Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

When an elliptic curve-based cryptosystem is deployed, a single set of public parameters (consisting of a particular elliptic curve over a finite field as well as a generator of a prime order subgroup of its group of points) is typically shared across all users.

Some of these public parameters are standardized in some form. The best known ones are NIST-approved curve parameters, described as part of the FIPS 186-{2,3} standard, but there are others. For example, a French agency recently released a set of parameters recommended for local security applications (possibly over concerns re the security of curves over the very special base fields used by NIST?—they didn't say).

Is a list of such curve parameters compiled somewhere? Do you know any aside from the previous ones?

share|improve this question
    
The French authorities gave the following rationale for their FRP256v1 curve: "The proposed parameters correspond to a randomly generated curve, selected as to obey usual security criteria" (my emphasis); I infer that (at least one of) the motivation was to avoid a special field as in P-256 of FIPS 186-3. The "usual security criteria" are likely those in RGS annex B1, section 2.2.1.4. –  fgrieu Feb 21 '12 at 11:50
    
One can infer that indeed, but on the other hand, the Digital Signature Standard says that NIST-approved curves are randomly generated (and even “provably” so!) in the sense that the curve coefficients are chosen using a hash function (even though the base fields are quite special). So it seems difficult to tell what exactly randomly generated means in this context. –  Mehdi Tibouchi Feb 22 '12 at 2:22
add comment

1 Answer 1

up vote 6 down vote accepted

There are a few more standards, with (sometimes) overlapping sets of parameters:

share|improve this answer
    
Very useful, thanks. –  Mehdi Tibouchi Feb 22 '12 at 2:14
    
Actually there is considerable overlap: all 15 FIPS 186-2/3 curves are part of the 20 curves that X9.62 lists in its annex L; and all these 20 curves are part of the curves listed in SEC 2. The Brainpool curves are (deliberately) separate. –  Thomas Pornin Feb 26 '12 at 1:57
    
Also, the AACS standard (protection on HD-DVD and Blu-ray discs) uses ECDSA in their own curve (see this document)‌​, page 10). When Sony designed the protection system for the PS3, they defined no less than 64 new curves (and they totally botched their ECDSA implementation, but that's another story). –  Thomas Pornin Feb 26 '12 at 2:00
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.