# Tag Info

0

How can a subgroup be created by a point ( So the base points creates a subgroup, which has a prime order. But this order is also the order of the curve25519. I'm a bit confused by that ) Take an element $g$ in a group $G$. You can create the subgroup generated by $g$, by taking all the elements $1$, $g$, $g^2$, $\ldots$, $g^{q-1}$ and eventually, $g^q=1$, ...

0

Meta: I know this answers is a basic copy and paste. It should be a comment to better understand the question, but it's too long, so I posted it as answer. It's very clear from the curve25519 paper. I selected $(A − 2)/4$ as a small integer, as suggested by Montgomery, to speed up the multiplication by $(A − 2)/4$; this has no effect on the ...

0

From the paper: I selected (A − 2)/4 as a small integer, as suggested by Montgomery, to speed up the multiplication by (A − 2)/4 The smaller the value (A-2)/4 is, the faster is the multiplication by that value (which is required by the point doubling formula). So basically the curve was found by incrementing the A value, restricting to the values where (...

5

There must be some attacks that you can use to try and crack the DLP that can't be used on ECDH and that would force you to chose a longer key for it to be safe. Indeed, there are algorithms applicable to DLP in groups that are a subgroup of $\Bbb Z_p^*$, but not to Elliptic Curve (sub)groups: A variant of (G)NFS. See e.g. this article about solving a 768-...

1

I first recall some basics on the discrete logarithm problem and the Pollard-rho algorithm before answering you question. The discrete logarithm problem Given a point $P$ of prime order $q$ on an elliptic curve, and $Q$ a point in the subgroup generated by $P$, then there exists $k$ such that $Q = kP$ where $0\leq k < q$. The discrete logarithm of $Q$ ...

2

How does reducing the upper limit for $k$ (to $2^n$) improve an attacker's chances to learn $k$ Security becomes at most $n/2$-bit. Baby step - giant step finds $k$ given the public key $\underline{[k]G}$ with computational cost $\mathcal O(2^{n/2})$. Pollard's Rho can be adapted to the same asymptotic cost, with feasibly little memory and efficient ...

1

The answer is contained in the Decaf paper [H2015], p. 3 already. Clearing the top bit(s). This appears to be just to get the scalar value $s$ in the range of $0 \le s < \ell$ (with an additional check whether it actually holds true after clearing the top bit(s)). This is just an implementation detail being mixed with actual cryptographic math; see ...

0

an attacker apparently needs both to have the public key and brute-force the passphrase to decrypt the data. Uh, no. The only way the passphrase helps the attacker is if s/he gets the file (often named secring) containing the private key, which in this file is encrypted using the passphrase. It is very useful to keep that file secret, especially if the ...

-1

[...] any proof that the e-voting is definitely insecure. [...] Blockchain can be considered the best solution compared to the current voting system as it covers many security aspects. can anybody explain to me thoroughly with tangible examples and proofs In cryptography, a system is considered secure: under a set of assumptions if formal proof ...

4

As a society we have decided that "secret ballots" are better than "open ballots". When you use a blockchain you will issue public keys to individuals who can then verify their votes were counted. I'm aware that the voter's name is not on these keys (I could not look at the chain and determine how you voted), but regardless it is a way to prove how you voted ...

16

There's a good reason many democracies reserve mail voting to rare cases where that's the only option: it allows one's vote to be influenced by duress or bribery, because one can prove how one voted. No remote voting technology that I know has solved that issue. Ergo, physically going to a polling station with isoloirs should remain the normal voting ...

0

This seems like a strange question. Curve25519 is the name of the curve and is also used to refer to a key agreement protocol using it (which is more properly called X25519), whereas Ed25519 is a signature scheme that uses the same curve (albeit represented differently). They're different applications, so what do you even mean by using curve25519 instead ...

3

TL;DR: The public key is not a point, it is the $x$-coordinate of the point. The base point of the curve has been chosen to be the point $G = (9,y_0)$ with $y_0>0$, and the curve Curve25519 is used in its Montgomery form given by the equation $$y^2 = x^3 + 486662x^2 + x.$$ The main operation on elliptic curves is the scalar multiplication, and in this ...

1

In general, asymmetric cryptography (which includes elliptic curve crypto, RSA, Diffie-Hellman, etc) is orders of magnitude slower than symmetric cryptography (e.g., AES). Curve 25519 is fast compared to other asymmetric cryptography, but still very slow compared to symmetric encryption. Because of this, asymmetric cryptography is mostly used to set up ...

1

A number of reasons contribute to this. Curve25519 has a non-governmental origin. It's a curve that's very safe by design, and impregnable to many side-channel and other weaknesses that other curves suffer from. Also, it's a curve with 'nothing up my sleeve' coefficients. Unlike the NSA curves, which NIST endorse. Although not directly related, after ...

0

In addition to poncho's answer, what is meant by smaller is the size of public keys and the size of signatures.

2

But my problem is that we usually have long messages, so we have to partition it into several blocks and then encrypt it. Therefore, when we have a 2048 bits long messages we make around 12 blocks and then encrypt them. No, that's not what we do in practice. Instead, when we need to public key encrypt a large message, we pick a random symmetric key, ...

3

Can anyone explain or push me in the right direction on how to show/answer this? The first obvious thing to ponder is "what does it mean that a 'group is cyclic'? What properties does a cyclic group have, that noncyclic groups do not?" (Broader hint: a cyclic group has a generator; noncyclic (finite) groups do not) I understand that points of order two ...

19

The RFC specifies things in terms of bits. Each call to HMAC outputs hlen bits. tlen is the count of bits obtained so far; when at least qlen bits have been obtained, this step is finished. The sample code is written in Java in which the elementary unit of information is the octet ("byte" in usual terminology). The supported hash functions always output a ...

3

Is there a reason for these differences You do realize that ECDSA is randomized [1], that is, signing the same message twice with the same private key will generate two different signatures. This is normal, and not due to you using three different ECDSA implementations. All three signatures are DER-encodings of 'a list of two integers, both of which are ...

1

called asymmetric self encryption No, not really, you just made up that term. might seem an unusual choice in situations where a key exchange is not required No it doesn't, although commonly a hybrid cryptography is used, especially for EC based cryptography. an attacker apparently needs both to have the public key and brute-force the passphrase to ...

3

How much Unsafe is using secp256k1 for ECIES and what dangers/weakness it exposes /what attack it makes possible? Let's have a look through the "failures" that secp256k1 achieves according to SafeCurves. ECDLP: "disc": This means that the curve has a specific value to be small. As the website indicates this is not inherently bad or exploitable, it just ...

Top 50 recent answers are included