4

Supplying ECDSA with deterministic input doesn't make for a one-time signature—RFC 6979 chooses the per-signature secret as a deterministic but secret function of the message. However, there is a variant of ECDSA—or EdDSA—that could probably work. In ECDSA, a public key is a point $A$ on a curve with standard base point $G$, and a signature on a message $m$...


3

Update: in a footnote of his paper Generic Groups, Collision Resistance, and ECDSA (online since 2002-02-27), then published in Designs, Codes and Cryptography (2005), Daniel R. L. Brown wrote that In ECDSA, the public key can be recovered from the message and the signature. Then, acting as editor of the SEC 1 standard, he put there how such ECDSA public ...


3

Could a C25519/ED25519 cryptographic module be FIPS certified? Likely yes in the near future—although ‘near’ is measured relative to the pace of a US federal government bureaucracy. On 2019-10-31, NIST submitted a request for comments to the Federal Register on drafts for FIPS 186-5 and NIST SP 800-186 that include the Montgomery and Edwards curve shapes; ...


2

Here is what I believe Sagemath is doing: Given the problem of finding $x$ s.t. $xP = Q$, one step is computing $x' = x \bmod 5888291787538299579505114081452341011$; it does this by computing $P' = (2\cdot 3 \cdot 5)P$, and $Q' = (2 \cdot 3 \cdot 5)Q$, and trying to solve $x'P' = Q'$ As the order of $P'$ is circa $2^{122}$, we would normally expect this ...


2

To the best of my knowledge, this hard assumption is introduced by Boneh and Boyen in this paper. But I don't think so the assumption that you mention being hard, because $c=0$ is a simple solution for it. Then the element $g^{\frac{1}{s}}$ should not publish. Also, this assumption is not bilinear because the challenge is an element in the cyclic group of $...


2

$G = [b^{-1} \bmod q]B$ where $q$ is the order of the group generated by $G$, assuming $\gcd(b, q) = 1$.


1

..how does this formula $(aG+bG) = (a+b)G$ work in ECDSA? Perfectly well. It follows from the definition of $kG$ as $\overbrace{G+\cdots+G}^{k\text{ times}}$, associativity and commutativity of point addition. Notice that operator $+$ in $(aG+bG)$ and $G+\cdots+G$ is elliptic curve point addition, while operator $+$ in $(a+b)$ is addition in $\Bbb Z$ (...


1

Here's one way to do roughly what you described: openssl genpkey -out alice.pem -algorithm EC \ -pkeyopt ec_paramgen_curve:P-256 \ -pkeyopt ec_param_enc:named_curve openssl pkey -pubout -in alice.pem -out alice.pub openssl genpkey -out bob.pem -algorithm EC \ -pkeyopt ec_paramgen_curve:P-256 \ -pkeyopt ec_param_enc:named_curve openssl pkey -pubout -...


1

Is there any quantum resistant public key cryptography with similar properties of elliptic curves? Not at the level you're asking about. The issue is that Shor's algorithm can generically solve the problem "given $A, x \times A$, recover $x$" for any finite group (and going to an infinite group looks problematic for large $x$). Hence, we'd need to base ...


1

I suppose it is a short Weierstrass curve. There are several possibilities: Projective coordinates: a point $P = (x,y)$ is stored with three coordinates, $X$, $Y$ and $Z$ that satisfy $x=X/Z$ and $y=Y/Z$. We note $P=(X:Y:Z)$. That means a point can have more than one representation (it is the same as fractions, $\frac 3 4$ is the same as $\frac{15}{20}$). ...


1

The second step has nothing to do with the first step. It doesn't matter which hash is used in the first step. For X25519, which operates on an equivalent curve Curve25519, the private key is obtained by randomly generating 32 bytes and the first step of using that key is to apply the bit pruning step (clear bits 0, 1, 2 and 255 and set bit 254). Clearing ...


Only top voted, non community-wiki answers of a minimum length are eligible