People who code: we want your input. Take the Survey

New answers tagged

3

For example, I could use: If the discrete log is already backdoored with the standard base point $G$, then changing the base to another point on the curve doesn't solve this issue. Let you know that $G$ is backdoored and you changed the base to $G' \neq G$. Then the entity that created the backdoor can use this to find the private keys. Let $P = [k]G'$ be a ...


0

Because you know one point of the curve (the base point). you can compute $a$ : $$a = \frac{(Gy)^2 -(Gx)^3 -b}{Gx} \mod p$$ Notice that this computation requires $Gx \neq 0 \mod p$. About the infinity point : The infinity point is supposed to be the neutral element, then by definition of the neutral element : $(x,y)+\mathcal{O}=\mathcal{O}+(x,y) = (x,y)$, it ...


1

we have $a=5, b=4, (x_P,y_P) = (10,3) and p = 11$ Back to the page 22 calculate $s\equiv (3x_P^2+a)(2y_P)^{-1} \mod p \equiv 5\mod 11$ calculate in $\mod p$: $2(10,3) = (5^2- 2\cdot 10,-3+5(10-5)) = (5,0) $ now add (5,0) to (10,3) (use the rule in the page 21) now we have $s\equiv (3-0)(10-5)^{-1}\mod p \equiv 5\mod p $ then $x_\beta \equiv (5^2 - 10 - 5) ...


0

I refer to your own answer. using TLS is good enough Is there any problem with ...snip... security breaches happening during message transfer, Well yes, there is a problem. Have you understood the implication of @forest 's cryptic comment? E2E = end to end. À la Signal. With TLS, client/server messaging will be encrypted, but the messages will be ...


1

Another pro is that the curve is designed to help protecting against side-channel attacks. More precisely, there is a birational equivalence to the Edwards curve $x^2 + y^2 = 1 + dx^2y^2$ with $d = 121665/121666$ as an element in $\mathbb{F}_p$ with $p=2^{255}-19$. Since $d$ is not a square in $\mathbb{F}_p$, the addition law on this curve is 'complete': ...


0

So I have found the answer. The answer provided in the comment by Eugene Styer states that just using TLS is good enough, as TLS is not limited to a specific port.


1

The theorem of the dual isogeny states that for every isogeny $ψ:E→E'$ of degree n there exists an associated isogeny $\hat{ψ}:E'→E$ of the same degree such that $ψ∘\hat{ψ}$ and $\hat{ψ}∘ψ$ are equal to multiplication by $n$ on the respective curves. See Silverman, The Arithmetic of Elliptic Curves, Chapter III. On top of that, there are efficient algorithms ...


0

No problem with that. It works right now. Because of IsOnCurve, I need to replace it with IsInSubGroup.


1

Attacks: Of course one can attack the Curve with Brute Force, but that's not very effective. But there are generic discrete logarithms attacks for elliptic curves in general. They can be applied to Curve25519. Examples are Pollard-Rho-attack, Shanks’-Baby-Step-Giant-Step-attack, Pollard-Kangaroo-attack. Here you can find more attacks. Pros: The main ...


1

Yes, Pollard's rho, in it's distributed version, is the best known method to break the DLP in the Elliptic Curve groups in NIST's SP 800-186 (draft) section 4 linked in the question, and NIST's FIPS 186-4 appendix D which specifies the P-192 curve alluded to in the question. It's also the method used in most¹ similar record attacks. Work complexity is $\...


0

If by "I'm working in a constrained hardware environment" you mean that you are developing a hardware wallet then yes, deterministic signatures matter a lot! With non-deterministic signatures, your hardware wallet might be leaking key material. The only way for users to verify this is not happening is to try your brand wallet with deterministically ...


0

https://github.com/alex-nitrokey/python-pgpdump can decipher password-protected secret keys (you will have to write a bit of python code though): import pgpdump with open("key.asc", "r") as f: data = pgpdump.AsciiData(f.read(), secret_keys=True, passphrase=None) for packet in data.packets(): print(packet) ```


1

!!!Caveat, Warning!!! walletgenerator.net is scam! Anyways be CAREFUL. It is possible to send BTC to a wallet address which is not belong to you and probably is someones else's wallet (probably coder's wallet!!!) This is called SCAM or THIEF or STEALING BTC which WalletGenerator.net is doing... They are the same, bitaddress.org uses an option that you ...


3

An Elliptic curve defined over the finite Field $\mathbb F_p$ means that all of the coordinates are elements of $\mathbb F_p$, i.e. in affine coordinates, let $P=(x,y)$ be a point then $x,y \in \mathbb F_p$. Actually, all of the arithmetic is done over $\mathbb F_p$ In the encoding 04 11 95 23 03 f0 f1 f1 45 67 14 98 e4 39 80 ce 25 39 02 6e 72 34 fe 02 38 8a ...


1

If you look at the all information on the site that provides you can find the answer very fast. X9.62 ECDSA Signature with SHA-256 X9.62 : Public Key Cryptography for the Financial Services Industry: The Elliptic Curve Digital Signature Standard (ECDSA)" So, it is the NIST curve and NIST uses the $r$ versions like secp256r1. A must-read question on ...


1

Whatever the curve, it's needed to use multi-precision integer arithmetic in ECC cryptography, at least for a few modular operations modulo the Ellitic Curve group order, since that's large (192-bit is the bare modern minimum). For the field, where the most compute-intensive operations are, there are alternatives with fields other than prime order groups. ...


Top 50 recent answers are included