Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would expect a complicated answer for what seems like a simple question about Elliptic curve cryptography. I've read several entries here such as "Elliptic curve cryptography related key attacks" and afterwards I am still left wondering what the primary attack vector would be and also what can be done by an implementer to shore-up a weakness.

Is hashing of keys the main weakness or is it in the PRNG? At the end of the day I want to do what I can to prevent "anyone" from reading what Alice or Bob have communicated.

To summarize, what is the weak point in the algorithm and what can be done to minimize the effectiveness of an attack?

share|improve this question

If you use elliptic curve cryptography properly, with a suitable choice of parameters, there is no known weak point. (More precisely: The cryptography is unlikely to be the weakest link in your system.)

The trick is to use the cryptography properly. That's why people generally recommend that you use some existing well-vetted solution, like TLS 1.2 or similar, rather than implementing your own.

If you want to know what is the primary, most likely risk that will cause the security of your communications to be compromised, it is probably things like (1) insecure endpoints, (2) human error/mistakes, (3) compromise of one of the people/entities who are party to the communication, (4) traffic analysis, etc. In other words: system-level issues, not the elliptic curve crypto algorithms. One could write an entire book on what could be done about that, and people have; see the information security literature.

share|improve this answer
My design only has 1 destination and while it could be insecure, I want to make sure the data is secure in most cases. I don't want my choice of key hashing or number generation to cause my app to produce data that is easily deciphered. – Paul Gregoire Oct 7 '13 at 14:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.