Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I read about the following "safe" ECC curves and notably, secp256 and all the NIST curves are marked as "unsafe" when compared to more modern curves.

I need a curve for signing or encryption, (or both) but not sure how to choose from the following:

  • M-221
  • E-222
  • Curve1174
  • Curve25519
  • E-382
  • M-383
  • Curve383187
  • Curve41417
  • Ed448-Goldilocks
  • M-511
  • E-521


  1. Are there performance, size, or power efficiencies from one curve to another?
  2. Perhaps more important, are there security improvements over a given curve?
share|improve this question

closed as primarily opinion-based by e-sushi, rath, archie, poncho, DrLecter Jul 21 '14 at 7:32

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

"post-quantum"? – K.G. Mar 18 '14 at 8:02
Quantum computers can compute d.logs. on all of these curves. "Post-quantum" they have no security. – K.G. Mar 19 '14 at 8:27
2 – K.G. Mar 19 '14 at 10:29
Sorry to say so, but from my point of view …“most secure or efficient…” is primarily opinion based. Same goes for sub-questions asking “…which curve is ideal…”. And even when I would ignore all the primarily opinion based stuff, questions that go “If a new alt-coin (Bitcoin) were created today…” are nothing else than “what if” questions, which are off-topic according to our help center. – e-sushi Jul 20 '14 at 19:54
@e-sushi I don't think "what properties would make a curve ideal" is a bad question per se, just for the sake of defining "ideal", but I agree with the close vote. – rath Jul 20 '14 at 20:24

Are there performance, size, or power efficiencies from one curve to another?

The larger the curve, the larger the keys and signatures, and likely the slower the computations. There are exceptions to the last one – curve parameters do affect how efficiently they can be implemented, so some curves with good parameters can be faster than slightly smaller curves.

Perhaps more important, are there security improvements over a given curve?

All of them should be safe, but the larger curves have more security margin.

If a new alt-coin (Bitcoin) were created today, which curve is ideal?

Since signatures and public keys appear in the blockchain, having them be small would be great. Having signature verifications take little time would also be good, since that's time wasted.

Curve25519 has 256-bit keys and 512-bit signatures, and is known to have a fast implementation (Ed25519 for signatures). Especially if it gets standardized, it would be a decent choice.

Unless there's some kind of a breakthrough, 256 bit curves with 128-bit security should be enough until/unless quantum computers break ECC. For a post-quantum altcoin, you could use e.g. hash signatures, but that would expand the blockchain quite a bit.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.