New answers tagged elliptic-curves
7
votes
Accepted
Why do we need additional secret value (k) in ECDSA?
First, why does $k$ need to be secret in ECDSA?
With the question's notation, in ECDSA, $s=k^{-1}(z+q\,r)\bmod n$ where $n$ is the public prime order of the elliptic curve group, $z$ is public since ...
- 138k
4
votes
Accepted
Is there an algebra group (or ring) in which computing the inverse element is hard without some trapdoor information?
Trapdoor groups with infeasible inversion have been considered in several papers since the Master's thesis of Hohenberger. They were considered a hypothetical assumption for a long time, but two ...
- 2,095
-1
votes
Understanding Point Negation in secp256k1 Elliptic Curve
There is no way you can know that because SECP256k1 uses:
$y^{2} = x^{3}+7$
Therefore multiplication removes negative sign.
From my understanding point negation is only used in the purpose of point ...
4
votes
Understanding Point Negation in secp256k1 Elliptic Curve
I would like to know how to determine if a point $P = (x, y)$ is negated or not ?
It appears you are asking: I was just given the value $(x, y)$, and I want to know if the person who gave it to make ...
- 145k
2
votes
Understanding Point Negation in secp256k1 Elliptic Curve
Similar to finite field has no "negative" element, elliptic groups don't have "negative points" either.
- 9,001
2
votes
Implementing Floor Division on secp256k1 Elliptic Curve in Python
Let, us have a public base point $G$ on the curve $E$, and let us have a public key $P$ with a related secret key $k$ with $P = [k]G$.
Discrete Logarithm
Finding $k$ given $G$ and $P$ and curve ...
- 47.5k
0
votes
Recover Y coordinate from xz elliptic curve multiplication
Let we have short Weierstraß form (see note) $$y^2 = x^3+ a_4x + a_6$$
If one wants to find the $y$ coordinate of $[n]P$, where $P=(x_1,y_1)$ is in affine coordinates the formula is
$$y_n = \frac{2a_6+...
- 47.5k
2
votes
Accepted
Key exchange for encrypted firmware update
The theory is to use a key derivation function after Diffie-Hellman key exchange. A truncated hash would do if a single key is nedded. As DJB puts it (emphasis mine):
Given someone else's Curve25519 ...
- 138k
1
vote
How to recover y-coordinates when using XZ montgomery curve
I also recommend seeing section 4.3 on Montgomery curves and their arithmetic by Craig Costello and Benjamin Smith. It cites the document from the answer above but also explains, has the algorithm and ...
- 68
1
vote
Is it possible to check pedersen commitment is of postive or negative number without knowing the original value
Is it possible at all? The primary concern here is, without knowing the original value of Pedersen commitment, is it possible to determine if it is a negative or positive number if I only have ...
- 145k
1
vote
Is it possible to check pedersen commitment is of postive or negative number without knowing the original value
A Pedersen commitment is an element of a cyclic group, and all group elements are generators of the group.
This means that strictly speaking, there is no such thing as a negative Pedersen commitment.
...
- 4,712
0
votes
Why is the Montgomery ladder algorithm safe against timing side-channel attacks?
In general, if statements implemented with conditional branches will have execution time depending on the sequence of branches taken. Even if we used a 256 bit vector where it is known that exactly ...
- 1,108
3
votes
Double- and -add algorithm
The points of an elliptic curve forms an abelian group under the usual point addition. In finite field case, the order is finite, i.e. the curve has finite number of points. The order can be prime or ...
- 2,120
Top 50 recent answers are included