Skip to main content

New answers tagged

2 votes
Accepted

Using Sagemath, how to exactly find out what the order of a point of an elliptic curve in the twisted Edwards form is?

The order of an element $P$ of a finite group is, by definition, the smallest strictly positive integer $k$ with $k\cdot P=\underbrace{P+P+\cdots+P}_{k\text{ terms}}$ equal to the group neutral. This ...
fgrieu's user avatar
  • 142k
2 votes
Accepted

Given a random point on a curve defined over a prime field, is it possible to compute 2 different scalar that will lead to the same result?

Consider an Edwards curve with equation $x^2+y^2=d\,x^2y^2$ in the field $\mathbb F_p$, with prime $p\bmod 4=1$, integer $d$ with $d^{(p-1)/2}\bmod p=p-1$. The group law is $$\bigl(x_1,y_1\bigr)+\bigl(...
fgrieu's user avatar
  • 142k
2 votes

Given a random point on a curve defined over a prime field, is it possible to compute 2 different scalar that will lead to the same result?

does 2 scalars $S1$ $S2$ exist such as $packed(S1\cdot P)= packed(S2\cdot P$) $S1 = S2$ is equivalent to the statement that $S1 - S2$ is an integer multiple of the order of $P$. $S1 \ne S2$ If ...
poncho's user avatar
  • 148k

Top 50 recent answers are included