Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [elliptic-curve]

Elliptic curve cryptography (ECC) is an approach to public-key cryptography that allowed smaller keys compared to non-ECC cryptography to provide equivalent levels of security.

1
vote
1answer
15 views

Is a mnemonic for view only wallet possible?

It occurred to me that one may wish to restore a wallet on a compromised computer. Perhaps they need to prove that a payment was received. Regardless of whether this is a good idea, is it possible ...
2
votes
1answer
80 views

Implementation of monero on other curves

Are there any other implementations of curves in the Monero code (other than Curve25519)? I'm asking because the code is very optimized to this curve (e.g. the multiplication in 8 when computing the ...
3
votes
1answer
42 views

How the H_p(x) (Hash to a point on the curve), is calculated in Monero?

How the H_p(x) (Hash to a point on the curve), is calculated in Monero? The reference in [1] state that it calculated directly. Is it also use keccack? [1]- Zero to Monero https://getmonero.org/...
4
votes
1answer
78 views

Who Generates parameters G & H for Pedersen commitment in Monero?

Who (which party) generates parameters G & H for Pedersen commitment in Monero? I mean for a confidential transaction in Monero, pedersen commitment is required which has parameters G & H ...
2
votes
1answer
51 views

Multiplication over an elliptic curve using the monero cryptographic libraries

I am trying to implement a PoC of some variant of monero. Currently for start, I want to generate the expression G*a*i^2 given all the scalars (a,i,2). I've lost my way while looking at Monero ...
1
vote
1answer
36 views

Are multiple base points or generator points used for the ed25519 curve in monero / CN?

Does the point ever change for different keys or other functions that use the curve? If the point never changes is the only curve input parameter the index (r) that is used in the scalar ...
2
votes
1answer
68 views

What are the hex representations of the small subgroup curve points on Ed25519?

Monero uses Ed25519, which has a cofactor of 8. This means the curve has a prime order l = 2^252 + 27742317777372353535851937790883648493 and the total number of possible points on the curve is 8l. ...
2
votes
2answers
97 views

Do stealth address only work with elliptic curve cryptography ?

Monero uses elliptic curve for stealth address generation. And all the things i have read about stealth addresses mention elliptic curve. My question is are there other cryptosystems out there which ...
0
votes
1answer
52 views

How do I multiply 2 public keys?

I want to make DH-like key exchange calculating something like this: b = H(b0B1B2) But the problem is multiplication between two ec-points is not defined on ec-curve. I know monero makes some ...
6
votes
2answers
312 views

Why does Monero use a 256 bit seed?

Apparently, ECC 256 bit keys have a bit strength of 128 bits. See https://crypto.stackexchange.com/questions/26791/how-many-bits-of-entropy-does-an-elliptic-curve-key-of-length-n-provide And ...
3
votes
1answer
124 views

How to convert monero's curve25519 basepoint to bouncycastle

This is how to get the curve25519 basepoint in monero (use js console at https://xmr.llcoins.net/) > var identity = "0100000000000000000000000000000000000000000000000000000000000000" > var base ...
5
votes
1answer
163 views

What is the 'base point' (G) from the whitepaper and how is it represented as a single hex value?

The white paper introduces G, aka the base point, as G = (x, −4/5). I have two questions: what is x? Is this the x from the elliptic curve (is it a variable)? If so, how is a private key aG ...
10
votes
3answers
3k views

How does the recent patched key image exploit work in practice?

For more info https://getmonero.org/2017/05/17/disclosure-of-a-major-bug-in-cryptonote-based-currencies.html This has been patched months ago and was never exploited which can be proven by running a ...
6
votes
1answer
189 views

How were Monero elliptic curve constants chosen?

In the cryptonote paper review, there was a mention about not knowing how the constants were calculated, is there anyway to verify these constants are 'safe' or change them to something 'better'? ...
6
votes
1answer
409 views

What is elliptic curve cryptography and why is it important to Monero?

What is elliptic curve cryptography and why is it important to Monero? Please provide both a basic description and an in depth description of the type found on Moneropedia
15
votes
1answer
1k views

Why/how does monero generate public ed25519 keys without using the standard public key generation provided by ed25519 libraries?

Why/how does monero generate public ed25519 keys without using the standard public key derivation provided by ed25519 libraries? Inspecting the code for mininero (https://github.com/monero-project/...
10
votes
4answers
757 views

Is a Monero key backdoor possible?

Recently an article was published stating the possibility of the NSA or some other malicious organization creating backdoor undetectable Diffie-Hellman keys (source) to allow snooping. Is Monero at ...
5
votes
2answers
236 views

How strong is Monero cryptography against brute-force attacks?

I have seen an image about brute forcing Bitcoin cryptography saying even a perfect computer which uses all the power of star system, and still wont succeed. How strong is Monero cryptography ...
10
votes
1answer
166 views

How to see that the RingCT commitment parameter H is in fact a multiple of the base point G

On the last paragraph of page 7 of Monero Research Lab's paper about RingCT, the author makes some statements to the effect that it is possible to pick a random point on the base curve ED25519 that is ...
5
votes
1answer
151 views

Why does the stealth address involve a hash function?

According to the cryptonote white paper, a stealth address of the form P = H_s(rA)G + B. My question is, why is the hash function necessary? It seems that P=rA + B would work just as well. Using a ...
9
votes
1answer
976 views

Comparison of Curve25519 with secp256k1?

How does the security of Curve25519 compare with secp256k1? Is it known why the creators of CryptoNote may have chosen one curve over the other?