I need to be able to deterministically generate (and re-generate) private-public ECC key pairs curve448 for ECDH from human-friendly passphrases (not necessarily human-memorable, just easy to type in), and I'm using the OpenSSL libraries. OpenSSL doesn't include curve448 as a standard named curve, nor does it have facilities for deterministically generating ECC keys built in, but https://wiki.openssl.org/index.php/Elliptic_Curve_Cryptography provides examples of manually computing a public key from a private key given a curve, and of constructing a custom curve. So, I have gotten as far as using PBKDF2 (which is available in OpenSSL) to convert an input passphrase into a 56-byte private key--but then I need to provide all of the group parameters for EC_GROUP_new_curve_GFp, EC_POINT_set_affine_coordinates_GFp and EC_GROUP_set_generator in binary / hexadecimal form:

  • a, b, and p from the equation y^2 mod p = x^3 +ax + b mod p
  • The order of the group.
  • The x and y coordinates of the generator for the group.

Where can I find these? Or, alternatively, how can I calculate them and verify that I have done so correctly?

  • $\begingroup$ Curve448 is traditionally computed in Edwards form. Now, that curve is isomorphic to some curve in Weierstrass form (that is, to some a, b, p), even then, there would be a nontrivial mapping from the resulting point in Weierstrass form back to Edwards form (which is what everyone expects) $\endgroup$
    – poncho
    Apr 1 at 19:03
  • $\begingroup$ @poncho Edited to fix it. What everybody else expects is not a big deal, as this will only be used between a closed set of devices, not to interact with the internet at large. But if there's another curve I could use with OpenSSL that provides a similar degree of strength to curve 448, that would also solve my problem. $\endgroup$ Apr 1 at 19:59
  • 2
    $\begingroup$ If you're looking for X448, OpenSSL does support that, just not with the standard EC code. There's documentation for doing what you want with the PKEY code. $\endgroup$
    – bk2204
    Apr 1 at 21:12
  • $\begingroup$ @bk2204 That makes sense, but I think this is more about constructing the PKEY in the first place (which is probably why you made this a comment, so this just to clarify). Note that coding questions should be asked on Stack Overflow so answers should be about the calculations themselves, possibly augmented with the required code. $\endgroup$
    – Maarten Bodewes
    Apr 2 at 0:27
  • 2
    $\begingroup$ @poncho+ most everybody uses Edwards for signature (EdDSA rather than ECDSA) and Montgomery for Bernstein's X-only form of ECDH (X448 as bk2204 says). But if you really want the non-interoperable Weierstrass form, it is published in NIST SP800-186 $\endgroup$ Apr 2 at 0:42


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.