:answer |
| Exclude |
-[tag] -apples |
| For more details on advanced search visit our help page | |
Results tagged with elliptic-curves
Search options not deleted
user 43864
Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.
2
votes
1
answer
2k
views
How to convert from curve25519 33 byte to 32 byte representation
According to the curve25519 paper a x25519 public key can be represented in 32 bytes.
The x25519 library I'm using (bouncycastle) however gives me a 33 byte representation according to this standard. …
- 4,790
4
votes
1
answer
1k
views
How to use a random 32 byte sequence as a curve25519 public key
According to the Wikipedia Curve25519 article, Curve25519 "accepts any 32-byte string as a valid public key and does not require validation"
However, I need to provide BouncyCastle with a 33 byte key …
- 4,790
3
votes
1
answer
277
views
Why do curve25519 implementations only have ge_frombytes_negate_vartime, and not a regular g...
In every implementation I can find, there is ge_frombytes_negate_vartime but not a regular ge_frombytes method.
I'm assuming there is a deep mathematical reason for things being this way that I'm hop …
- 4,790
3
votes
2
answers
334
views
How to prove that two EC public keys created with two different generators share the same se...
Consider a situation where there is a (scalar) secret key $x$, known only to Alice.
There are two well known generator points $G$ and $H$, known to both Alice and Bob. $H$ is chosen such that discrete …
- 4,790
0
votes
How to prove that two EC public keys created with two different generators share the same se...
A Chaum-Pedersen discrete logarithm equivalence (DLEQ) proof will demonstrate that the private key for the public key $A$ on the base point $G$ is the same private key for the public key $B$ on the ba …
- 4,790
1
vote
Random Generation a Valid Scalar on the Chosen Curve
Scalars are not "on the curve". Scalars are just positive integers (including zero) less than the group order $\ell$ of the curve generator. E.g. for the Ed25519 curve, the group order $\ell$ is $2^{2 …
- 4,790
2
votes
1
answer
227
views
Discovery of Ed25519 128-bit private key where a KDF has not been used
If there is a uniformly random 128-bit private key scalar $x$, with the corresponding public key $X=xG$ (where $G$ is a well-known base point), how difficult would it be to discover $x$ from $X$?
I am …
- 4,790
8
votes
Accepted
Replacing Curve25519 with Ristretto255
The Monero vulnerability was related to "key images". When signing a transaction to spend an output, a unique EC point called a "key image" is produced as a result of the signature. This key image uni …
- 4,790
3
votes
0
answers
99
views
Which safe elliptic curves allow for the fastest scalar multiplication
I'm specifically looking for curves that are safe (ideally on this list: https://safecurves.cr.yp.to/) and which allow for the fastest scalar multiplication operations on arbitrary points.
By 'arbit …
- 4,790
1
vote
ECC Range proof
Proving that $-z\leq x-y\leq z$ given $C=xG-yG=(x-y)G$ is the same as proving that $0\leq a<n$ where $a=z + x - y$ and $n=2z+1$ given $C'= aG = C + zG$.
$C'$ can be considered a Pedersen commitment of …
- 4,790
4
votes
2
answers
556
views
How to efficiently find the distance between two EC point private keys
There exist two EC private keys $x_1$ and $x_2$, where their corresponding public keys on the well-known base point $G$ are $X_1=x_1G$ and $X_2=x_2G$ respectively. The order of the cyclic group genera …
- 4,790
5
votes
2
answers
185
views
EC: How to prevent discovery of base point after commutative operation
If I have a scalar $x$ and point $B$, then I can compute $X = f(x,B)$
If the function $f$ is point multiplication, i.e. $f(x,B) = x \cdot B$, then $B$ can be determined if $X$ and $x$ are known.
Und …
- 4,790
8
votes
1
answer
325
views
Bob has an EC key pair. How can he receive a small integer in the least compute intensive way?
Alice wishes to send Bob a number $n$ between 0 and 255.
Bob has a private, public EC key pair $(b, B)$ where $B = bG$ and $G$ is an already agreed upon base point on the ed25519 curve.
Alice could …
- 4,790
0
votes
1
answer
2k
views
Reasoning about WebCrypto ECDSA choices: P-256/384/521, SHA-1/256/384/512?
When implementing EC signing/verification in Javascript, the only options available via the WebCrypto API are:
Curves: P-256, P-384, or P-521
Hashes: SHA-1, SHA-256, SHA-384, or SHA-512
If I was no …
- 4,790
4
votes
Accepted
How to attest simultaneous knowledge of $2$ private keys?
Alice has the (private, public) EC key pair $(a, A=aG)$, and Bob has $(b, B=bG)$.
Let's say that Alice starts the signature, and gives it to Bob to complete (or somehow collaborates with Bob to comple …
- 4,790