Tag Info

1 vote

Why not to use curve over field of $p^m$ with $p > 2$ for ECDSA?

Note that ECDLP over extension fields is not necessarily harder than ECDLP over the underlying field of prime characteristic, simply because for any power of prime $q$, $E(\mathbb{F}_{q})$ is a ...
• 11

Which is better ECDHE with TLS 1.0

If your client use modern browser such as the latest chrome or firefox you should choose TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (If you use ECDSA certificates)OR TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (If ...
• 19
Accepted

Curve448 - Can Ed448 key material be reused for X448?

You do not need to convert the Edwards448 public key to the birationally equivalent Curve448 public key in order to do ECDH. You can just stick to Edwards448. There will be a performance gain if you ...
• 2,523

Strauss-Shamir trick on EC multiplication by scalar

I'll describe the standard Shamir trick adapted to the context of ECDSA signature verification. Dropping some indices, the computationally expensive part of it is computing $$u\cdot G+v\cdot Q$$ where ...
• 122k
1 vote

Do you know protocols, where it is necessary to obtain several "independent" points on the same elliptic curve?

Your question is essentially: Is it useful to be able to sample a tuple $(Q_1, Q_2, \dots, Q_n) \in E(F)^n$ such that no relation is known among the points, but the tuple is not sampled from the ...
• 4,382

Do you know protocols, where it is necessary to obtain several "independent" points on the same elliptic curve?

There is a "hash-to-point" function used in several schemes, where it is necessary to generate an EC point where the discrete log w.r.t. any other EC point is unknown. In particular: A ...
• 2,523
Accepted

Do you know protocols, where it is necessary to obtain several "independent" points on the same elliptic curve?

Do you know protocols where it is necessary to obtain several "independent" points on the same elliptic curve? One obvious place where this occurs if you are implementing a Pedersen ...
• 131k
1 vote
Accepted

Test vectors (points) for Ed25519

Just use a reliable library to generate your test vectors. For example, using elliptic: ...
• 2,523
Accepted

Is it theoretically possible to delegate public key generation?

If I understand your scheme correctly, then Alice needs a separate secure channel to communicate $i$ to Bob. Monero solves this problem by creating a one-time destination public key every time funds ...
• 2,523

ECDSA signature with Brainpool curves in TLS possible?

RFC 7027 defines short names for the brainpool curves that may be used in TLS 1.0, 1.1, and 1.2 for key exchange (by adding them the NamedCurve defined types). As ...
• 101

EC Public key encryption scheme where Alice does not know Bob's public key

You might be looking for anonymous messaging in which the sender hides their identity from the receiver. The Libsodium has one specially designed for this sealed_box Only the recipient can decrypt ...
• 42.9k