Questions tagged [elliptic-curve-generation]

ECC is an approach to public-key cryptography based on the algebraic structure of elliptic curves over finite fields. ECC allows smaller keys compared to non-EC cryptography (based on plain Galois fields) to provide equivalent security. Elliptic curves are applicable for key agreement, digital signatures, pseudorandom generators, and other tasks. they can be used for encryption by combining the key agreement with an asymmetric encryption scheme.

Filter by
Sorted by
Tagged with
2 votes
1 answer
136 views

Generating pseudorandom numbers using Dual_EC_DRBG

I am currently learning about the Dual_EC_DRBG protocol and I am stuck at the calculation of the initial state with the point P. For context, I am using the secp256k1 curve with a = 0 and b = 7. I ...
Nosticlov's user avatar
3 votes
1 answer
128 views

Standard Montgomery curves over prime field

Is there some source of standard, vetted, efficient Montgomery elliptic curves over prime field? I'm looking for curves $B\,y^2\equiv x^3+A\,x^2+x\pmod p$ engineered for efficient computation of ...
fgrieu's user avatar
  • 140k
0 votes
0 answers
78 views

Generating a new curve using an existing curve and new prime

Can you take a curve equation from https://safecurves.cr.yp.to and a large safe prime from existing DH parameters (for example openssl dhparam 9000), combine them, ...
user avatar
3 votes
0 answers
136 views

EC public key with leading zeros

Let us take example of secp256k1 curve. The current known public key with most leading zero (in x cordinate) is: ...
madhurkant's user avatar
0 votes
0 answers
45 views

Practical deployments of ECC with cofactor of elliptic curves $4$ or $8$?

Are cofactor $4$ and $8$ ECC schemes widely used in practical deployments such as those in cryptocurrencies? Can you name some practical settings where there curves are used and cryptocurrencies where ...
Turbo's user avatar
  • 908
0 votes
1 answer
79 views

Non-interactive EC DKG (Distributed Key Generation) question

Normally, when computing an EC threshold DKG, I have all parties reveal a commitment to the public key, and only reveal their own public key after verifying the commitments. Otherwise it's trivial ...
Erik Aronesty's user avatar
5 votes
1 answer
273 views

Binary Elliptic Curves Point Doubling Formula - Calculate Lambda from P3

As I am studying ordinary (non-supersingular) binary elliptic curves in the Guide to ECC book by Hankerson (Section 3.1, page 81), for point doubling, the equations presented in the book are: $x_3 = \...
prairie99's user avatar
2 votes
2 answers
170 views

Can you find a secure curve defined over the scalar field of secp256k1?

Is it possible to find a secure curve which's base field is the scalar field of secp256k1? In general, can you find a secure curve defined over the scalar field of any secure curve? (For example, a ...
RobinLinus's user avatar
1 vote
1 answer
52 views

Scalar Multiplication using NAF method

I am learning about Elliptic curve scalar multiplications and I am on NAF, and I am trying to figure out the concept. What I understand is if I have K=27 with using ...
Cisco Saeed's user avatar
0 votes
0 answers
35 views

Binary vs Prime field-Elliptic Curve Cryptography [duplicate]

Binary extension and prime field-based elliptic curves are used in Elliptic curve cryptography (ECC). From the performance point of view, ECC using Binary field are faster and easy to compute on ...
Khalid's user avatar
  • 307
2 votes
0 answers
184 views

Forging an ECDSA signature for a random public key string

An adversary is able to insert a random string (which he does not control: he can only randomly generate it and insert it). The random string is parsed by the victim as an ECDSA public key. This ...
Joe's user avatar
  • 73
2 votes
1 answer
136 views

What is the equation to get P-Q in Montgomery curve XZ coordinates

Based on Differentia-addition on P I can understand (Xp,Zp) which is the base point, (Xq,Zq) which comes from Doubling, but I ...
Cisco Saeed's user avatar
3 votes
1 answer
394 views

Criteria for choice of prime field in secp256k1?

