# Tag Info

### Does an binary elliptic curve like sect571r1 support a bijective asymmetric operation pair on bytes? If so, is there a self-contained example?

Mapping from a scalar (a positive integer less than the order of the group generated by the curve base point) to a group element (EC point) is a bijection. However, it's also computationally one-way. ...
• 3,902
Accepted

### EC has lower CPU consumption than RSA under what condition?

under what condition (is processing for ECC about four times less CPU-intensive than for RSA) ? That figure is likely for computing and once verifying a signature at an industry-standard security ...
• 126k
1 vote
Accepted

### Does the ECDSA private or public keys contain data about the signature hash algorithm?

I'm not sure about the Java code, but whether or not a keypair has a hash function associated with it depends on its AlgorithmIdentifier, which usually contains ASN....
• 7,168
Accepted

### How are the unified addition formulae in extended twisted Edwards coordinates derived from the affine addition formulae?

To convert extended twisted Edwards coordinates to extended projective coordinates one needs to divide $$X_3 = (X_1Y_2 + Y_1X_2)(Z_1Z_2 − d T_1T_2)$$ by $$Z3 = (Z_1Z_2 − d T_1T_2)(Z_1Z_2 + d T_1T_2)$$ ...
• 44.3k
Accepted

### Find Ed25519 Y Coordinate from X Coordinate

Get the curve equation $$-x^2 + y^2 = 1 - \frac{121665}{121666}x^2y^2$$ Call $d = \frac{121665}{121666}$ $$-x^2 + y^2 = 1 - dx^2y^2$$ Take $y^2$ to left $$y^2 + dx^2y^2 = 1 + x^2$$ Take $y^2$ out ...
• 44.3k
Accepted

### Is it true that Public keys with even y coordinate correspond to private key that are less than n/2 and vice versa? (Secp256k1)

A little test with Sagemath for the first 10 integers as the private key; ...
• 44.3k

### When working in a subgroup of EC in EdDSA (especially Ed255190), how is it OK to use operations different from that of the main group?

Little preamble on EC(C) In cryptography, we use an Elliptic Curve (EC) over a finite field. To form an EC over a finite field, first, select a finite field $\mathbb F_p$ where $p$ is either a prime ...
• 44.3k
1 vote

### When working in a subgroup of EC in EdDSA (especially Ed255190), how is it OK to use operations different from that of the main group?

every existing implementation implements scalar arithmetic $\operatorname{mod} q$ This works perfectly in all scenarios as long as all scalars and all EC points are trusted or validated. Just in case ...
• 3,902
Accepted

### When working in a subgroup of EC in EdDSA (especially Ed255190), how is it OK to use operations different from that of the main group?

The statement every existing implementation implements scalar arithmetic $\bmod q$, the order of the prime-order group, not $\bmod 8q$, the order of the full group. does not imply that working in a ...
• 126k
1 vote

### How to modify elliptic curve point?

Q(5555555555) % 2500 = Q(55) how to do this ? We hope you can't do this (on a large elliptic curve, and without knowing the private key 5555555555 - if you can, then ECC is broken. After all, if you ...
• 134k
1 vote

### How to modify elliptic curve point?

In standard Elliptic Curve cryptography, the private key can be reduced modulo the order of the generator point, without changing the matching public key. That order is often noted $n$. In the ...
• 126k

### Is product of two linear combinations over a finite field information hiding?

would it be sufficient if the attacker could compute $h(M)$ for values of $M$ that he did not query? yes, that's also not desirable Ok, here's one (not likely to be optimal approach) to do that, ...
• 134k

### How is the edwards448 generator derived from the curve448 generator in RFC 7748?

The code below complements Ruggero's answer. Ruggero explained that the given isogeny, curve448 --> edwards448, is a 4-isogeny, as is stated in RFC 7748. When it is applied to a point on curve448, ...
1 vote
Accepted

### Non-determnistic ECDSA: is there any unique common factor of all signatures of the same message by the same private key?

An ECDSA signature can't be verified unless the associated public key $P$ is known. If that public key is part of what is communicated as part of $s_i$, then the answer is simply $f(s_i) = P$. If $P$ ...
• 3,902
It doesn't work as you expect. This is a 4 degree isogeny, not an isomorphism or a birational equivalence. One complete map $toMonty(toEdwards(P))$ will not get you to the starting point $(P)$, it ...