# How can I tell which curve a given ECDSA implementation uses? (P-521 or something else)

I'd like to test and see if certain software uses P-521 ECC curves, or if it uses another variant.

Without having access to the sourcecode, or the specification, is there any way for me to test which ECC curve a given implementation of software uses?

Take a x509 certificate as an example, aside from ASN.1 information that may exist in the file, is there any way to look at raw cryptographic outputs and determine the curve used?

What is the minimum information needed to understand what curve is being used? (What variables on the client, or on the issuer/CA are needed)?

-

## migrated from security.stackexchange.comJul 22 '13 at 15:54

This question came from our site for information security professionals.

Signatures make sense only if there is a verifier somewhere, and the verifier uses the public key, which is public. The public key will normally include the unambiguous specification of the curve. If the public key does not include such a specification (e.g. a closed system where both signer and verifier know a priori the curve), then you can still infer things:

• A public key is a curve point $(X,Y)$ which fulfils the curve equation $Y^2 = X^3 + aX + b$ where $a$ and $b$ are part of the curve definition. This allows you to match the public key point with some standard curves.

• If point compression is used, you might have only the $X$ coordinate. You can still match that with standard curves, because $X$ is part of the base field on which the curve is defined. If you find a $X$ which is a 521-bit integer or not much smaller (e.g. no smaller than 500 bits) then chances are high that the curve is P-521. Although it could be a custom non-standard curve of the same size.

• If you only see the signature themselves, then you can still try to match that to standard curves. An ECDSA signature is a pair of integers $(r,s)$, where both $r$ and $s$ are in the $1..q-1$ range, $q$ being the size of the curve. There again, if both $r$ and $s$ are in the 500 to 521 bits, then chances are that the curve is P-521, because $r$ and $s$ would be too large for the smaller curves (the previous ones are 401-bit only), and it would be very improbable to obtain both values below 521 bits if the curve is B-571 or K-571 (the next ones, among the standard curves).

-
I'd like to study the equation 'y^2 = x^3 + ax + b` in more depth. Where should I begin? (how are those variables generated, what are known weaknesses, etc?) – LamonteCristo Jul 22 '13 at 16:15
ECC is a whole field. This book would teach you most of what you need to know. – Thomas Pornin Jul 22 '13 at 16:29
I just purchased that \$99 book the other day. Glad to know I have the right study material. Thanks for confirming that, and let me know if you come across anything else I should know – LamonteCristo Jul 22 '13 at 16:35
Note that both Germany and France have specified curves of their own. So that 500-521 bit curve may also be brainpoolP512r1. Anything over 512 bits is of course safe from this issue. – Maarten Bodewes Jul 22 '13 at 17:50