4
$\begingroup$

Say for instance, this webservice offers the following curves.

sect283k1 sect283r1 sect409k1 sect409r1 sect571k1 sect571r1 secp256k1 prime256v1 secp384r1 secp521r1 brainpoolP256r1 brainpoolP384r1 brainpoolP512r1

Clients are being connected using B-571, P-521 and P-256 curves. Base on my experience, P-256 refers to prime256v1, however, how do i know which curve does B-571 represents? it could be sect571k1 or sect571r1.

Thanks,

| improve this question | |
$\endgroup$
  • 1
    $\begingroup$ P-521 means secp521r1. $\endgroup$ – SEJPM♦ Nov 6 '17 at 11:38
  • 1
    $\begingroup$ Indeed, and 521 is not a misspelling; it's indeed a 521 bit curve. This is inconvenient as it isn't a multiple of 8. Brainpool curves are generated in such a way that they are always a multiple of 8 in bit size. B-571 is a binary curve - BC has tables with the different names / OID's in the source, I'll check if I can create or find a table somewhere. sect are the twisted representation of curves; you normally don't use those directly, and seck are Koblitz curves. $\endgroup$ – Maarten Bodewes♦ Nov 6 '17 at 12:02
  • $\begingroup$ thanks Maarten, that clears up abit. As you notice, I had removed the last section asking about P512. I probably typed it wrongly or saw it wrongly. urm, yeah if you can find me a table that would display how they are represented, that be wonderful. Thanks. $\endgroup$ – Kin Loo Nov 6 '17 at 12:19
  • $\begingroup$ Whoops, sorry, in above comment the part for "twisted" is wrong. $\endgroup$ – Maarten Bodewes♦ Nov 6 '17 at 14:56
6
$\begingroup$

The names P-xxx, B-xxx and K-xxx refers to NIST notation.

You can find the names and the curves' parameters in Appendix D of FIPS 186-4. NIST notation uses P-xxx for curves defined over large characteristics (i.e. prime fields), B-xxx for random binary curves ($a=1,b$ random), while K-xxx is for binary curves of Koblitz form ($a=[0,1],b=1$)

The other names you mentioned, starting with "sec" refers to the SECG SEC1 standard. Here all curves start with "sec" followed by "p" for prime fields or "t" for binary, followed by the size of the field and by "r" or "k" where "r" stands for randomly generated and "k" stands for Koblitz type.

There are correspondence between the two notations. By looking at the documents and the actual curves' parameters, you can find, for example, that:

  • P-256 = secp256r1
  • P-384 = secp384r1
  • P-521 = secp521r1
  • B-283 = sect283r1
  • K-283 = sect283k1
  • B-409 = sect409r1
  • K-409 = sect409k1
  • B-571 = sect571r1
  • K-571 = sect571k1

Note: SEC extends the concept of Koblitz curves also for prime field curves, such as the bitcoin secp256k1. In this context, a Koblitz curve has an additional efficiently computable endomorphism.

The name prime256v1 (the same curves as P-256 and secp256r1) comes from ANSI X9.62.

And as far as I know the brainpool standard is the only one naming the brainpool curves, so their name is unique.

| improve this answer | |
$\endgroup$
  • $\begingroup$ Hi Ruggero, thanks for your detailed explanation, I will be taking alot of time to digest this information and to determine the strengths of these curves. $\endgroup$ – Kin Loo Nov 6 '17 at 13:55
  • $\begingroup$ Hi Ruggero, can you also explain to me how does X25519 differs from SEC ? thanks $\endgroup$ – Kin Loo Nov 6 '17 at 14:19
  • $\begingroup$ @KinLoo for the strength you can roughly use the field size (i.e the number), noting that in general binary curves are not encouraged/used. The difference between X25519 and the SEC curves is totally unrelated to the current question. However Curve25519 is a curve of prime field type. $\endgroup$ – Ruggero Nov 6 '17 at 17:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.