13
votes
Accepted
EC Public key encryption scheme where Alice does not know Bob's public key
ECIES does not require the sender to publish their own permanent public key. Instead, they can just create an anonymous ephemeral key pair, and publish the ephemeral public key along with the ...
- 2,523
8
votes
Accepted
Do you know protocols, where it is necessary to obtain several "independent" points on the same elliptic curve?
Do you know protocols where it is necessary to obtain several "independent" points on the same elliptic curve?
One obvious place where this occurs if you are implementing a Pedersen ...
- 131k
4
votes
Accepted
Curve448 - Can Ed448 key material be reused for X448?
You do not need to convert the Edwards448 public key to the birationally equivalent Curve448 public key in order to do ECDH. You can just stick to Edwards448. There will be a performance gain if you ...
- 2,523
3
votes
Accepted
Is it theoretically possible to delegate public key generation?
If I understand your scheme correctly, then Alice needs a separate secure channel to communicate $i$ to Bob.
Monero solves this problem by creating a one-time destination public key every time funds ...
- 2,523
3
votes
Accepted
Strauss-Shamir trick on EC multiplication by scalar
I'll describe the standard Shamir trick adapted to the context of ECDSA signature verification. Dropping some indices, the computationally expensive part of it is computing
$$u\cdot G+v\cdot Q$$
where ...
- 122k
2
votes
Do you know protocols, where it is necessary to obtain several "independent" points on the same elliptic curve?
There is a "hash-to-point" function used in several schemes, where it is necessary to generate an EC point where the discrete log w.r.t. any other EC point is unknown. In particular:
A ...
- 2,523
2
votes
EC Public key encryption scheme where Alice does not know Bob's public key
You might be looking for anonymous messaging in which the sender hides their identity from the receiver. The Libsodium has one specially designed for this sealed_box
Only the recipient can decrypt ...
- 43k
1
vote
Do you know protocols, where it is necessary to obtain several "independent" points on the same elliptic curve?
Your question is essentially: Is it useful to be able to sample a tuple $(Q_1, Q_2, \dots, Q_n) \in E(F)^n$ such that no relation is known among the points, but the tuple is not sampled from the ...
- 4,382
1
vote
Accepted
Test vectors (points) for Ed25519
Just use a reliable library to generate your test vectors. For example, using elliptic:
...
- 2,523
1
vote
Why not to use curve over field of $p^m$ with $p > 2$ for ECDSA?
Note that ECDLP over extension fields is not necessarily harder than ECDLP over the underlying field of prime characteristic, simply because for any power of prime $q$, $E(\mathbb{F}_{q})$ is a ...
- 41
Only top scored, non community-wiki answers of a minimum length are eligible