RSA and ElGamal can be implemented using the technique of Elliptic curves. I am confused on why the it seems that Elliptic curves are not so popular in cryptographic applications since they provide the same security with smaller key sizes?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
It is true that elliptic curves allow the same security with smaller key sizes. However, the size is not the only important aspect. Familiarity of algorithm, ease of implementation, performance, how many independent implementations exist, etc. affect how widely algorithm is implemented.
For Elliptic Curves, like many other technologies one factor slowing down the adoption has been patents. EC2m was previously considered "patent mine field" and there are also some patents on ECP techniques.
Elliptic Curves are still fairly new, and for security levels usually deployed, it is very common that in practice performance of RSA, DSA or DH exceeds ECC of similar security strength.
For larger security levels (around 192-bit or 256-bit security strength, i.e. 384-bit - 521-bit ECC curves), the required DSA/DH primes or RSA modulus grow so large that ECC usually wins in performance.
So, in my experience the reasons for smaller adoption are: difference in complexity, smaller speed on usual key lengths, patent risks, and the fact that there are less implementations than of, say RSA.
I have seen Elliptic Curves getting some attention and deployments and it seems to be growing. The drivers for that (which help with ECC adoption) seem to NIST's transition to higher key lengths (see SP 800-131A) and NSA Suite B. There are very few applications where the difference in key length is significant differentiator.