Questions tagged [elliptic-curves]

Elliptic curves are algebraic-geometric structures with applications in cryptography. Such a curve consists of the set of solutions to a cubic equation over a finite field equipped with a group operation. Questions relating to elliptic curves and derived algorithms should use this tag and might also consider more specific tags such as discrete-logarithm and ecdsa.

Filter by
Sorted by
Tagged with
-1 votes
0 answers
15 views

Expected data is incorrect when scalar_mul_size is different from the modulus size in ECC MUL [closed]

Does that when the scalar_mul_size was different from the modulus_mul_size this impact on the output data?
amjed ghrairi's user avatar
0 votes
0 answers
32 views

How to calculate Cardinality of an Elliptic curve over $\mathbb Z_{23}$

How to calculate Cardinality of an Elliptic curve over $\mathbb Z_{23}$. $E: y^2 = x^3 + x + 1$ defined over $\mathbb Z_{23}$.
Sanjai Kumar's user avatar
2 votes
1 answer
183 views

Can we use several times the same RSA and ECC keys?

For RSA or elliptic cryptography, can we use the same public/private keys for several exchanges, or is that unsafe? Does it lower the security of the protocol? To me it doesn't matter, as receiving ...
Wheatley's user avatar
  • 145
3 votes
0 answers
61 views

Is it fine to use ECDSA with edwards25519?

The elliptic.js library allows instantiating ECDSA with the edwards25519 curve. I've rarely seen this combination in the wild. ...
mti's user avatar
  • 609
1 vote
1 answer
57 views

Is injective encoding of a message important for Elliptic Curve ElGamal?

I'm trying to understand if using non-injective encodings for Elliptic Curve ElGamal encryption is dangerous. A standard probabilistic encoding defined by Koblitz for elliptic curves over $\mathbb{F}...
pintor's user avatar
  • 558
2 votes
1 answer
135 views

Generating pseudorandom numbers using Dual_EC_DRBG

I am currently learning about the Dual_EC_DRBG protocol and I am stuck at the calculation of the initial state with the point P. For context, I am using the secp256k1 curve with a = 0 and b = 7. I ...
Nosticlov's user avatar
0 votes
0 answers
28 views

P256 signature verification was succeed with 2 public key [duplicate]

I tried to recover public key from P256 signature. With 2 recovery id ( 0, 1 ), signature makes 2 public key. And I tried to verify signature with public key and verification was succeed all of 2 keys....
박해성's user avatar
2 votes
1 answer
89 views

Not understanding elliptic curve scalar multiplication to produce Ethereum address

This is the equation Public key = Private key * G Here, ...
Asif Iqbal's user avatar
1 vote
1 answer
122 views

How to calculate Legendre Symbol in secp256k1 Elliptic Curve

In this answer by fkraiem he proves a property that: $a^{(p-1)/2} = 1$ if and only if $x$ is even But this doesn't seem to work in my test with the secp256k1 Elliptic Curve. Here is my Python 2 ...
Devanshu Linux's user avatar
4 votes
1 answer
246 views

Distinguishing EC Public Key from random

I recently read the post Distinguishing x25519 public keys from random? and found myself wondering why, for a randomly chosen x, the result of the function $$x^3+ax^2+x$$ is a square in 50% of cases ...
Safari1811's user avatar
0 votes
1 answer
93 views

In multiplicative subgroup Fp* of an elliptic curve does multiplying an element make it leave the subgroup?

In the case of an Elliptic curve over a GF(p) which has order n and multiplicative group of n-1 elements, does multiplication of an element of a subgroup of order q where q is a divisor of n-1 with a ...
immigrantswede's user avatar
3 votes
1 answer
126 views

Standard Montgomery curves over prime field

Is there some source of standard, vetted, efficient Montgomery elliptic curves over prime field? I'm looking for curves $B\,y^2\equiv x^3+A\,x^2+x\pmod p$ engineered for efficient computation of ...
fgrieu's user avatar
  • 140k
0 votes
0 answers
40 views

Secure key exchange for custom USB device

I'm learning various cryptography protocols and use cases and since I'm developing a USB device and PC application, it would be nice to use encrypted communication. I studied TLS 1.2 key exchange but ...
unalignedmemoryaccess's user avatar
0 votes
0 answers
46 views

ECC, Montgomery Curve cofactor bigger than 1

I read that in elliptical curve cryptography, the order of the Montgomery Curve is a multiple of 8, this mean that we can't have cofactor one curves which can be problematic in some corner cases ...
Nawras Hussein's user avatar
3 votes
1 answer
101 views

BLS curve with a smaller modulus?

To achieve approximately 128 bits of security, curve BLS12-381 uses 381 bits to encode the X coordinate. This means the size of a group element needs at least 48B to store/transmit. I am in a ...
Chunchi Liu's user avatar
1 vote
0 answers
112 views

ECDSA: Can we use the private key for a different curve? [closed]

ECDSA can be instantiated with a variety of different elliptic curve groups. Two example curves are secp256k1 and edwards25519. ...
mti's user avatar
  • 609
0 votes
0 answers
61 views

ed25519: Scalar multiplication guaranteed to land in prime order subgroup?

ed25519 is defined over curve edwards25519 which has a large prime order subgroup and a small subgroup of order 8. During key generation, bit clamping is used to ...
mti's user avatar
  • 609
0 votes
1 answer
67 views

Threshold ed25519: How to export keys?

