Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

# Tag Info

0

The answer indicates that the order of all points on the curve over the finite field $2^{255} - 19$ is 8 times the size of the subgroup formed by $G$. Obviously, this is incorrect, and Samuel never claims it. This curve defines a group with $8q$ elements (with $q = 2^{252} + 27742317777372353535851937790883648493$ prime), and the factorization of $8q = 2 \... 0 The Montgomery Curve is introduced by Peter L. Montgomery for speeding up the Pollard and Elliptic Curve Methods of integer factorization. Montgomery Curves are in the form$By^2=x^3+Ax^2+x$and it is also represented as$M_{A,B}$. Addition and Doubling Formulas of Montgomery Curves Given Montgomery Curve$By^2=x^3+Ax^2+x$and the point$P_1 = (x_1,x_1)$... 3 First, the size: the best attacks for breaking elliptic curve cryptography are algorithms that break the discrete log (given a point$P = kG$, find the integer$k$; which in ECC translates to: given the public key, find the private key). These attacks have complexity of$O(2^{n/2})$, where$n$is the size of the field. So, in a 256-bit field (i.e. with a 256-... 3 Curve25519 was chosen to have the Montgomery shape$y^2 = x^3 + A x^2 + x$to support the fast single-coordinate Montgomery ladder for Diffie–Hellman: given$x(P)$and$a$, it is cheap to compute$x([a]P)$, so there is no need to pass the$y$coordinate and implementors are not tempted to use secret-dependent conditionals to compute scalar multiplication ... 1 A signature under a public key$P$is a pair$(R,s)$such that$[s]G = R + [e]P$, where$G$is the standard base point, and$e$is the challenge. If$e = H(P, m)$doesn't involve$R$, then I can just pick$s$arbitrarily and compute$R = [s]G - [e]P$to forge any signature I want. The motivation for the Schnorr signature scheme is the Schnorr ... 3 According to Recommended Elliptic Curve Domain Parameters, Koblitz curve secp256k1 defined by$T = (p, a, b, G, n, h)p$defines the finite field$\mathbb{F}_p$,$p=2^{256} − 2^{32} − 2^{9} − 2^8 − 2^7 − 2^6 − 2^4 − 1$or in hex FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F The curve$E: y^2 = x^3 + ax + b$over$\mathbb{F}...

3

You are confusing the prime $p$ over which the curve is defined (the coordinate of the points are all defined mod $p$) with the prime $q$ which is the curve cardinality and is also prime. We have $qG = G + \ldots + G = \infty$ the neutral element (like $0$ with the addition with numbers). Taking your example, you have: $T_1 = (p+5)G$ and $T_2 = 5G$. Of ...

0

The CC2650 is a Cortex M3 with 128KB flash memory and 20KB SRAM. This is definitely not enough for RELIC or OpenSSL. TinyECC fits, but even if this is only for signatures, some symmetric cryptography will be needed in addition to it. Better options would be Cifra, libhydrogen, tweetNaCl or a minimal BearSSL build. They all fit in about 20 KB flash memory ...

1

..how does this formula $(aG+bG) = (a+b)G$ work in ECDSA? Perfectly well. It follows from the definition of $kG$ as $\overbrace{G+\cdots+G}^{k\text{ times}}$, associativity and commutativity of point addition. Notice that operator $+$ in $(aG+bG)$ and $G+\cdots+G$ is elliptic curve point addition, while operator $+$ in $(a+b)$ is addition in $\Bbb Z$ (...

0

How does this formula work (aG+bG)=(a+b)G in ECDSA? This is due to the definition of scalar multiplication of Elliptic Curves. $$[a]g = \overbrace{g+\cdots+g}^{{a\hbox{ - }times}}$$ $$[b]g = \overbrace{g+\cdots+g}^{{b\hbox{ - }times}}$$ then [a+b]g = \overbrace{g+\cdots+g}^{{a+b\hbox{ - }times}} = \overbrace{g+\cdots+g}^{{a\hbox{ - }times}} + \overbrace{...

1

Here's one way to do roughly what you described: openssl genpkey -out alice.pem -algorithm EC \ -pkeyopt ec_paramgen_curve:P-256 \ -pkeyopt ec_param_enc:named_curve openssl pkey -pubout -in alice.pem -out alice.pub openssl genpkey -out bob.pem -algorithm EC \ -pkeyopt ec_paramgen_curve:P-256 \ -pkeyopt ec_param_enc:named_curve openssl pkey -pubout -...

4

Supplying ECDSA with deterministic input doesn't make for a one-time signature—RFC 6979 chooses the per-signature secret as a deterministic but secret function of the message. However, there is a variant of ECDSA—or EdDSA—that could probably work. In ECDSA, a public key is a point $A$ on a curve with standard base point $G$, and a signature on a message $m$...

3

Update: in a footnote of his paper Generic Groups, Collision Resistance, and ECDSA (online since 2002-02-27), then published in Designs, Codes and Cryptography (2005), Daniel R. L. Brown wrote that In ECDSA, the public key can be recovered from the message and the signature. Then, acting as editor of the SEC 1 standard, he put there how such ECDSA public ...

3

Could a C25519/ED25519 cryptographic module be FIPS certified? Likely yes in the near future—although ‘near’ is measured relative to the pace of a US federal government bureaucracy. On 2019-10-31, NIST submitted a request for comments to the Federal Register on drafts for FIPS 186-5 and NIST SP 800-186 that include the Montgomery and Edwards curve shapes; ...

1

To the best of my knowledge, this hard assumption is introduced by Boneh and Boyen in this paper. But I don't think so the assumption that you mention being hard, because $c=0$ is a simple solution for it. Then the element $g^{\frac{1}{s}}$ should not publish. Also, this assumption is not bilinear because the challenge is an element in the cyclic group of $... 0 The sender must know and trust something about the intended receiver. Otherwise, the sender can't know who s/he shares a secret with. Also, the intended receiver must know and trust something about the intended sender; otherwise, the receiver will share a secret but can't know with who. The standard solution is that the above known and trusted "somethings" ... 2$G = [b^{-1} \bmod q]B$where$q$is the order of the group generated by$G$, assuming$\gcd(b, q) = 1$. 1 Is there any quantum resistant public key cryptography with similar properties of elliptic curves? Not at the level you're asking about. The issue is that Shor's algorithm can generically solve the problem "given$A, x \times A$, recover$x$" for any finite group (and going to an infinite group looks problematic for large$x$). Hence, we'd need to base ... 2 Here is what I believe Sagemath is doing: Given the problem of finding$x$s.t.$xP = Q$, one step is computing$x' = x \bmod 5888291787538299579505114081452341011$; it does this by computing$P' = (2\cdot 3 \cdot 5)P$, and$Q' = (2 \cdot 3 \cdot 5)Q$, and trying to solve$x'P' = Q'$As the order of$P'$is circa$2^{122}\$, we would normally expect this ...

Top 50 recent answers are included