Sign up ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I would like to implement a protocol using elliptic curves. I'm thinking of using MIRACL so using curves in their Weierstrass form is preferable as it they are supported by this framework.

I don't want to start picking random curves, so I am looking at the available safe curves. None of the curves is in Weierstrass form however. Do you have any suggestions for such curves? Even curves with low security, such as 80 bit curves are welcome.

share|improve this question
You can use Curve25519 as per this answer. –  SEJPM Sep 26 at 17:06
Thanks for this. I also found this post which is very useful –  absinthe Sep 26 at 19:45
Most of the advantages of safe curves only apply if you use Mongomery or (twisted) Edwards form for computation. Or do you just want to use Weierstrass form for easy prototyping with MIRACL and then switch to another form for production use? –  CodesInChaos Sep 28 at 14:50
At the current stage I want to use them for a prototype and say that I use this curves which are known as secure even if they do not perform as they are expected to. It's more like a proof of concept. Indeed, using the original form of these curves would give me a significant performance boost, but this will be done at a later stage, if so. –  absinthe Sep 30 at 8:44

2 Answers 2

Bernstein and Lange regard any curve in Weierstraß form as "not safe" because they assume, implementers of ECC with these curves will make stupid mistakes. You can see a more detailed discussion on this point here:Safety of ECC-point addition.

So you should pick a subset of their criteria if you want the Weierstraß form(I don't see any reason not to). IMHO the most important criterion is that their creation was "stiff" i.e. there was no unexplained way to fill degrees of freedom in the creation process. The NIST curves do not fullfill this criterion. They somehow fell from heaven and the community is suspicious. You might use the "stiffly" created ECC-brainpool elliptic curves(up to 512 bit), or my stiffly created curves ECC-curves_anders (up to 1024 bit).

share|improve this answer
'Rigid' is the word they use. –  otus 2 days ago

I am not clear about the categorisation of safe and non-safe curves on this site.

But the "unsafe" curves of Nist, Brainpool and Certicom are used in electronic passports , the new german id card , etc.

So, I would simply stick to that curves and forget the fancy "safe" curves.

share|improve this answer
I wouldn't say fancy Curve25519 as it is being standardized. However, the arguments that the site has are not unfair (see here. –  absinthe Sep 26 at 21:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.