What are the properties of secure Elliptic Curves?

Question

I have heard about the standard elliptic curves called NIST curves. What are the properties of such cryptographically secure elliptic curves? Are they standardized according to certain protocols? Also, does the attacker get any huge benefits from knowing which curve was used?

Answer 1

For typical protocols like Diffie–Hellman key agreement and Schnorr-type signature,^* SafeCurves surveys the modern security criteria for elliptic curve choice. In these protocols, the adversary is assumed to know the choice of curve; the security comes from criteria of the curve, not of secrecy of the curve.^†

The basic criterion is that computing ‘discrete logs’—that is, given a scalar multiple $[n]P = P + \dots + P$ of a known point $P$ on the curve by a secret integer $n$, computing $n$—costs well above $2^{100}$ curve additions. But there are many other criteria, like twist security, that are not as obvious to an untrained observer, and were not considered in the design of historical standard curves like NIST P-224.

Certain criteria are not about secure vs. insecure curves per se, but rather about fast and secure vs. fast or secure implementations: for example, NIST P-256 does not admit the Montgomery ladder, which is a fast way to compute $x$-restricted scalar multiplication in constant time. In NIST P-256, you can compute scalar multiplication fast, or in constant time, but not both—so it is tempting to sacrifice security in pursuit of performance when implementing NIST P-256 or choosing an implementation of it, whereas with Curve25519 you can attain both simultaneously using the Montgomery ladder and there is no temptation to sacrifice security that way.

Some of the criteria are relevant to some protocols but not others, for instance because DH key agreement is subject to active attacks that are not relevant in the security model of signatures. Fortunately, some curves satisfy all the criteria, such as Curve25519, Ed448-Goldilocks, and E-521. The first two of those are standardized in RFC 7748, which also prescribes a rigid procedure for selecting a curve for a given prime field satisfying all the security criteria and optimizing performance by certain easy heuristics—a procedure which, incidentally, also generates E-521.^‡

---

_{^* SafeCurves does not address more exotic applications like pairing-based cryptography, which necessarily use a different class of curves.}

_{^† In the various proposed post-quantum isogeny-based cryptosystems, choices of curves are secret positions in an isogeny graph of curves, but this is a rather different scenario from what is usually known as elliptic curve cryptography today, and as such seems unlikely to be relevant to your question.}

_{^‡ The IETF chose to endorse Ed448-Goldilocks rather than E-521 because Ed448-Goldilocks performs better, and even though the theoretical attack costs on E-521 are higher than on Ed448-Goldilocks, the two both have a meaninglessly high ‘security level’ that only serves as a hedge against minor cryptanalytic advances, not to raise actual costs on what is an impossibly expensive attack to begin with.}

Answer 2

1, there are websites/tools to check the curves you select, but highly recommend that you use "mature" curves such as secp256k1

2, crypto protocols have nothing to do with the curve selection, such as the authentication protocol.

3, yes, only if you secretly select some insecure curve.