Questions tagged [elliptic-curve]
Elliptic curve cryptography (ECC) is an approach to public-key cryptography that allowed smaller keys compared to non-ECC cryptography to provide equivalent levels of security.
31
questions
1
vote
1
answer
31
views
What is ge.h and what do its structs store?
As I am reading the Monero source code to understand it, I am not getting one thing, the confusion is caused due to crypto-ops.c,ge.h,rctOps.cpp.
Monero uses keccak hash that is 32 bytes in size, it ...
- 11
0
votes
0
answers
19
views
cross-curve public keys validation
I read a tech note that describes an algorithm for checking if two public keys on different curves belong to the same private key. Also found implementation on Rust programming language. Unfortunately,...
- 87
1
vote
1
answer
46
views
How Elliptic Curve calculations are possible when using base58 addresses, if these are 552 bits long?
EDIT: I mistakenly use the term Stealth Address when referring to a Monero Wallet Subaddress. Please, be aware.
I'm aware that "bare" Monero addresses aren't used to perform calculations. ...
- 63
2
votes
1
answer
98
views
ed25519 problem with libsodium implementation S_a + S_b = (s_a+s_b)*G
I'm trying to make my own implementation of atomic swaps by following this article. I use a low level node.js bindings for libsodium for this.
If I understand the protocol correctly, then Alice and ...
- 87
1
vote
1
answer
85
views
Possible error in book Zero to Monero: Second Edition
I am reading the book Zero to Monero: Second Edition from the GetMonero Library.
On the 3rd paragraph of page 15, the book mentions an algorithm for finding points inside the subgroup of order l, ...
- 13
1
vote
1
answer
74
views
Twisted Edwards curve and stealth addresses
Monero uses Twisted Edwards curve Ed25519. My questions:
Is it necessary to use this curve for stealth addresses or can one use any kind of elliptic curve, such as secp256k1?
How to define Ed25519 ...
- 11
1
vote
1
answer
54
views
How to compute ringct multisignature key images? (Disambiguation of MRL005)
I'm looking at the multisignature scheme provided by MRL005 Section 4.4, and some things are unclear to me. I've attached a picture below of the expression for which I'm seeking some clarification.
...
- 13
5
votes
2
answers
700
views
Curve used in Monero - A Subgroup of Ed25519?
I am a student researcher at IIT Bombay (India). I have been recently understanding the cryptography behind Monero as well as its implementation.
The elliptic curve used in the CryptoNote protocol is ...
- 51
1
vote
1
answer
57
views
How can we be sure that there is no bias in calculating H?
To get H we hash G using keccak, interpret the result as a compressed Ed25519 point, then multiply by 8 to ensure the point is in the subgroup of the base point G.
How can we be sure there is no bias ...
- 650
2
votes
1
answer
173
views
Generating key derivation in construct_miner_tx
Good day!
I am trying to understand the construct_miner_tx function inside cryptonote_tx_utils.cpp and I am stuck on comparing what is being discussed in the zero to monero reference pdf regarding ...
- 69
3
votes
1
answer
70
views
Is a mnemonic for view only wallet possible?
It occurred to me that one may wish to restore a wallet on a compromised computer. Perhaps they need to prove that a payment was received.
Regardless of whether this is a good idea, is it possible ...
- 5,495
2
votes
1
answer
110
views
Implementation of monero on other curves
Are there any other implementations of curves in the Monero code (other than Curve25519)?
I'm asking because the code is very optimized to this curve (e.g. the multiplication in 8 when computing the ...
- 367
3
votes
1
answer
170
views
How the H_p(x) (Hash to a point on the curve), is calculated in Monero?
How the H_p(x) (Hash to a point on the curve), is calculated in Monero?
The reference in [1] state that it calculated directly.
Is it also use keccack?
[1]- Zero to Monero https://getmonero.org/...
- 367
4
votes
1
answer
226
views
Who Generates parameters G & H for Pedersen commitment in Monero?
Who (which party) generates parameters G & H for Pedersen commitment in Monero? I mean for a confidential transaction in Monero, pedersen commitment is required which has parameters G & H ...
- 41
2
votes
1
answer
86
views
Multiplication over an elliptic curve using the monero cryptographic libraries
I am trying to implement a PoC of some variant of monero.
Currently for start, I want to generate the expression G*a*i^2 given all the scalars (a,i,2).
