# Tag Info

## Hot answers tagged elliptic-curves

Accepted

### EC has lower CPU consumption than RSA under what condition?

under what condition (is processing for ECC about four times less CPU-intensive than for RSA) ? That figure is likely for computing and once verifying a signature at an industry-standard security ...
• 126k
Accepted

### Find Ed25519 Y Coordinate from X Coordinate

Get the curve equation $$-x^2 + y^2 = 1 - \frac{121665}{121666}x^2y^2$$ Call $d = \frac{121665}{121666}$ $$-x^2 + y^2 = 1 - dx^2y^2$$ Take $y^2$ to left $$y^2 + dx^2y^2 = 1 + x^2$$ Take $y^2$ out ...
• 44.3k

### When working in a subgroup of EC in EdDSA (especially Ed255190), how is it OK to use operations different from that of the main group?

Little preamble on EC(C) In cryptography, we use an Elliptic Curve (EC) over a finite field. To form an EC over a finite field, first, select a finite field $\mathbb F_p$ where $p$ is either a prime ...
• 44.3k
Accepted

### How are the unified addition formulae in extended twisted Edwards coordinates derived from the affine addition formulae?

To convert extended twisted Edwards coordinates to extended projective coordinates one needs to divide $$X_3 = (X_1Y_2 + Y_1X_2)(Z_1Z_2 − d T_1T_2)$$ by $$Z3 = (Z_1Z_2 − d T_1T_2)(Z_1Z_2 + d T_1T_2)$$ ...
• 44.3k
Accepted

### How is the edwards448 generator derived from the curve448 generator in RFC 7748?

It doesn't work as you expect. This is a 4 degree isogeny, not an isomorphism or a birational equivalence. One complete map $toMonty(toEdwards(P))$ will not get you to the starting point $(P)$, it ...
• 6,499
Accepted

### When working in a subgroup of EC in EdDSA (especially Ed255190), how is it OK to use operations different from that of the main group?

The statement every existing implementation implements scalar arithmetic $\bmod q$, the order of the prime-order group, not $\bmod 8q$, the order of the full group. does not imply that working in a ...
• 126k
Accepted

### Is it true that Public keys with even y coordinate correspond to private key that are less than n/2 and vice versa? (Secp256k1)

A little test with Sagemath for the first 10 integers as the private key; ...
• 44.3k

### Does an binary elliptic curve like sect571r1 support a bijective asymmetric operation pair on bytes? If so, is there a self-contained example?

Mapping from a scalar (a positive integer less than the order of the group generated by the curve base point) to a group element (EC point) is a bijection. However, it's also computationally one-way. ...
• 3,902
1 vote
Accepted

### Does the ECDSA private or public keys contain data about the signature hash algorithm?

I'm not sure about the Java code, but whether or not a keypair has a hash function associated with it depends on its AlgorithmIdentifier, which usually contains ASN....
• 7,168
1 vote

### When working in a subgroup of EC in EdDSA (especially Ed255190), how is it OK to use operations different from that of the main group?

every existing implementation implements scalar arithmetic $\operatorname{mod} q$ This works perfectly in all scenarios as long as all scalars and all EC points are trusted or validated. Just in case ...
• 3,902
1 vote

### How to modify elliptic curve point?

Q(5555555555) % 2500 = Q(55) how to do this ? We hope you can't do this (on a large elliptic curve, and without knowing the private key 5555555555 - if you can, then ECC is broken. After all, if you ...
• 134k
1 vote

### How to modify elliptic curve point?

In standard Elliptic Curve cryptography, the private key can be reduced modulo the order of the generator point, without changing the matching public key. That order is often noted $n$. In the ...
• 126k
1 vote
Accepted

### Non-determnistic ECDSA: is there any unique common factor of all signatures of the same message by the same private key?

An ECDSA signature can't be verified unless the associated public key $P$ is known. If that public key is part of what is communicated as part of $s_i$, then the answer is simply $f(s_i) = P$. If $P$ ...
• 3,902

Only top scored, non community-wiki answers of a minimum length are eligible