The 2024 Developer Survey results are live! See the results

# Tag Info

### What is the maximum message size when using ECDSA (specifically secp256k1?

According to FIPS 186-5, the hash tag is truncated to the bit length of the group order, len(n). For secp256k1, this is 256 bits. This is relevant, say, when using ...

### ECDSA-SHA256 HTTP Signature String Construction

I was able to recreate solution in python ...

### Why exactly finding the same result by changing a scalar in such a case is equivalent to solving the discrete logarithm between one or more points?

It's fixed and given a twisted Edward's curve over some finite field, with parameters making the curve a finite group under the point addition law; the order $h\,\ell$ of that group, with $h$ (always ...
• 143k
1 vote

### Given 3 points on a twisted edward curve, if I know 2 discrete logarithms, is it possible compute the third relation/discrete logarithm?

The problem can be restated as: given a twisted Edwards curve over some finite field, $A$, $B$, $G$ on that curve, integers $s_1$ and $s_2$ with $A=s_1\times G$ and $B=s_2\times G$, can we find ...
• 143k

### Given 3 points on a twisted edward curve, if I know 2 discrete logarithms, is it possible compute the third relation/discrete logarithm?

Yes. If $A=s_1G$ and $B=s_2G$ and the group order is $\ell$, compute $s_3=s_1/s_2\pmod \ell$ (using the extended Euclidean algorithm) then $A=s_3B$. Likewise if $s_4=s_2/s_1\pmod\ell$ then $B=s_4A$.
• 24.4k
1 vote

### How do I compute unified PADD on BLS12-377 using the twisted Edwards curve equations?

Note that not every elliptic curve can be represented in twisted Edwards form. Only those with a Montgomery representation can be so transformed. Fortunately, BLS12-377 can be put in this form per the ...
• 24.4k

### Can Curve25519 shared secret be safely truncated to half its size?

You'll want to use a KDF to derive the AES key, for example HKDF-SHA256. You could specify a 128-bit output key from HKDF, but if you want a 128-bit security level you should use AES-256 anyway.

### in elliptic curve over finite field we get two values of y for each x now how can we draw elliptic curve using these points?

The curve $y^2=x^3+a\,x+b$ with $x$, $y$ in the field $\mathbb R$ of reals has infinitely many point. It is continuous (with for some choices of parameters 2 disjoint pieces). It is symmetrical with ...
• 143k
Accepted

### Can attacker recover private key if he have history of intermediate elliptic curve point coordinates?

Yes if the intermediate values of the addition/subtraction chain used in the computation of $kG$ are known, then it is straightforward to recover $k$. Recovery of the operands of the chain is ...
• 24.4k
1 vote

### Can attacker recover private key if he have history of intermediate elliptic curve point coordinates?

Can attacker recover private key if he know the algorithm and have the history of previous elliptic curve point coordinates, e.g. by using rainbow table? Yes, there are multiple algorithms to compute ...
• 149k
Accepted

### Can we use Super-Elliptic or Supersingular Elliptic Curves in Cryptography?

Supersingular curves have weaknesses and thus are not used in Elliptic Curve Cryptography. This has been known for a long time, see for example, the statement in the PhD thesis on page 11, available ...
• 23.1k

### Is MOV attack against ECDLP fundamentally impossible?

Actually, the multiplicative group of the extension field $GF(p^k)$ does have order $p^k-1$. In particular, for any $m$ that does not have $p$ as a factor, there will exist a $k$ such that $GF(p^k)$ ...
• 149k
Accepted

### Can Curve25519 shared secret be safely truncated to half its size?

Can Curve25519 shared secret be safely truncated to half its size? TL;DR: don't do this, mostly because you need several keys. Use a KDF, even a cheap one. The shared secret in Curve25519 is 256-bit....
• 143k

• 49.2k
Accepted

### Using Sagemath, how to exactly find out what the order of a point of an elliptic curve in the twisted Edwards form is?

The order of an element $P$ of a finite group is, by definition, the smallest strictly positive integer $k$ with $k\cdot P=\underbrace{P+P+\cdots+P}_{k\text{ terms}}$ equal to the group neutral. This ...
• 143k
Accepted

### Given a random point on a curve defined over a prime field, is it possible to compute 2 different scalar that will lead to the same result?

Consider an Edwards curve with equation $x^2+y^2=d\,x^2y^2$ in the field $\mathbb F_p$, with prime $p\bmod 4=1$, integer $d$ with $d^{(p-1)/2}\bmod p=p-1$. The group law is \bigl(x_1,y_1\bigr)+\bigl(...
• 143k

### Is ElGamal homomorphic encryption using additive groups works only for Discrete Log ElGamal? What about EC ElGamal?

Building additively homomorphic encryption on top of ElGamal encryption is possible regardless of the finite group used. However for convenient decryption the sum $c$ of the plaintexts can't span too ...
• 143k
Accepted

### Is ElGamal homomorphic encryption using additive groups works only for Discrete Log ElGamal? What about EC ElGamal?

The Discrete Log ElGamal forms multiplicative group, which is not suitable for homomorphic encryption with additive group. There is no inherent difference between 'multiplicative' groups versus '...
• 149k
1 vote

### Can I move elements from cyclic subgroup to its cyclic parent group?

I want to know if there's a way/formula/algorithm for we can do the things in opposite, i.e., "moving elements from cyclic subgroup to its cyclic parent group" such that we get elements ...
• 149k
Accepted

### Is it possible to abstract an ElGamal encryption for EC and Discrete Log by using a Group Law?

The modern academic presentation of ElGamal encryption is in an abstract group1. That applies to both the first and second part of the question. There are two common notations for the group: ...
• 143k