# ECC considered secure in OpenSSL?

If I perform the following command:

openssl ecparam -list_curves


using my OpenSSL version (1.0.1f), it spits out the following supported curves:

  secp112r1 : SECG/WTLS curve over a 112 bit prime field
secp112r2 : SECG curve over a 112 bit prime field
secp128r1 : SECG curve over a 128 bit prime field
secp128r2 : SECG curve over a 128 bit prime field
secp160k1 : SECG curve over a 160 bit prime field
secp160r1 : SECG curve over a 160 bit prime field
secp160r2 : SECG/WTLS curve over a 160 bit prime field
secp192k1 : SECG curve over a 192 bit prime field
secp224k1 : SECG curve over a 224 bit prime field
secp224r1 : NIST/SECG curve over a 224 bit prime field
secp256k1 : SECG curve over a 256 bit prime field
secp384r1 : NIST/SECG curve over a 384 bit prime field
secp521r1 : NIST/SECG curve over a 521 bit prime field
prime192v1: NIST/X9.62/SECG curve over a 192 bit prime field
prime192v2: X9.62 curve over a 192 bit prime field
prime192v3: X9.62 curve over a 192 bit prime field
prime239v1: X9.62 curve over a 239 bit prime field
prime239v2: X9.62 curve over a 239 bit prime field
prime239v3: X9.62 curve over a 239 bit prime field
prime256v1: X9.62/SECG curve over a 256 bit prime field
sect113r1 : SECG curve over a 113 bit binary field
sect113r2 : SECG curve over a 113 bit binary field
sect131r1 : SECG/WTLS curve over a 131 bit binary field
sect131r2 : SECG curve over a 131 bit binary field
sect163k1 : NIST/SECG/WTLS curve over a 163 bit binary field
sect163r1 : SECG curve over a 163 bit binary field
sect163r2 : NIST/SECG curve over a 163 bit binary field
sect193r1 : SECG curve over a 193 bit binary field
sect193r2 : SECG curve over a 193 bit binary field
sect233k1 : NIST/SECG/WTLS curve over a 233 bit binary field
sect233r1 : NIST/SECG/WTLS curve over a 233 bit binary field
sect239k1 : SECG curve over a 239 bit binary field
sect283k1 : NIST/SECG curve over a 283 bit binary field
sect283r1 : NIST/SECG curve over a 283 bit binary field
sect409k1 : NIST/SECG curve over a 409 bit binary field
sect409r1 : NIST/SECG curve over a 409 bit binary field
sect571k1 : NIST/SECG curve over a 571 bit binary field
sect571r1 : NIST/SECG curve over a 571 bit binary field
c2pnb163v1: X9.62 curve over a 163 bit binary field
c2pnb163v2: X9.62 curve over a 163 bit binary field
c2pnb163v3: X9.62 curve over a 163 bit binary field
c2pnb176v1: X9.62 curve over a 176 bit binary field
c2tnb191v1: X9.62 curve over a 191 bit binary field
c2tnb191v2: X9.62 curve over a 191 bit binary field
c2tnb191v3: X9.62 curve over a 191 bit binary field
c2pnb208w1: X9.62 curve over a 208 bit binary field
c2tnb239v1: X9.62 curve over a 239 bit binary field
c2tnb239v2: X9.62 curve over a 239 bit binary field
c2tnb239v3: X9.62 curve over a 239 bit binary field
c2pnb272w1: X9.62 curve over a 272 bit binary field
c2pnb304w1: X9.62 curve over a 304 bit binary field
c2tnb359v1: X9.62 curve over a 359 bit binary field
c2pnb368w1: X9.62 curve over a 368 bit binary field
c2tnb431r1: X9.62 curve over a 431 bit binary field
wap-wsg-idm-ecid-wtls1: WTLS curve over a 113 bit binary field
wap-wsg-idm-ecid-wtls3: NIST/SECG/WTLS curve over a 163 bit binary field
wap-wsg-idm-ecid-wtls4: SECG curve over a 113 bit binary field
wap-wsg-idm-ecid-wtls5: X9.62 curve over a 163 bit binary field
wap-wsg-idm-ecid-wtls6: SECG/WTLS curve over a 112 bit prime field
wap-wsg-idm-ecid-wtls7: SECG/WTLS curve over a 160 bit prime field
wap-wsg-idm-ecid-wtls8: WTLS curve over a 112 bit prime field
wap-wsg-idm-ecid-wtls9: WTLS curve over a 160 bit prime field
wap-wsg-idm-ecid-wtls10: NIST/SECG/WTLS curve over a 233 bit binary field
wap-wsg-idm-ecid-wtls11: NIST/SECG/WTLS curve over a 233 bit binary field
wap-wsg-idm-ecid-wtls12: WTLS curvs over a 224 bit prime field
Oakley-EC2N-3:
IPSec/IKE/Oakley curve #3 over a 155 bit binary field.
Not suitable for ECDSA.
Questionable extension field!
Oakley-EC2N-4:
IPSec/IKE/Oakley curve #4 over a 185 bit binary field.
Not suitable for ECDSA.
Questionable extension field!


None of these curves are listed on SafeCurves: choosing safe curves for elliptic-curve cryptography and marked as safe - while the only one that is listed (secp256k1) are marked as unsafe.

Assuming we trust Daniel J Bernstein (DJB): are the elliptic curves within this version of OpenSSL considered safe?

• The term "safe curve" seems to be used by Bernstein for curves that meet certain criteria, selected to make it easy to ensure that simple implementations are secure implementations. This doesn't imply that "non-simple" implementations using other curves are not secure. Hence, the information provided on the page is insufficient to infer anything about the security of OpenSSL, although it does raise some flags. – Henrick Hellström Feb 16 '15 at 19:20

[...] the only one that is listed (secp256k1) are marked as unsafe.

Some of the others are there too. NIST P-224 is the same curve as secp224r1, and similarly for P-256 and P-384. Those are marked unsafe as well.

Assuming we trust djb, are the elliptic curves that are currently supported by this reasonably new version of OpenSSL (and therefore typically get used for TLS connections etc) considered safe?

Probably not, according to the definition used by SafeCurves, though I haven't looked at them all.

The smaller curves (anything below about 200 bits) would fail the rho criterion and those are pretty clearly unsafe. One of the smallest, secp112r1, was broken in 2009 and many the others are probably within reach.

The ANSI, SEC and NIST prime field curves probably fail either the rigidity criterion or the discriminant criterion. The former means there isn't sufficient reasoning for why the parameters are what they are. The latter means those curves are known to be slightly weaker than their size implies (and could theoretically be even weaker).

Neither means they are necessarily unsafe to use. If you don't think anyone has backdoored them, the rigidity criteria doesn't matter. If you are fine with the very small loss of security from the D-criterion and don't think further breaks are likely, that one doesn't matter.

Many of them probably also fail some of the "ECC security" criteria. Those are not necessarily "fatal", they just mean that the implementation has to get certain things correctly. You would have to go through the OpenSSL code to make sure it does if you were concerned.