In secp256k1, the prime order field $\mathbb F_p$ uses $$p=2^{256}-2^{32}-977$$ This is the largest prime $p$ less than $2^{256}-2^{32}$ allowing to construct a Koblitz curve $y^2\equiv x^3+b\bmod p$ ...
fgrieu's user avatar
  • 140k
2 votes
1 answer
139 views

Elliptic curve Jacobian coordinates example

I am working on Matlab Jacobian coordinates, I want a jacobian coordinates example with numbers include doubling and additions based on k value to test the code if ...
Mohammad Khaled's user avatar
3 votes
1 answer
178 views

Elliptic Curve NAF scalar method

I am new in Elliptic curve and I got a lot of knowledge through reading :) but I reached to NAF method as a scalar multiplication method, but don't understand how in this example get it: ...
Cisco Saeed's user avatar
1 vote
1 answer
937 views

How to know if a public key has been created based on the ECDSA algorithm?

Suppose in a network, the identity of users is their public key, which is generated based on the ECDSA algorithm. That is, to create a valid identity, a user must generate an ECDSA public key and then ...
Questioner's user avatar
0 votes
0 answers
158 views

Fast methods for adding the basepoint to an elliptic curve point?

Are there any clever (fast) methods for adding the basepoint (generator) to an arbitrary point on elliptic curve, finally ending in affine coordinates? I.e. if G is ...
pointat8's user avatar
2 votes
2 answers
177 views

How is the edwards448 generator derived from the curve448 generator in RFC 7748?

In RFC 7748, it is explained how the Montgomery curve, curve448, is deterministically generated from the prime $p = 2^{448} - 2^{224} - 1$. It is also explained how the generator (given below) for ...
user61836's user avatar
2 votes
0 answers
57 views

Generating pairs of elliptic $\mathbb{F}_q$-curves isogenous over $\mathbb{F}_q$ such that nobody knows an $\mathbb{F}_q$-isogeny between them

Let $\mathbb{F}_q$ be a large finite field. What if I invent how to efficiently construct pairs of elliptic "cryptographically strong" $\mathbb{F}_q$-curves $E_1$, $E_2$ isogenous over $\...
Dimitri Koshelev's user avatar
2 votes
1 answer
82 views

Follow-up II: Number of points on an elliptic curve

Context: paper on pairing based cryptography, question 1, question 2. Let $E: y^2 = x^3+x$ be an elliptic curve over $\mathbb{F}_{q}$ where $q=3^m$ for some $m\geq 1$. Then I know that $$ \# E(\mathbb{...
fish_monster's user avatar
2 votes
1 answer
105 views

Follow-up: Number of points on an elliptic curve

Consider this question. Say I would want to do something similar for $E_2:y^2=x^3−x+1$ over $\mathbb{F}_{3^m}$. How would I proceed?
fish_monster's user avatar
3 votes
1 answer
147 views

Number of points on an elliptic curve

In his paper on pairing based cryptography, Menezes claims that for $$ E_1: y^2+y = x^3+x+1 $$ the number of $\mathbb{F}_{2^m}$-points is $2^m +1 - (1+i)^m - (1-i)^m$. Whereas this is clear, it is not ...
fish_monster's user avatar
1 vote
1 answer
118 views

Distribution of elliptic curves with rank 2?

An elliptic curve defined over a finite field is either cyclic, or a direct sum of two cyclic groups. In cryptography, we use exclusively the former. I was wondering if there is any result on how ...
zugzwang's user avatar
  • 119
1 vote
0 answers
202 views

How is ECDH shared secret represented in SoftHSM

I am working on implementing ECDH with some HSM. According to the theory behind ECDH, the generated shared secret is a point on the elliptic curve (x, y) which is exactly what is returned by the HSM. ...
Fan Zhang's user avatar
4 votes
3 answers
674 views

Do you know protocols, where it is necessary to obtain several "independent" points on the same elliptic curve?