I've lost my way while looking at Monero ...
- 219
1
vote
1
answer
282
views
Are multiple base points or generator points used for the ed25519 curve in monero / CN?
Does the point ever change for different keys or other functions that use the curve?
If the point never changes is the only curve input parameter the index (r) that is used in the scalar ...
- 985
2
votes
1
answer
295
views
What are the hex representations of the small subgroup curve points on Ed25519?
Monero uses Ed25519, which has a cofactor of 8. This means the curve has a prime order l = 2^252 + 27742317777372353535851937790883648493 and the total number of possible points on the curve is 8l. ...
- 8,428
2
votes
2
answers
257
views
Do stealth address only work with elliptic curve cryptography ?
Monero uses elliptic curve for stealth address generation. And all the things i have read about stealth addresses mention elliptic curve. My question is are there other cryptosystems out there which ...
- 123
0
votes
1
answer
103
views
How do I multiply 2 public keys?
I want to make DH-like key exchange calculating something like this:
b = H(b0B1B2)
But the problem is multiplication between two ec-points is not defined on ec-curve.
I know monero makes some ...
- 121
6
votes
2
answers
539
views
Why does Monero use a 256 bit seed?
Apparently, ECC 256 bit keys have a bit strength of 128 bits. See https://crypto.stackexchange.com/questions/26791/how-many-bits-of-entropy-does-an-elliptic-curve-key-of-length-n-provide
And ...
- 8,428
2
votes
1
answer
451
views
How to convert monero's curve25519 basepoint to bouncycastle
This is how to get the curve25519 basepoint in monero (use js console at https://xmr.llcoins.net/)
> var identity = "0100000000000000000000000000000000000000000000000000000000000000"
> var base ...
7
votes
1
answer
753
views
What is the 'base point' (G) from the whitepaper and how is it represented as a single hex value?
The white paper introduces G, aka the base point, as G = (x, −4/5).
I have two questions:
what is x? Is this the x from the elliptic curve (is it a variable)? If so, how is a private key aG ...
- 822
9
votes
3
answers
4k
views
How does the recent patched key image exploit work in practice?
For more info https://getmonero.org/2017/05/17/disclosure-of-a-major-bug-in-cryptonote-based-currencies.html This has been patched months ago and was never exploited which can be proven by running a ...
- 3,185
5
votes
1
answer
231
views
How were Monero elliptic curve constants chosen?
In the cryptonote paper review, there was a mention about not knowing how the constants were calculated, is there anyway to verify these constants are 'safe' or change them to something 'better'? ...
- 3,185
5
votes
1
answer
671
views
What is elliptic curve cryptography and why is it important to Monero?
What is elliptic curve cryptography and why is it important to Monero?
Please provide both a basic description and an in depth description of the type found on Moneropedia
- 1,010
17
votes
2
answers
2k
views
Why/how does monero generate public ed25519 keys without using the standard public key generation provided by ed25519 libraries?
Why/how does monero generate public ed25519 keys without using the standard public key derivation provided by ed25519 libraries?
Inspecting the code for mininero (https://github.com/monero-project/...
- 1,257
10
votes
4
answers
946
views
Is a Monero key backdoor possible?
Recently an article was published stating the possibility of the NSA or some other malicious organization creating backdoor undetectable Diffie-Hellman keys (source) to allow snooping.
Is Monero at ...
- 420
5
votes
2
answers
373
views
How strong is Monero cryptography against brute-force attacks?
I have seen an image about brute forcing Bitcoin cryptography saying even a perfect computer which uses all the power of star system, and still wont succeed.
How strong is Monero cryptography ...
- 722
10
votes
1
answer
272
views
How to see that the RingCT commitment parameter H is in fact a multiple of the base point G
On the last paragraph of page 7 of Monero Research Lab's paper about RingCT, the author makes some statements to the effect that it is possible to pick a random point on the base curve ED25519 that is ...
- 3,327
5
votes
1
answer
223
views
Why does the stealth address involve a hash function?
According to the cryptonote white paper, a stealth address of the form P = H_s(rA)G + B. My question is, why is the hash function necessary? It seems that P=rA + B would work just as well. Using a ...
- 3,120
10
votes
1
answer
2k
views
Comparison of Curve25519 with secp256k1?
How does the security of Curve25519 compare with secp256k1? Is it known why the creators of CryptoNote may have chosen one curve over the other?
- 808