Elliptic curve cryptography attack vector

Question

I would expect a complicated answer for what seems like a simple question about Elliptic curve cryptography. I've read several entries here such as "Elliptic curve cryptography related key attacks" and afterwards I am still left wondering what the primary attack vector would be and also what can be done by an implementer to shore-up a weakness.

Is hashing of keys the main weakness or is it in the PRNG? At the end of the day I want to do what I can to prevent "anyone" from reading what Alice or Bob have communicated.

To summarize, what is the weak point in the algorithm and what can be done to minimize the effectiveness of an attack?

Answer 1

If you use elliptic curve cryptography properly, with a suitable choice of parameters, there is no known weak point. (More precisely: The cryptography is unlikely to be the weakest link in your system.)

The trick is to use the cryptography properly. That's why people generally recommend that you use some existing well-vetted solution, like TLS 1.2 or similar, rather than implementing your own.

If you want to know what is the primary, most likely risk that will cause the security of your communications to be compromised, it is probably things like (1) insecure endpoints, (2) human error/mistakes, (3) compromise of one of the people/entities who are party to the communication, (4) traffic analysis, etc. In other words: system-level issues, not the elliptic curve crypto algorithms. One could write an entire book on what could be done about that, and people have; see the information security literature.