Consider ed25519 signing (RFC 8032). There, the private key is a 32-byte random value, and for signature generation, the 32-byte private key is first hashed and then the secret scalar and nonce are ...
mti's user avatar
  • 609
3 votes
1 answer
118 views

Problem with efficiency of projective coordinates in Elliptic Curve arithmetic

Ok sort of long post incoming. Will go slow to make it as clear as possible I'm trying to build a C library for Elliptic Curve Arithmetic. Since the idea is to learn from the process, I decided to ...
popeye's user avatar
  • 95
1 vote
1 answer
63 views

Convert XZ Montgomery Curve Points to Twisted Edwards Curve Points (Inversion-Free)

This question covers how to convert a projective point $(X_E, Y_E, Z_E)$ on a twisted Edwards curve to a projective point $(X_M, Y_M, Z_M)$ on a Montgomery Curve. Using XZ coordinates, there is no ...
rndm_me's user avatar
  • 76
1 vote
1 answer
161 views

Cheating in a Pedersen-based auction

Imagine a simple auction made with Pedersen commitments rather than sealed envelopes. Participant 1 commits their bid, $b_1$, choosing a blinding factor $x_1$ and using publicly known G and H ...
A. Darwin's user avatar
  • 486
3 votes
1 answer
121 views

EdDSA signing modification

I've got a question regarding the signing algorithm on elliptic curves (EdDSA). In ed25519 signature scheme there is no nonce $k$, instead every message has its own different hash. From what I know ...
ThomasJady's user avatar
3 votes
0 answers
112 views

How do you securely implement a finite field?

I'm not sure if this question belongs here or to StackOverflow. Please flag it if not. I'm trying to implement a standalone library for finite field arithmetic of prime and prime power order as a way ...
tur11ng's user avatar
  • 962
4 votes
0 answers
178 views

Split a private key into shares and sign successively or separately

Assume I have a private key, priv_k, a public key pub_key and a message, msg, along with its ...
Ryan's user avatar
  • 141
1 vote
1 answer
92 views

Why we need z-coordinate in Montgomery Curve?

In Montgomery Curve $By^2=x^3+Ax^2+x$, B $\neq$ 0, A $\neq$ +2 or -2. First case: If $x_{1}$=$x_{2}$ and $y_{1}$=$y_{2}$$\neq$0: then s=($3(x_{1})^2$+$2Ax_{1}$)/(2B$v_{1}$). If $x_{1}$$\neq$$x_{2}$: ...
Nawras Hussein's user avatar
3 votes
1 answer
629 views

Why is the constant in Montgomery Curve code 121665 instead of 486662 in the formula?

In the Montgomery Curve $y^2=x^3+486662x^2+x$, $A=486662$. So, why when applying its code in Python or another programming language, $A=121665$? ...
Nawras Hussein's user avatar
2 votes
1 answer
123 views

Loop back or cyclic nature of secp256k1 curve

I am working with point addition and scalar multiplication on the secp256k1 curve for points $(x,y)$ or public keys to derive the next public key scalar k times further from it. Actually when I use a ...
Aflatoon's user avatar
1 vote
1 answer
117 views

How can we derive G from P and N?

I would like to find the fastest way to derive G for secp256k1 and secq256k1 curves, does anyone know the method, equation? Edit: I'm interested to know how can this happen, when we use n/2 of ...
Aggregator's user avatar
1 vote
1 answer
69 views

Hashing to the target group of bilinear pairing

Assuming we have fixed pairing friendly elliptic curve groups $G_1$, $G_2$ and $G_T$ where for $a \in G_1$ and $b \in G_T$ it holds $e(a,b) \in G_T$. Let's put some more context and we are working in ...
curious's user avatar
  • 6,150
1 vote
1 answer
84 views

Mapping two different elliptic curve on same finite field

There exist two such question but I have noticed my question is fundamentally different as it asks for mapping between two different curves, rather two different prime field like this. Given a finite ...
madhurkant's user avatar
1 vote
2 answers
145 views

Understanding Pollard's Rho method for solving ECDLP

I am trying to understand illustrative example of Pollard's Rho method to solve ECDLP from the book "Guide to Elliptic Curve Cryptography" I am referring to Algorithm 4.3 and Example 4.4 ...
Sudhanwa Deo's user avatar
0 votes
1 answer
86 views

Which SafeCurves critics about Brainpool twisted curves apply to the corresponding random curves?

In SafeCurves: choosing safe curves for elliptic-curve cryptography, Daniel J. Bernstein and Tanja Lange characterize Brainpool curves of the twisted variety (e.g. brainpoolP256t1) as not "Safe&...
fgrieu's user avatar
  • 140k
0 votes
3 answers
112 views

Elliptic curves parameters data

Is there an official database with curve parameters for common curves? Asking for generator point, order, prime, a, b I found one for secp256k1 in the mbedtls ...
unalignedmemoryaccess's user avatar
1 vote
1 answer
159 views

BN254 specification?

