# EC non-shared cryptosystems - different group for every party

Efficient Identity Based Parameter Selection for Elliptic Curve Cryptosystems by Arjen K. Lenstra contains a proposal for a non-shared elliptic curve cryptosystem. Every party chooses its own field and then after some computations and checks (Table 1 in paper) chooses Weierstrass model. The main reason of this work is minimize of trust to the third parties (don't use pre-selected elliptic curves).

Cite:

The same Weierstraß model used over two different finite fields gives rise to two different and, from a security point of view, independent groups. With the current algorithms, ability to solve discrete logarithms in one of those groups does not make it easier to compute discrete logarithms in the other group.

Question: How is possible that parties do not have to have the same group? I thought that having the same group is essential. How can I perform any operations correctly, if the chosen groups are not identical?

• Conceivably one could have every TLS server generate its own curve, just like it used to be common practice for every TLS server to generate bespoke finite field DH groups with openssl dhparam; the server would send the client a description of the group, and then the two would do a DH tango together. But dynamic group selection is a a security disaster; you should just use X25519. – Squeamish Ossifrage Feb 18 at 22:01
• Thanks! But they said that security is the better than shared cryptosystem have. Why do you think it is disaster? – Daniel Herbrych Feb 18 at 22:20
• Confidently validating a DH group (FF or EC) is hard and opens up enormous attack surfaces. See, e.g., eprint.iacr.org/2016/961, weakdh.org, bada55.cr.yp.to. – Squeamish Ossifrage Feb 18 at 22:32
• Altough, I need to understand how it works if groups are different. I take your advice into consideration, thanks again! – Daniel Herbrych Feb 18 at 22:53