7
votes
Accepted
Why do we need additional secret value (k) in ECDSA?
First, why does $k$ need to be secret in ECDSA?
With the question's notation, in ECDSA, $s=k^{-1}(z+q\,r)\bmod n$ where $n$ is the public prime order of the elliptic curve group, $z$ is public since ...
- 138k
4
votes
Accepted
Integrating Elligator mapping with libsodium Curve25519 implementation
Monocypher author here.
First, I can confirm Elligator only needs the sign of the y coordinate… which by definition of X25519, is always "positive". This is not a good thing! You want ...
4
votes
Accepted
Is there an algebra group (or ring) in which computing the inverse element is hard without some trapdoor information?
Trapdoor groups with infeasible inversion have been considered in several papers since the Master's thesis of Hohenberger. They were considered a hypothetical assumption for a long time, but two ...
- 2,115
4
votes
Understanding Point Negation in secp256k1 Elliptic Curve
I would like to know how to determine if a point $P = (x, y)$ is negated or not ?
It appears you are asking: I was just given the value $(x, y)$, and I want to know if the person who gave it to make ...
- 145k
2
votes
Understanding Point Negation in secp256k1 Elliptic Curve
Similar to finite field has no "negative" element, elliptic groups don't have "negative points" either.
- 9,001
2
votes
Accepted
Implementing Floor Division on secp256k1 Elliptic Curve in Python
Let, us have a public base point $G$ on the curve $E$, and let us have a public key $P$ with a related secret key $k$ with $P = [k]G$.
Discrete Logarithm
Finding $k$ given $G$ and $P$ and curve ...
- 47.6k
2
votes
Accepted
Key exchange for encrypted firmware update
The theory is to use a key derivation function after Diffie-Hellman key exchange. A truncated hash would do if a single key is nedded. As DJB puts it (emphasis mine):
Given someone else's Curve25519 ...
- 138k
1
vote
Is it possible to check pedersen commitment is of postive or negative number without knowing the original value
Is it possible at all? The primary concern here is, without knowing the original value of Pedersen commitment, is it possible to determine if it is a negative or positive number if I only have ...
- 145k
1
vote
Is it possible to check pedersen commitment is of postive or negative number without knowing the original value
A Pedersen commitment is an element of a cyclic group, and all group elements are generators of the group.
This means that strictly speaking, there is no such thing as a negative Pedersen commitment.
...
- 4,712
1
vote
How to recover y-coordinates when using XZ montgomery curve
I also recommend seeing section 4.3 on Montgomery curves and their arithmetic by Craig Costello and Benjamin Smith. It cites the document from the answer above but also explains, has the algorithm and ...
- 68
Only top scored, non community-wiki answers of a minimum length are eligible