2
One small issue is that it can be detected if the x-coordinate lives on the base curve or on its twist.
There's not a small issue; this allows a passive attacker to halve his dictionary by listening into a single exchange.
That is, if $s$ is on the curve, then so will be $s^x$; if $s$ is on the twist, so will be $s^x$.
So, what the attacker can do is ...
1
I suppose it is a short Weierstrass curve. There are several possibilities:
Projective coordinates: a point $P = (x,y)$ is stored with three coordinates, $X$, $Y$ and $Z$ that satisfy $x=X/Z$ and $y=Y/Z$. We note $P=(X:Y:Z)$. That means a point can have more than one representation (it is the same as fractions, $\frac 3 4$ is the same as $\frac{15}{20}$). ...
1
I give a python program to clarify the above answer.
Given the Elliptic curve $E:y^2= x^3+2 x + 2 \pmod {17} , \#E=19$ and a primitive point $P=(x_p,y_p)=(5,1)$ on the curve. We calculate the $nP$
# -*- coding:UTF-8
# Extended Euclidean algorithm
def extended_gcd(aa, bb):
lastremainder, remainder = abs(aa), abs(bb)
x, lastx, y, lasty = 0, 1, 1, 0
...
1
The second step has nothing to do with the first step. It doesn't matter which hash is used in the first step. For X25519, which operates on an equivalent curve Curve25519, the private key is obtained by randomly generating 32 bytes and the first step of using that key is to apply the bit pruning step (clear bits 0, 1, 2 and 255 and set bit 254).
Clearing ...
Only top voted, non community-wiki answers of a minimum length are eligible
