What's the meaning of "160-bit curve" in an elliptic curve? Or 192, 224, 256, etc. And what is the standard for selecting this number of bits?
Why they don't say "100-bit curve"?
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this communityWhat's the meaning of "160-bit curve" in an elliptic curve? Or 192, 224, 256, etc. And what is the standard for selecting this number of bits?
Why they don't say "100-bit curve"?
What's the meaning of 160 bit Curve in Elliptic curve?
It's the size of the field, as the other answers explain. It affects the size of keys and signatures (which can be equal to the number or e.g. double it), as well as security and performance.
Why they don't say 100 bit curve?
100-bit curves are too small.
It's also a convention. Other cryptographic primitives, like hash functions or symmetric ciphers, can have any bit length we want and powers of two are chosen for performance. So we want elliptic curves that match (or are close) to pair with them in a protocol, so we don't waste performance on security beyond the weakest link.
There's also the performance of the elliptic curve algorithm itself. It is useful to have the bit length be a multiple of a large enough power of two, like 64 bits, because computers deal with numbers of 32-bits or 64-bits. This isn't always the case though (e.g. P-521) if there happens to be a very juicy prime ($2^{521}-1$) that is easy to work with.
(As an aside, we do sometimes approximate something as e.g. 100-bit security if we don't care about the exact number but only a minimum. For example, a 256-bit elliptic curve that has a prime smaller than $2^{256}$ – e.g. P-256 – has only approximately 128-bit security so might as well call it 100-bit. Especially after you add a signature algorithm that also relies on a hash function, perhaps losing another bit of security to collisions.)
It refers to the bit length of the order of the elliptic curve group (number of points on the curve).
The security of a curve is equal to the square root of its order. So we pick values that are twice as long as the security level we want (160-bit for 80-bit security, 256-bit for 128-bit security, etc)
We don't use 100-bit curves because we prefer security levels that are greater than or equal to (preferably close to) symmetric key lengths.
An elliptic curve to be used in cryptography is defined over a finite field $\mathbb{F}_p$ (but also can be a binary polynomial finite field $\mathbb{F}_{2^m}$). The bit length of this $p$, or the $m$ in the case of the binary polinomials, is what is used later to describe the elliptic curve in terms of size.
The best known discrete logarithm algorithm on elliptic curves is the parallelized Pollard rho algorithm , which has running time $O(√r)$ where $r$ is the size of largest prime-order subgroup of $E(F_q)$. On the other hand, the best algorithm for discrete logarithm computation in finite fields is the index calculus attack which has running time subexponential in the field size. Thus to achieve the same level of security in both groups, the size $q^k$ of the extension field must be significantly larger than $r$.