8
votes
Accepted
EC has lower CPU consumption than RSA under what condition?
under what condition (is processing for ECC about four times less CPU-intensive than for RSA) ?
That figure is likely for computing and once verifying a signature at an industry-standard security ...
- 126k
6
votes
Accepted
Find Ed25519 Y Coordinate from X Coordinate
Get the curve equation $$-x^2 + y^2 = 1 - \frac{121665}{121666}x^2y^2$$
Call $d = \frac{121665}{121666}$ $$-x^2 + y^2 = 1 - dx^2y^2$$
Take $y^2$ to left
$$y^2 + dx^2y^2 = 1 + x^2$$
Take $y^2$ out ...
- 44.3k
5
votes
When working in a subgroup of EC in EdDSA (especially Ed255190), how is it OK to use operations different from that of the main group?
Little preamble on EC(C)
In cryptography, we use an Elliptic Curve (EC) over a finite field. To form an EC over a finite field, first, select a finite field $\mathbb F_p$ where $p$ is either a prime ...
- 44.3k
4
votes
Accepted
How are the unified addition formulae in extended twisted Edwards coordinates derived from the affine addition formulae?
To convert extended twisted Edwards coordinates to extended projective coordinates one needs to divide
$$X_3 = (X_1Y_2 + Y_1X_2)(Z_1Z_2 − d T_1T_2)$$
by
$$Z3 = (Z_1Z_2 − d T_1T_2)(Z_1Z_2 + d T_1T_2)$$
...
- 44.3k
3
votes
Accepted
How is the edwards448 generator derived from the curve448 generator in RFC 7748?
It doesn't work as you expect.
This is a 4 degree isogeny, not an isomorphism or a birational equivalence.
One complete map $toMonty(toEdwards(P))$ will not get you to the starting point $(P)$, it ...
- 6,499
2
votes
Accepted
When working in a subgroup of EC in EdDSA (especially Ed255190), how is it OK to use operations different from that of the main group?
The statement
every existing implementation implements scalar arithmetic $\bmod q$, the order of the prime-order group, not $\bmod 8q$, the order of the full group.
does not imply that working in a ...
- 126k
2
votes
Accepted
Is it true that Public keys with even y coordinate correspond to private key that are less than n/2 and vice versa? (Secp256k1)
A little test with Sagemath for the first 10 integers as the private key;
...
- 44.3k
2
votes
Does an binary elliptic curve like sect571r1 support a bijective asymmetric operation pair on bytes? If so, is there a self-contained example?
Mapping from a scalar (a positive integer less than the order of the group generated by the curve base point) to a group element (EC point) is a bijection. However, it's also computationally one-way.
...
- 3,902
1
vote
Accepted
Does the ECDSA private or public keys contain data about the signature hash algorithm?
I'm not sure about the Java code, but whether or not a keypair has a hash function associated with it depends on its AlgorithmIdentifier, which usually contains ASN....
- 7,168
1
vote
When working in a subgroup of EC in EdDSA (especially Ed255190), how is it OK to use operations different from that of the main group?
every existing implementation implements scalar arithmetic
$\operatorname{mod} q$
This works perfectly in all scenarios as long as all scalars and all EC points are trusted or validated.
Just in case ...
- 3,902
1
vote
How to modify elliptic curve point?
Q(5555555555) % 2500 = Q(55) how to do this ?
We hope you can't do this (on a large elliptic curve, and without knowing the private key 5555555555 - if you can, then ECC is broken.
After all, if you ...
- 134k
1
vote
How to modify elliptic curve point?
In standard Elliptic Curve cryptography, the private key can be reduced modulo the order of the generator point, without changing the matching public key. That order is often noted $n$. In the ...
- 126k
1
vote
Accepted
Non-determnistic ECDSA: is there any unique common factor of all signatures of the same message by the same private key?
An ECDSA signature can't be verified unless the associated public key $P$ is known. If that public key is part of what is communicated as part of $s_i$, then the answer is simply $f(s_i) = P$.
If $P$ ...
- 3,902
Only top scored, non community-wiki answers of a minimum length are eligible