2
$\begingroup$

I would expect a complicated answer for what seems like a simple question about Elliptic curve cryptography. I've read several entries here such as "Elliptic curve cryptography related key attacks" and afterwards I am still left wondering what the primary attack vector would be and also what can be done by an implementer to shore-up a weakness.

Is hashing of keys the main weakness or is it in the PRNG? At the end of the day I want to do what I can to prevent "anyone" from reading what Alice or Bob have communicated.

To summarize, what is the weak point in the algorithm and what can be done to minimize the effectiveness of an attack?

$\endgroup$

1 Answer 1

3
$\begingroup$

If you use elliptic curve cryptography properly, with a suitable choice of parameters, there is no known weak point. (More precisely: The cryptography is unlikely to be the weakest link in your system.)

The trick is to use the cryptography properly. That's why people generally recommend that you use some existing well-vetted solution, like TLS 1.2 or similar, rather than implementing your own.

If you want to know what is the primary, most likely risk that will cause the security of your communications to be compromised, it is probably things like (1) insecure endpoints, (2) human error/mistakes, (3) compromise of one of the people/entities who are party to the communication, (4) traffic analysis, etc. In other words: system-level issues, not the elliptic curve crypto algorithms. One could write an entire book on what could be done about that, and people have; see the information security literature.

$\endgroup$
1
  • $\begingroup$ My design only has 1 destination and while it could be insecure, I want to make sure the data is secure in most cases. I don't want my choice of key hashing or number generation to cause my app to produce data that is easily deciphered. $\endgroup$ Oct 7, 2013 at 14:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.