Consider an elliptic curve $E$ defined over a finite field $\mathbb{F}_{\!q}$ with a fixed non-zero $\mathbb{F}_{\!q}$-point $P$. For simplicity, let the order of the $\mathbb{F}_{\!q}$-point group $E(...
Dimitri Koshelev's user avatar
1 vote
1 answer
849 views

What is the order of the generator point G=9 in curve25519?

In Curve25519 we typically have this generator point or base point: ...
RocketNuts's user avatar
  • 1,397
0 votes
0 answers
653 views

What attacks exist on ECDSA if there are more than 10 million signatures?

I am aware that there are weaknesses in ECDSA when reusing NONCE and I am aware that there is a lattice attack on ECDSA. Are ...
JDop's user avatar
  • 3
3 votes
0 answers
291 views

Elliptic Curve how to calculate y value [duplicate]

I have been reading the book Mastering Bitcoin written by Andreas. It was the process of compressing public keys that hurt my mind. Specifically, a public key after being generated from a private key ...
John Pham's user avatar
3 votes
2 answers
1k views

Modulo p in Elliptic Curve Cryptography

To carry out Elliptic Curve Cryptography between parties, are all elliptic curve equations considered to be in the form $\bmod p$? For example, the $secp256k1$ Bitcoin curve of the equation $y^2=x^3+7$...
EKahyaoglu's user avatar
3 votes
2 answers
504 views

Can two different hash function create two unlinkable `ed25519` keys from the same randomness?

Assume the following scenario: Alice has access to 32 bytes of true randomness $s$. Alice hashes $s$ with SHA-512, and uses the resulting hash as the secret $d_{A}$ for ...
cryptobeginner's user avatar
5 votes
1 answer
368 views

Why is Montgomery Ladder fast on Montgomery Curves?

When I look at the Montgomery Ladder algorithm, I don't find anything that is specific to the Montgomery curve. We are dealing with the points all the time i.e. we are either adding two points or ...
Gautham Krishna's user avatar
0 votes
0 answers
136 views

How to decompose a public key into subgroups EC?

Is it possible to decompose the public key into its own subgroups? Suppose we know the order P with which the public key was generated ...
Dew Debra's user avatar
0 votes
0 answers
68 views

How to get a common coordinate from two different coordinates on Elliptic Curves? [duplicate]

I am trying to write a SageMath script that multiplies two coordinates on Elliptic Curves into one common coordinate. SageMath Elliptic curves over finite fields ...
Dew Debra's user avatar
3 votes
1 answer
653 views

How to find out what the order of the base point of the elliptic curve is?

I wanted to use https://github.com/AntonKueltz/fastecdsa library and the function parameters for creating curve are: ...
Amadeusz Kreta's user avatar
0 votes
1 answer
97 views

what does "product of two cyclic groups" mean

I am reading "Elliptic curve cryptosystems" and the link is here(https://www.ams.org/journals/mcom/1987-48-177/S0025-5718-1987-0866109-5/S0025-5718-1987-0866109-5.pdf). I don't understand ...
painter Qiao's user avatar
8 votes
2 answers
989 views

Why Elliptic Curve Cryptography protocols depend on fixed curves?

I'm learning about Ed25519. It depends on a bunch of magic values: The finite field of order $2^{255}-19$, the specific elliptic curve over that field, a specific ...
Jasiu's user avatar
  • 181
1 vote
1 answer
256 views

ECDH public keys restrictions

I know that Bob can calculate the shared DH key without knowing the private key. If he sends to Alice a public key = 1, then the the DH key would be 1. Can i achieve something like this in ECDH? where ...
Ashraf Yassin's user avatar
4 votes
3 answers
652 views

