# Tag Info

Accepted

### Why do we need additional secret value (k) in ECDSA?

First, why does $k$ need to be secret in ECDSA? With the question's notation, in ECDSA, $s=k^{-1}(z+q\,r)\bmod n$ where $n$ is the public prime order of the elliptic curve group, $z$ is public since ...
Accepted

### Integrating Elligator mapping with libsodium Curve25519 implementation

Monocypher author here. First, I can confirm Elligator only needs the sign of the y coordinate… which by definition of X25519, is always "positive". This is not a good thing! You want ...
Accepted

### Is there an algebra group (or ring) in which computing the inverse element is hard without some trapdoor information?

Trapdoor groups with infeasible inversion have been considered in several papers since the Master's thesis of Hohenberger. They were considered a hypothetical assumption for a long time, but two ...

### Understanding Point Negation in secp256k1 Elliptic Curve

I would like to know how to determine if a point $P = (x, y)$ is negated or not ? It appears you are asking: I was just given the value $(x, y)$, and I want to know if the person who gave it to make ...

### Understanding Point Negation in secp256k1 Elliptic Curve

Similar to finite field has no "negative" element, elliptic groups don't have "negative points" either.
Accepted

### Implementing Floor Division on secp256k1 Elliptic Curve in Python

Let, us have a public base point $G$ on the curve $E$, and let us have a public key $P$ with a related secret key $k$ with $P = [k]G$. Discrete Logarithm Finding $k$ given $G$ and $P$ and curve ...
Accepted

### Key exchange for encrypted firmware update

The theory is to use a key derivation function after Diffie-Hellman key exchange. A truncated hash would do if a single key is nedded. As DJB puts it (emphasis mine): Given someone else's Curve25519 ...
1 vote

### Is it possible to check pedersen commitment is of postive or negative number without knowing the original value

Is it possible at all? The primary concern here is, without knowing the original value of Pedersen commitment, is it possible to determine if it is a negative or positive number if I only have ...
1 vote

### Is it possible to check pedersen commitment is of postive or negative number without knowing the original value

A Pedersen commitment is an element of a cyclic group, and all group elements are generators of the group. This means that strictly speaking, there is no such thing as a negative Pedersen commitment. ...
1 vote

### How to recover y-coordinates when using XZ montgomery curve

I also recommend seeing section 4.3 on Montgomery curves and their arithmetic by Craig Costello and Benjamin Smith. It cites the document from the answer above but also explains, has the algorithm and ...

Only top scored, non community-wiki answers of a minimum length are eligible