# How Elliptic Curve equation is chosen?

We all know the basic equation of Elliptic Curve is $y^2 \equiv x^3 + ax + b \pmod p$

• How the value of the constants $a$ and $b$ are chosen?
• Suppose $\mathbb P\ni p \approx 2^{256}$ then what approach should I take while selecting the value of constants $a$ and $b$?

I have some basic knowledge of Elliptic Curve, EC Cryptography, EC discrete logarithm problem and EC diffie-hellman.
I need some experts help.

• TL;DR: Choosing EC constants isn't trivial (compared to DH and RSA) and should be delegated to specialized software. Related question with further references: "How to generate own secure elliptic curves?" – SEJPM Oct 15 '16 at 20:48
• I've edited your question to make the formulae fancier. I've also lower-cased $p$ like its usual and I have changed P such that its size is 256-bit instead of its value (which would be 100% insecure these days). If I changed the intention of your question an you actually wanted to ask about such small parameters, please comment or edit yourself. – SEJPM Oct 15 '16 at 20:49
• @fkraiem: actually, just choosing $a$ and $b$ at random will, with high probability, give you a considerably weaker curve than if use constants that were well selected. A random $a, b$ would give you a random curve order, which (with high probability) will have a factorization which would make the discrete log problem considerably easier than if you picked a curve with a prime order. For example, with probability circa 1/3, the largest prime factor will be $< 2^{128}$, which would make the DLog problem solvable in $2^{64}$ time. – poncho Oct 16 '16 at 3:12
• according to my query the value of P will be 2^8. And thanks for modifying the equation.I will consider the security issue later on.At first i need to know how to generate the equation. – Arnab Rahman Oct 16 '16 at 8:33