Sorry for asking another question but is BN254 specification standardized? I am using two different implementations one python another solidity and the prime field $F_p,F_{p^2}$ and the the group ...
Manish Adhikari's user avatar
1 vote
2 answers
161 views

Challenge with curve ed25519

Recently a friend of mine showed me a "puzzle" he created with curve ed25519 It is based on adding and multiplying points on the curve You supply three arguments to the program ...
denth's user avatar
  • 11
1 vote
1 answer
52 views

Similar to Diffie Hellman for BLS in asymmetric pairing?

I had asked one question before One-More Computational Diffie-Hellman in asymmetric pairing groups and have not received answer. I am posing a supplementary question now that I just realized I don't ...
Manish Adhikari's user avatar
2 votes
2 answers
330 views

Cost of solving multiple Discrete Logarithm Problems in the same group

We consider the Discrete Logarithm Problem of finding integer $x$ random in $[0,n)$ where $n$ is the group order, given $Y=G^x$ (or $Y=xG$) computed in the group noted multiplicatively (or additively),...
fgrieu's user avatar
  • 140k
0 votes
0 answers
77 views

Generating a new curve using an existing curve and new prime

Can you take a curve equation from https://safecurves.cr.yp.to and a large safe prime from existing DH parameters (for example openssl dhparam 9000), combine them, ...
user avatar
1 vote
1 answer
66 views

Difference between a a doubled point and a point from point addition

Are all doubled points on an elliptic curve even, meaning if you compress the point, it will have '02' plus the $x$ coordinate? If not, what distinguishes a doubled point from a point resulting from ...
Dev Tenji's user avatar
0 votes
1 answer
80 views

Z-coordinate in Jacobian coordinates

secp256k1 Generator:(G_X, G_Y, 0x1), secp256k1 any public key using affine coordinates : B=(X, Y) secp256k1 any Public key using jacobian coordinates:BB=(P_X, P_Y, P_Z) (B's private key)==(BB's ...
bnsage123's user avatar
1 vote
1 answer
83 views

Probability when representing message as a point on elliptic curve

There is a very popular method to represent a message $m$ (number) as a point on elliptic curve over a finite field: Set $i = 0$ Check whether $m'=m\cdot K+i$ is on elliptic curve. If not, try again ...
Ape Tim's user avatar
  • 13
1 vote
1 answer
91 views

Point doubling for a point on Elliptic Curve (15,13) + (15,13) = (2,)

Consider the elliptic curve E1:y2=x3+7 over F17 with the base point G=(15,13) I am trying to compute point double of (15,13) i.e (15,13)+ (15,13) Expected point is (2,10) , however I am not able to ...
Sudhanwa Deo's user avatar
5 votes
1 answer
202 views

Integrating Elligator mapping with libsodium Curve25519 implementation

I'm currently working on a project where I want to map Curve25519 public keys to uniformly random noise. The main idea is that when these transformed public keys are sent over a network, an outsider ...
Safari1811's user avatar
0 votes
0 answers
54 views

Ed25519 and sealed boxes libsodium

Accidentally used ed25519 public key to create libsoidum_sealed_box. Is there any way to decrypt the data if the private key ed25519 is known?
user112852's user avatar
3 votes
0 answers
136 views

EC public key with leading zeros

Let us take example of secp256k1 curve. The current known public key with most leading zero (in x cordinate) is: ...
madhurkant's user avatar
1 vote
0 answers
71 views

Does ECC give the most secure assymetric cipher for a given public key size?

Cracking an ideal block cipher is basically a brute force key enumeration. The complexity of the attack is exponential, growing as $2^b$. Cracking ECC is also exponential, but the cost grows as $2^{\...
槿铃兔's user avatar
3 votes
1 answer
1k views

Why do we need additional secret value (k) in ECDSA?

Formula for calculating an ECDSA signature (r, s) is: s = k-1(z + qr) k - private key for a random point R z - hash of a message q - original private key r - x(R) I am interested in why do we need ...
LeaBit's user avatar
  • 133
2 votes
1 answer
247 views

Is there an algebra group (or ring) in which computing the inverse element is hard without some trapdoor information?

Specifically, I want an algebra group $G$ (or ring $R$) features: Given elements $g,h\in G$ (or $R$ ), computing $g\cdot h \in G$ (or $R$ ) is easy. Given an element $g \in G$ (or $R$ ), finding the ...
ming alex's user avatar
  • 368
0 votes
3 answers
166 views

Understanding Point Negation in secp256k1 Elliptic Curve

I'm exploring the secp256k1 elliptic curve in the context of cryptography and encountered the concept of Point negation. I would appreciate clarification on what point negation means in this context. ...
Favour's user avatar
  • 39
1 vote
0 answers
68 views

Can the byte overhead of an ECDH based hybrid cryptosystem be reduced by encoding data in ephemeral key?

Motivation I have a use case that involves sending small (25-50 byte) encrypted messages over a very constrained channel. Many senders send public key encrypted messages to other receivers. Anonymity (...
Richard Thiessen's user avatar

1
2 3 4 5
44