Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I am using nginx compiled with OpenSSL 1.0.1f (most current release available). Nginx allows administrators to set a configuration parameter called ssl_ecdh_curve, and the value of this parameter can be any named curve available in OpenSSL. I've seen most people here reference the secp256r1 curve, and many nginx users have selected secp521r1.

Normally, I would just pick one of those and assume that the collective wisdom of the community had selected the safest curves. Just yesterday, however, I stumbled on the site http://safecurves.cr.yp.to/.

From what I see there, standard curves like NIST's P-256 have weaknesses or vulnerabilities that cause them to be labelled as unsafe. Looking over their list of safe curves, I had a difficult time matching their curve names up to the list of curves available in the most recent release of OpenSSL.

So, my question is this: Which curves currently available in OpenSSL would be considered safe using the guidelines set forth by Bernstein and Lange on their site?


A very weak attempt at a summary of their criteria includes the following points:

  • Montgomery ladder support
  • Not vulnerable to twist attacks
  • Must support simple, fast, complete, constant-time single-coordinate single-scalar multiplication, and constant-time multi-scalar multiplication
  • Uniform random string indistinguishability (e.g. Elligator)
  • Safe against additive and multiplicative transfer to a linear algebraic group
  • The absolute value of a complex-multiplication field discriminant D (defined on their site) to be larger than 2^100
  • The curve-generation process is completely / mostly explained (in their words "rigid")

For reference, I've included the list of curves as supplied by OpenSSL 1.0.1f:

