New answers tagged

2 votes

Does an binary elliptic curve like sect571r1 support a bijective asymmetric operation pair on bytes? If so, is there a self-contained example?

Mapping from a scalar (a positive integer less than the order of the group generated by the curve base point) to a group element (EC point) is a bijection. However, it's also computationally one-way. ...
  • 3,902
8 votes
Accepted

EC has lower CPU consumption than RSA under what condition?

under what condition (is processing for ECC about four times less CPU-intensive than for RSA) ? That figure is likely for computing and once verifying a signature at an industry-standard security ...
  • 126k
1 vote
Accepted

Does the ECDSA private or public keys contain data about the signature hash algorithm?

I'm not sure about the Java code, but whether or not a keypair has a hash function associated with it depends on its AlgorithmIdentifier, which usually contains ASN....
  • 7,168
4 votes
Accepted

How are the unified addition formulae in extended twisted Edwards coordinates derived from the affine addition formulae?

To convert extended twisted Edwards coordinates to extended projective coordinates one needs to divide $$X_3 = (X_1Y_2 + Y_1X_2)(Z_1Z_2 − d T_1T_2)$$ by $$Z3 = (Z_1Z_2 − d T_1T_2)(Z_1Z_2 + d T_1T_2)$$ ...
  • 44.3k
6 votes
Accepted

Find Ed25519 Y Coordinate from X Coordinate

Get the curve equation $$-x^2 + y^2 = 1 - \frac{121665}{121666}x^2y^2$$ Call $d = \frac{121665}{121666}$ $$-x^2 + y^2 = 1 - dx^2y^2$$ Take $y^2$ to left $$y^2 + dx^2y^2 = 1 + x^2$$ Take $y^2$ out ...
  • 44.3k
2 votes
Accepted

Is it true that Public keys with even y coordinate correspond to private key that are less than n/2 and vice versa? (Secp256k1)

A little test with Sagemath for the first 10 integers as the private key; ...
  • 44.3k
5 votes

When working in a subgroup of EC in EdDSA (especially Ed255190), how is it OK to use operations different from that of the main group?

Little preamble on EC(C) In cryptography, we use an Elliptic Curve (EC) over a finite field. To form an EC over a finite field, first, select a finite field $\mathbb F_p$ where $p$ is either a prime ...
  • 44.3k
1 vote

When working in a subgroup of EC in EdDSA (especially Ed255190), how is it OK to use operations different from that of the main group?

every existing implementation implements scalar arithmetic $\operatorname{mod} q$ This works perfectly in all scenarios as long as all scalars and all EC points are trusted or validated. Just in case ...
  • 3,902
2 votes
Accepted

When working in a subgroup of EC in EdDSA (especially Ed255190), how is it OK to use operations different from that of the main group?

The statement every existing implementation implements scalar arithmetic $\bmod q$, the order of the prime-order group, not $\bmod 8q$, the order of the full group. does not imply that working in a ...
  • 126k
1 vote

How to modify elliptic curve point?

Q(5555555555) % 2500 = Q(55) how to do this ? We hope you can't do this (on a large elliptic curve, and without knowing the private key 5555555555 - if you can, then ECC is broken. After all, if you ...
  • 134k
1 vote

How to modify elliptic curve point?

In standard Elliptic Curve cryptography, the private key can be reduced modulo the order of the generator point, without changing the matching public key. That order is often noted $n$. In the ...
  • 126k
0 votes

Is product of two linear combinations over a finite field information hiding?

would it be sufficient if the attacker could compute $h(M)$ for values of $M$ that he did not query? yes, that's also not desirable Ok, here's one (not likely to be optimal approach) to do that, ...
  • 134k
0 votes

How is the edwards448 generator derived from the curve448 generator in RFC 7748?

The code below complements Ruggero's answer. Ruggero explained that the given isogeny, curve448 --> edwards448, is a 4-isogeny, as is stated in RFC 7748. When it is applied to a point on curve448, ...
1 vote
Accepted

Non-determnistic ECDSA: is there any unique common factor of all signatures of the same message by the same private key?

An ECDSA signature can't be verified unless the associated public key $P$ is known. If that public key is part of what is communicated as part of $s_i$, then the answer is simply $f(s_i) = P$. If $P$ ...
  • 3,902
3 votes
Accepted

How is the edwards448 generator derived from the curve448 generator in RFC 7748?

It doesn't work as you expect. This is a 4 degree isogeny, not an isomorphism or a birational equivalence. One complete map $toMonty(toEdwards(P))$ will not get you to the starting point $(P)$, it ...
  • 6,499

Top 50 recent answers are included