Youssef El Housni
• Member for 3 years, 2 months
• Last seen this week
• Tetouan, Morocco

As you said, you need to define the goals. You can take a look at SafeCurves, which is a joint work by Bernstein and Lange to help choose/construct elliptic curves w.r.t. ECDLP difficulty and ECC ...

The 12 in BLS12-381 means that the embedding degree is 12 and the 381 means that the prime in the finite field $\mathbb{F}_p$ is of 381 bits. Now talking about your bulletpoints: The order is not $\... View answer Accepted answer 6 votes The normal form (later Edwards form) of an elliptic curve was first introduced by Harlod Edwards in his AMS bulletin by its addition law but gave no geometric interpretation. To give an interpretation ... View answer Accepted answer 3 votes You are correct about the graphical representation. A line in the finite field$\mathbb{F}_p$is not$y=ax+b$but "informally"$y \equiv ax+b \pmod p$, so the line "repeats" itself. For the tangent, ... View answer Accepted answer 2 votes Curves P-256 and Secp256k1 cannot be converted to Montgomery or Edwards forms because they are of prime order. Let's take the example of Secp256k1 and try to convert it to a Montgomery curve: A ... View answer 2 votes The order of the curve$\#E(\mathbb{F}_p)$is different from$p$. In fact, according to Hasse's theorem,$\#E(\mathbb{F}_p)=p+1-t$where$t$the Frobenius trace satisfies$|t|<2\sqrt{p}$. So the ... View answer Accepted answer 2 votes In general:$a^{-1} \equiv a^{\phi (q)-1} \pmod q$where$\phi$is euler totient function. If$q$is a prime, then$\phi (q)=q-1$and thus$a^{-1} \equiv a^{q-2} \pmod q$. View answer 2 votes You operations have to be modulo$p$where$p=2^{255}-19$because you are working in$\mathbb{F}_p$. View answer 1 votes Let's start from the beginning. We have symmetric encryption, an AES128 for example is said to have a security level$128$because we need$2^{128}$operations to recover the key (brute force). ... View answer 1 votes Given two plaintexts$\alpha$and$\beta$, Pailler cryptosystem$\mathcal{E}$homomotphic property is:$\mathcal{E}(\alpha)\times \mathcal{E}(\beta)=\mathcal{E}(\alpha+\beta)$. So,$\mathcal{E}(\alpha)...

let $a=g^{k_1} \pmod n$ and $b=g^{k_2} \pmod n$. We want to prove that $a^{k_2} \equiv b^{k_1} \pmod n$. By congruence definition, $\exists t_1 \in \mathbb{Z}/\,a=nt_1+g^{k_1}$ and $\exists t_2 \in \... View answer Accepted answer 1 votes if your$e$is coprime to$p-1$where$p=2^{255}-19$you can calculate the$e$-th of an integer modulo$p$which means you can recover$E(m)$given$E(m)^e$. In fact, if the condition holds, there ... View answer 1 votes It is common to define pairing-friendly curve such as Barreto-Naehrig on sextic twists to implement efficient pairings (https://eprint.iacr.org/2012/232.pdf). for example,$E(\mathbb{F}_p): y^2 = x^3 ...
For the modulus $n=pq$ you need to verify that $p$ and $q$ are prime numbers. You can do this with a probabilistic primality test like Rabin-Miller. For the public key $e$ you need to verify that it ...