$ openssl ecparam -list_curves
  secp112r1 : SECG/WTLS curve over a 112 bit prime field
  secp112r2 : SECG curve over a 112 bit prime field
  secp128r1 : SECG curve over a 128 bit prime field
  secp128r2 : SECG curve over a 128 bit prime field
  secp160k1 : SECG curve over a 160 bit prime field
  secp160r1 : SECG curve over a 160 bit prime field
  secp160r2 : SECG/WTLS curve over a 160 bit prime field
  secp192k1 : SECG curve over a 192 bit prime field
  secp224k1 : SECG curve over a 224 bit prime field
  secp224r1 : NIST/SECG curve over a 224 bit prime field
  secp256k1 : SECG curve over a 256 bit prime field
  secp384r1 : NIST/SECG curve over a 384 bit prime field
  secp521r1 : NIST/SECG curve over a 521 bit prime field
  prime192v1: NIST/X9.62/SECG curve over a 192 bit prime field
  prime192v2: X9.62 curve over a 192 bit prime field
  prime192v3: X9.62 curve over a 192 bit prime field
  prime239v1: X9.62 curve over a 239 bit prime field
  prime239v2: X9.62 curve over a 239 bit prime field
  prime239v3: X9.62 curve over a 239 bit prime field
  prime256v1: X9.62/SECG curve over a 256 bit prime field
  sect113r1 : SECG curve over a 113 bit binary field
  sect113r2 : SECG curve over a 113 bit binary field
  sect131r1 : SECG/WTLS curve over a 131 bit binary field
  sect131r2 : SECG curve over a 131 bit binary field
  sect163k1 : NIST/SECG/WTLS curve over a 163 bit binary field
  sect163r1 : SECG curve over a 163 bit binary field
  sect163r2 : NIST/SECG curve over a 163 bit binary field
  sect193r1 : SECG curve over a 193 bit binary field
  sect193r2 : SECG curve over a 193 bit binary field
  sect233k1 : NIST/SECG/WTLS curve over a 233 bit binary field
  sect233r1 : NIST/SECG/WTLS curve over a 233 bit binary field
  sect239k1 : SECG curve over a 239 bit binary field
  sect283k1 : NIST/SECG curve over a 283 bit binary field
  sect283r1 : NIST/SECG curve over a 283 bit binary field
  sect409k1 : NIST/SECG curve over a 409 bit binary field
  sect409r1 : NIST/SECG curve over a 409 bit binary field
  sect571k1 : NIST/SECG curve over a 571 bit binary field
  sect571r1 : NIST/SECG curve over a 571 bit binary field
  c2pnb163v1: X9.62 curve over a 163 bit binary field
  c2pnb163v2: X9.62 curve over a 163 bit binary field
  c2pnb163v3: X9.62 curve over a 163 bit binary field
  c2pnb176v1: X9.62 curve over a 176 bit binary field
  c2tnb191v1: X9.62 curve over a 191 bit binary field
  c2tnb191v2: X9.62 curve over a 191 bit binary field
  c2tnb191v3: X9.62 curve over a 191 bit binary field
  c2pnb208w1: X9.62 curve over a 208 bit binary field
  c2tnb239v1: X9.62 curve over a 239 bit binary field
  c2tnb239v2: X9.62 curve over a 239 bit binary field
  c2tnb239v3: X9.62 curve over a 239 bit binary field
  c2pnb272w1: X9.62 curve over a 272 bit binary field
  c2pnb304w1: X9.62 curve over a 304 bit binary field
  c2tnb359v1: X9.62 curve over a 359 bit binary field
  c2pnb368w1: X9.62 curve over a 368 bit binary field
  c2tnb431r1: X9.62 curve over a 431 bit binary field
  wap-wsg-idm-ecid-wtls1: WTLS curve over a 113 bit binary field
  wap-wsg-idm-ecid-wtls3: NIST/SECG/WTLS curve over a 163 bit binary field
  wap-wsg-idm-ecid-wtls4: SECG curve over a 113 bit binary field
  wap-wsg-idm-ecid-wtls5: X9.62 curve over a 163 bit binary field
  wap-wsg-idm-ecid-wtls6: SECG/WTLS curve over a 112 bit prime field
  wap-wsg-idm-ecid-wtls7: SECG/WTLS curve over a 160 bit prime field
  wap-wsg-idm-ecid-wtls8: WTLS curve over a 112 bit prime field
  wap-wsg-idm-ecid-wtls9: WTLS curve over a 160 bit prime field
  wap-wsg-idm-ecid-wtls10: NIST/SECG/WTLS curve over a 233 bit binary field
  wap-wsg-idm-ecid-wtls11: NIST/SECG/WTLS curve over a 233 bit binary field
  wap-wsg-idm-ecid-wtls12: WTLS curvs over a 224 bit prime field
  Oakley-EC2N-3: 
    IPSec/IKE/Oakley curve #3 over a 155 bit binary field.
    Not suitable for ECDSA.
    Questionable extension field!
  Oakley-EC2N-4: 
    IPSec/IKE/Oakley curve #4 over a 185 bit binary field.
    Not suitable for ECDSA.
    Questionable extension field!
share|improve this question

closed as primarily opinion-based by e-sushi, DrLecter, AFS, hunter, rath Mar 14 at 9:14

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

    
I explicitly asked "using the guidelines set forth by Bernstein and Lange on their site." –  SamC Mar 13 at 18:59
    
It will still result in primarily opinion-based answers because (a) it is personal opinion if Bernstein and Lange have actually provided enough information to be able to find “… the safest curve…“ beyond any reasonable doubt, (b) the interpretation of what Bernstein and Lange published is also primarily opinion-based – like every interpretation is, and (c) it is primarily opinion-based how one defines “… the safest curve…“ in the first place. –  e-sushi Mar 13 at 19:05
    
Apart from rigidness those "weaknesses" are features of montgomery/edwards curves. Those features don't gain you anything if you use weierstrass form in your implementation. –  CodesInChaos Mar 13 at 21:30
    
According to Bernstein and Lange, "These problems are exploitable by real attackers, taking advantage of the gaps between ECDLP and real-world ECC" –  SamC Mar 14 at 1:27
    
I likely believe that you will find it none of the curves meet your requirements. The main concern I have with curve security is complete addition, which is a problem with all NIST curves. –  Richie Frame Mar 14 at 3:01