9
(minisign author here)
As noted by corpsfini, keys encode the Y coordinate. The X coordinate is recovered using the curve equation: X = sqrt((Y^2 - 1) / (d Y^2 + 1)).
The square root has two solutions, so we need to encode the sign of x as well. Since coordinates only require 255 bits, we have a extra bit, used to encode the sign.
X and Y ∈ [0; 2^255-19[, ...
8
The leading 04 byte is specified by the SEC standard (which is based on the ANSI X9.62 standard). It indicates that the public key point is not compressed. If the key is compressed, it uses 02 or 03 as leading byte depending on the lower bit of the y coordinate.
EdDSA public keys do not use this byte for two reasons:
It always uses compressed points; there ...
7
The secret $s$ in ECDSA is a value in the range 1 and the order of the group (exclusive). Some parameters are chosen in such a way that you can simply generate any value within the amount of bits as the chance that you're outside of the range or choose 0 is very small indeed. The public key is a point on the curve, calculated by performing $w = s \cdot G$ - ...
4
Well, if you have a pseudocurve [1] based on the formula:
$$y^2 = x^3 + ax + b \pmod{ pq }$$
what you have is really two different curves stapled together; that is, the curves based on:
$$y^2 = x^3 + ax + b \pmod{ p }$$
$$y^2 = x^3 + ax + b \pmod{ q }$$
You can look at a point in the $pq$ curve as really being a point in the $p$ curve and a point in the ...
3
Well, to explain that, I have to touch lightly on what a group is, and how both operations involve a group.
A group [1] is a set of values, along with an operation (which I'll denote as $\odot$); with this operation, we take two values, smash them together, and generate a third one [2]. One example of a group are the numbers, along with the operation of ...
3
In ECDSA, the private key is an integer $n$ between $0$ and $q$ where $q$ is the number of points of the curve. In the case of secp256k1, it is a $256$-bit integer.
From the base point $G$ of the curve, we can compute $P = nG$ (which is $G + G + \ldots + G$ where $G$ appears $n$ times) and it is the public key. A point has two coordinates of the same size ...
3
You can do ECDH with more than two parties. See the below adaptation of the wikipedia example for an EC group -
The parties agree on the algorithm parameters, a curve over $E(\mathbb{F}_p)$ and base point $G$.
The parties generate their private keys, named $a$, $b$, and $c$ (these are integers).
Alice computes $aG$ and sends it to Bob.
Bob computes $(aG)b = ...
3
You can encrypt with secp256k1 (or any elliptic curve) by using ECIES (Elliptc Curve Integrated Encryption Scheme). However, inside ECIES a symmetric key is generated and the message is encrypted using it.
This is in contrast with RSA, which can encrypt data directly; though most of the time it is also used to encrypt a symmetric key and then encrypt data ...
3
Now, you highlighted key generation - no one really cares about key generation time (unless you are generating ephemeral keys, that is, a fresh key pair for each connection - we generally don't). Instead, we might generate a fresh key pair maybe once a day or once a month (usually far less frequently), and so we don't care whether it takes perhaps a second (...
2
Using public key cryptography instead of a long-term shared secret is slightly more complicated but has major advantages. One of them being that the server doesn't learn the secret key. This protects against accidental leaks, but also insider threats.
If this is an option, you can use client TLS certificates. Most HTTP client libraries support this, but web ...
2
BIP32 uses secp256k1 because BIPs are for bitcoin and bitcoin uses secp256k1. (I feel like Buffy 1.01: "[the reason I'm here now is] because now is when we came here".) The same approach(es) would work for any elliptic curve, with obvious substitutions for ser256 and parse256, and for serp if using a non-Weierstrass form like X25519.
But TLS in practice ...
2
Consider this an oversimplified, though hopefully useful outline of the path to take.
Proficiency in calculations modulo n is a must. That includes results such as Lagrange's theorem, exponentiation, the Extended Euclidean algorithm, and quadratic residues (most likely I am missing some important items here). The essential concepts from group theory are ...
2
I also know that the curve order is $q$, with $q<p$. That means there exist $q$ valid points on the curve,
True
which is less than all the values that $x$ could have in $\mathbb{Z}_p$
Actually, that's less relevant than you think.
For every $x$ value in $\mathbb{Z}_p$ that has a valid solution, there are two values of $y$ that satisfy the equation (...
1
It seems that curves like that do not exist.
Hasse's bound states that $|N-(p+1)| \le 2\sqrt p$, where $N=\#E$. Writing the order of the group as $N = ph$, you get:
$|ph-(p+1)| \le 2\sqrt p \rightarrow$
$|p(h-1)-1)| \le 2\sqrt p \rightarrow$
$|\sqrt p(h-1)-\frac{1}{\sqrt p}| \le 2$
The only way this inequality is true for $p > 5$ is if $h = 1$, i.e., ...
1
The two main examples of discrete logarithms in crypto are
the multiplicative group of a finite field: the integers modulo a prime $p$ with the multiplication
elliptic curves: points with an operation to add them
For the first one, we look at the subgroup generated by a number $g$ called the generator :
$$
1, g, g^2, \ldots, g^{q-1},
$$
and $g^q = 1$, so ...
1
The private key can be anything within the group order, if you take the key more than 32 bytes, then your key will work, but due to the cyclic nature of the group, your public key will be equal to the remainder of the key from the group order (modulo the group order).
As for the public key, it will not necessarily be 64 bytes (two numbers are the x and y ...
1
No, this is a known variation of the computational Diffie-Hellman problem, called Inverse computational Diffie-Hellman (InvCDH), according to which on input $g$, $g^{x}$, it is difficult to find $g^{x^{-1}}$.
See section 2.2 at Variations of Diffie-Hellman Problem by Bao et al. for more info and problem reduction proofs.
1
It should be pretty much the same. If you can sign a CSR with RSA you can sign with ECC. The exact same data is signed, what changes is:
The signature algorithm should be the right OID (e.g. ecdsaWithSHA256)
The signature value must be the ECDSA signature encoded as specified in SEC (i.e. an ASN.1 sequence of the two integers in the signature)
The public ...
1
Information on how the specific base point was chosen is scarce. If you look at SEC1 (section 3.1.3.2), you will find a pseudo-random method in which a given seed is hashed (along with some parameters, in particular a counter value) into a bit string, which is then interpreted as the $X$ coordinate of the candidate point (if there is no valid point with that ...
1
On curve secp256k1 which is a finite range equal to $2^{256}-2^{32}-{2^9}-2^{8}-2^{7}-2^{6}-2^{4}-1$, the number of valid keys denoted as n would be any 256-bit value between 1 and n-1, where n is equal to 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141 and thus all 256-bit values in that particular range are valid private keys which each ...
Only top voted, non community-wiki answers of a minimum length are eligible