Order of Edwards curve and its twist

In Mike Hamburg's Ed448-Goldilocks, a new elliptic curve (eprint 2015, WECCS 2015) it is studied untwisted Edwards curves in the prime field $\mathbb F_p$ $$E_d:\,y^2+x^2\,=\,1+d\,x^2\,y^2$$ with ...
fgrieu's user avatar
  • 140k
1 vote
2 answers
566 views

How to generate a random point on an elliptic curve without knowing it's corresponding scalar private key

Given an elliptic curve with generator $G$, is it possible to generate a random point on the curve $Q = a \cdot G$ without knowing the secret value $a$ that generated it? Note that just using an $a$ ...
chausies's user avatar
  • 335
3 votes
1 answer
350 views

In The Ristretto Group, do all points sampled with Elligator have the same order?

Assume the Hash-to-ristretto255 function Elligator as laid out here. Assume a random hash that is then mapped to a point in the <...
networkstudent's user avatar
0 votes
1 answer
753 views

Deterministic Key using a seed for ECNamedCurve

I am trying to generate deterministic keys using EC curve secp521r1 in java. I went through KDF but, couldn't find any references to use it with EC curves. I would appreciate if someone could point me ...
Nitish Bhardwaj's user avatar
0 votes
2 answers
229 views

Break El Gamal for Elliptic Curves

There is an elliptic curve El Gamal digital signature scheme. Alice fixes an elliptic curve $E$, a prime $p$, a point $A$ on $E$, a secret integer $a$, and computes $B = aA$. She makes $(E, ...
budding_crypto's user avatar
0 votes
2 answers
782 views

The Generator point and Mod P in ECDSA

I've been reading about The discrete logarithm problem as of recent and i decided to try it out on a small portion of numbers myself and i actually came to a mental gridlock after watching this Video....
Dave Kent 's user avatar
1 vote
0 answers
60 views

Why is it necessary that the mod in an elliptic curve is a prime? [duplicate]

For the elliptic curve y^2 = x^3+2x+2 mod(23), why is it necessary that 23 is a prime. Why is the elliptic curve y^2 = x^3+2x+2 mod(24) not suitable for elliptic curve cryptography?
Stijn de Vries's user avatar
3 votes
1 answer
797 views

How are the points in an elliptic curve over the finite field calculated?

For the elliptic curve with equation $y^2 = x^3 + x + 0 \pmod{13}$ in the finite field, how are all the points in this curve calculated. See the image below for an example created via https://graui.de/...
Stijn de Vries's user avatar
2 votes
1 answer
168 views

SafeCurves verification script

The SafeCurves project provides a Sage script to verify the SafeCurves criteria for given curves, https://safecurves.cr.yp.to/verify.html According to the description, the script works simply as: $ ...
x8cb91e82a33's user avatar
2 votes
1 answer
299 views

Diffie Hellman groups

I saw that non-negative integers with the addition operation cannot be the Diffie Hellman group. I'm having trouble understanding why it cannot be the DHKE group. To be DHKE group, there are five ...
user19283043's user avatar
1 vote
0 answers
112 views

Elliptic curve subgroup with $p$ elements in field of characteristic $p$

Are there any elliptic curves defined over a finite field $\mathrm{GF}(p^k)$ with a subgroup of order $p$ where the discrete log (and preferably DDH) problem is hard? Elliptic curve with prime ...
qbt937's user avatar
  • 258
1 vote
2 answers
647 views

How to convert coordinates o a point from y^2=x^3+7 to y^2=x^3+4? [closed]

To moderator, this my question is not off topic !!! Please OPEN MY QUESTION. If for this place elliptic curves was off topic this so world is crazy. ...
Marex's user avatar
  • 11
3 votes
1 answer
589 views

Significance of y-coordinates in ECDH public key exchange

In the research paper Breaking the Bluetooth Pairing – The Fixed Coordinate Invalid Curve Attack? by Biham and Neumann, 2019, they talk about attacks in Bluetooth pairing, they state that in the ...
shijuza's user avatar
  • 153