8
$\begingroup$

When an elliptic curve-based cryptosystem is deployed, a single set of public parameters (consisting of a particular elliptic curve over a finite field as well as a generator of a prime order subgroup of its group of points) is typically shared across all users.

Some of these public parameters are standardized in some form. The best known ones are NIST-approved curve parameters, described as part of the FIPS 186-{2,3} standard, but there are others. For example, a French agency recently released a set of parameters recommended for local security applications (possibly over concerns re the security of curves over the very special base fields used by NIST?—they didn't say).

Is a list of such curve parameters compiled somewhere? Do you know any aside from the previous ones?

Improve this question
$\endgroup$
2
  • $\begingroup$ The French authorities gave the following rationale for their FRP256v1 curve: "The proposed parameters correspond to a randomly generated curve, selected as to obey usual security criteria" (my emphasis); I infer that (at least one of) the motivation was to avoid a special field as in P-256 of FIPS 186-3. The "usual security criteria" are likely those in RGS annex B1, section 2.2.1.4. $\endgroup$
    – fgrieu ♦
    Feb 21, 2012 at 11:50
  • $\begingroup$ One can infer that indeed, but on the other hand, the Digital Signature Standard says that NIST-approved curves are randomly generated (and even “provably” so!) in the sense that the curve coefficients are chosen using a hash function (even though the base fields are quite special). So it seems difficult to tell what exactly randomly generated means in this context. $\endgroup$
    – Mehdi Tibouchi
    Feb 22, 2012 at 2:22

1 Answer 1

Reset to default
6
$\begingroup$

There are a few more standards, with (sometimes) overlapping sets of parameters:

Improve this answer
$\endgroup$
2
  • $\begingroup$ Actually there is considerable overlap: all 15 FIPS 186-2/3 curves are part of the 20 curves that X9.62 lists in its annex L; and all these 20 curves are part of the curves listed in SEC 2. The Brainpool curves are (deliberately) separate. $\endgroup$
    – Thomas Pornin
    Feb 26, 2012 at 1:57
  • $\begingroup$ Also, the AACS standard (protection on HD-DVD and Blu-ray discs) uses ECDSA in their own curve (see this document), page 10). When Sony designed the protection system for the PS3, they defined no less than 64 new curves (and they totally botched their ECDSA implementation, but that's another story). $\endgroup$
    – Thomas Pornin
    Feb 26, 2012 at 2:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.