Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to test and see if certain software uses P-521 ECC curves, or if it uses another variant.

Without having access to the sourcecode, or the specification, is there any way for me to test which ECC curve a given implementation of software uses?

Take a x509 certificate as an example, aside from ASN.1 information that may exist in the file, is there any way to look at raw cryptographic outputs and determine the curve used?

What is the minimum information needed to understand what curve is being used? (What variables on the client, or on the issuer/CA are needed)?

share|improve this question

migrated from Jul 22 '13 at 15:54

This question came from our site for information security professionals.

up vote 2 down vote accepted

Signatures make sense only if there is a verifier somewhere, and the verifier uses the public key, which is public. The public key will normally include the unambiguous specification of the curve. If the public key does not include such a specification (e.g. a closed system where both signer and verifier know a priori the curve), then you can still infer things:

  • A public key is a curve point $(X,Y)$ which fulfils the curve equation $Y^2 = X^3 + aX + b$ where $a$ and $b$ are part of the curve definition. This allows you to match the public key point with some standard curves.

  • If point compression is used, you might have only the $X$ coordinate. You can still match that with standard curves, because $X$ is part of the base field on which the curve is defined. If you find a $X$ which is a 521-bit integer or not much smaller (e.g. no smaller than 500 bits) then chances are high that the curve is P-521. Although it could be a custom non-standard curve of the same size.

  • If you only see the signature themselves, then you can still try to match that to standard curves. An ECDSA signature is a pair of integers $(r,s)$, where both $r$ and $s$ are in the $1..q-1$ range, $q$ being the size of the curve. There again, if both $r$ and $s$ are in the 500 to 521 bits, then chances are that the curve is P-521, because $r$ and $s$ would be too large for the smaller curves (the previous ones are 401-bit only), and it would be very improbable to obtain both values below 521 bits if the curve is B-571 or K-571 (the next ones, among the standard curves).

share|improve this answer
I'd like to study the equation 'y^2 = x^3 + ax + b` in more depth. Where should I begin? (how are those variables generated, what are known weaknesses, etc?) – LamonteCristo Jul 22 '13 at 16:15
ECC is a whole field. This book would teach you most of what you need to know. – Thomas Pornin Jul 22 '13 at 16:29
I just purchased that $99 book the other day. Glad to know I have the right study material. Thanks for confirming that, and let me know if you come across anything else I should know – LamonteCristo Jul 22 '13 at 16:35
Note that both Germany and France have specified curves of their own. So that 500-521 bit curve may also be brainpoolP512r1. Anything over 512 bits is of course safe from this issue. – Maarten Bodewes Jul 22 '13 at 17:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.