Derive a shared secret between different curves

Question

1. Is it possible to derive a shared secret between different curves?
   An explanation would be nice.

2. How can I decide which curve I should use in my software?
   Highest amount of bits has in my case the brainpoolP320r1 curve, but on this site https://safecurves.cr.yp.to/ the brainpool curves are rated as not safe. The German Federal Office for Information Security recommend amongst others the brainpoolP320r1.

These curves can I use with my HSM (hardware security module):

• secp192r1 (aka prime192v1)
• secp256r1 (aka prime256v1)
• brainpoolP192r1
• brainpoolP224r1
• brainpoolP256r1
• brainpoolP320r1
• secp192k1
• secp256k1 (the Bitcoin curve)

Additional Question:
If I want to perform signing and generating a shared secret, should I always use different instances of a curve? Because if not, I would perform different actions one the sone instance. Which is bad?

Answer 1

You can probably come up with some key exchange using different curves, for example if they are isomorphic (a curve and its twist). If you have two curves that are independently chosen, it will become much harder (if not impossible).

With regard to SafeCurves, I would be quite careful making too strong conclusions based on the website. By their logic any curve with a prime number of points is insecure. The reasons are that

1. Prime order curves do not have a ladder. This is not true. They do have a ladder, the formulas are just not as efficient. Even so, you would usually not want to use a ladder since it prohibits precomputation.
2. Prime order curves do not have a complete addition law. This is not true. They do have one, it is just not as efficient.
3. Prime order curves have points that are distinguishable from random. This is not true. There exist an encoding (Elligator Squared).

It is nonsense to conclude that these points make prime order curves insecure. They are perhaps not as efficient as other curves, but in no way more insecure.