New answers tagged

1 vote

Why not to use curve over field of $p^m$ with $p > 2$ for ECDSA?

Note that ECDLP over extension fields is not necessarily harder than ECDLP over the underlying field of prime characteristic, simply because for any power of prime $q$, $E(\mathbb{F}_{q})$ is a ...
user avatar
-1 votes

Which is better ECDHE with TLS 1.0

If your client use modern browser such as the latest chrome or firefox you should choose TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (If you use ECDSA certificates)OR TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (If ...
user avatar
  • 19
4 votes
Accepted

Curve448 - Can Ed448 key material be reused for X448?

You do not need to convert the Edwards448 public key to the birationally equivalent Curve448 public key in order to do ECDH. You can just stick to Edwards448. There will be a performance gain if you ...
user avatar
  • 2,523
3 votes

Strauss-Shamir trick on EC multiplication by scalar

I'll describe the standard Shamir trick adapted to the context of ECDSA signature verification. Dropping some indices, the computationally expensive part of it is computing $$u\cdot G+v\cdot Q$$ where ...
user avatar
  • 122k
1 vote

Do you know protocols, where it is necessary to obtain several "independent" points on the same elliptic curve?

Your question is essentially: Is it useful to be able to sample a tuple $(Q_1, Q_2, \dots, Q_n) \in E(F)^n$ such that no relation is known among the points, but the tuple is not sampled from the ...
user avatar
  • 4,382
2 votes

Do you know protocols, where it is necessary to obtain several "independent" points on the same elliptic curve?

There is a "hash-to-point" function used in several schemes, where it is necessary to generate an EC point where the discrete log w.r.t. any other EC point is unknown. In particular: A ...
user avatar
  • 2,523
8 votes
Accepted

Do you know protocols, where it is necessary to obtain several "independent" points on the same elliptic curve?

Do you know protocols where it is necessary to obtain several "independent" points on the same elliptic curve? One obvious place where this occurs if you are implementing a Pedersen ...
user avatar
  • 131k
1 vote
Accepted

Test vectors (points) for Ed25519

Just use a reliable library to generate your test vectors. For example, using elliptic: ...
user avatar
  • 2,523
3 votes
Accepted

Is it theoretically possible to delegate public key generation?

If I understand your scheme correctly, then Alice needs a separate secure channel to communicate $i$ to Bob. Monero solves this problem by creating a one-time destination public key every time funds ...
user avatar
  • 2,523
0 votes

ECDSA signature with Brainpool curves in TLS possible?

RFC 7027 defines short names for the brainpool curves that may be used in TLS 1.0, 1.1, and 1.2 for key exchange (by adding them the NamedCurve defined types). As ...
user avatar
2 votes

EC Public key encryption scheme where Alice does not know Bob's public key

You might be looking for anonymous messaging in which the sender hides their identity from the receiver. The Libsodium has one specially designed for this sealed_box Only the recipient can decrypt ...
user avatar
  • 42.9k
13 votes
Accepted

EC Public key encryption scheme where Alice does not know Bob's public key

ECIES does not require the sender to publish their own permanent public key. Instead, they can just create an anonymous ephemeral key pair, and publish the ephemeral public key along with the ...
user avatar
  • 2,523

Top 50 recent answers are included