1. Is it possible to derive a shared secret between different curves?
    An explanation would be nice.

  2. How can I decide which curve I should use in my software?
    Highest amount of bits has in my case the brainpoolP320r1 curve, but on this site https://safecurves.cr.yp.to/ the brainpool curves are rated as not safe. The German Federal Office for Information Security recommend amongst others the brainpoolP320r1.

These curves can I use with my HSM (hardware security module):

  • secp192r1 (aka prime192v1)
  • secp256r1 (aka prime256v1)
  • brainpoolP192r1
  • brainpoolP224r1
  • brainpoolP256r1
  • brainpoolP320r1
  • secp192k1
  • secp256k1 (the Bitcoin curve)

Additional Question:
If I want to perform signing and generating a shared secret, should I always use different instances of a curve? Because if not, I would perform different actions one the sone instance. Which is bad?

  • 1
    $\begingroup$ 1. In general: Probably not. 2. Just scroll down on that website and read why they consider some curves not safe. All the information is there already. Also note, that there are two brainpool curves listed. With different criteria in the detailed section. Those results are true for exactly those curves. It is a stretch to generalize it to other brainpool curves without going into the details. $\endgroup$
    – tylo
    Commented Dec 7, 2016 at 11:56

1 Answer 1


You can probably come up with some key exchange using different curves, for example if they are isomorphic (a curve and its twist). If you have two curves that are independently chosen, it will become much harder (if not impossible).

With regard to SafeCurves, I would be quite careful making too strong conclusions based on the website. By their logic any curve with a prime number of points is insecure. The reasons are that

  1. Prime order curves do not have a ladder. This is not true. They do have a ladder, the formulas are just not as efficient. Even so, you would usually not want to use a ladder since it prohibits precomputation.
  2. Prime order curves do not have a complete addition law. This is not true. They do have one, it is just not as efficient.
  3. Prime order curves have points that are distinguishable from random. This is not true. There exist an encoding (Elligator Squared).

It is nonsense to conclude that these points make prime order curves insecure. They are perhaps not as efficient as other curves, but in no way more insecure.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.