I was reading this paper about elliptic curves and I saw this graphic: enter image description here

This paper is pretty new (november 2018) and I was wondering, whether these are all known ecc-families or not. The key point is, that I don't see Weierstraß curves. Can someone explain to me, why Weierstraß-Curves are not included? Are there other curve-families that are not included. If true, which?

  • 3
    $\begingroup$ Every curve (at least over prime fields) has an equivalent weierstrass formulation. This there's nothing "distinct" here. $\endgroup$
    – SEJPM
    May 15, 2020 at 11:21
  • $\begingroup$ Or, one can call the father of curves. $\endgroup$
    – kelalaka
    May 15, 2020 at 11:37
  • $\begingroup$ @SEJPM: There are Weierstrass formulations for curves over extension fields as well. The formulation differs for characteristic 2 and 3 curves, but they do exist. $\endgroup$
    – poncho
    May 15, 2020 at 12:21
  • $\begingroup$ @SEJPM: That makes sense! All of them are "subgroups" (or families) with certain properties and Weierstraß the "father of them all" ;) But are some curve families missing, or is this graphic complete? $\endgroup$
    – Titanlord
    May 16, 2020 at 8:39

1 Answer 1


For elliptic-curve-based protocols, it is assumed that finding the discrete logarithm of a random elliptic curve element with respect to a publicly known base point is infeasible: this is the "elliptic curve discrete logarithm problem" (ECDLP). The security of elliptic curve cryptography depends on the ability to compute a point multiplication and the inability to compute the multiplicand given the original and product points. The size of the elliptic curve determines the difficulty of the problem.

We can formally define an elliptic curve (over a field k) is a smooth projective curve of genus 1 (defined over k) with a distinguished (k-rational) point. However, not every smooth projective curve of genus 1 corresponds to an elliptic curve, it needs to have at least one rational point. The definition of the elliptic curve also requires that the curve be non-singular. Geometrically, this means that the graph has no cusps, self-intersections, or isolated points.

There is an infinite number of elliptic curves, but a small number that is used in elliptic curve cryptography (ECC), and these special curves have names. Apparently there are no hard and fast rules for how the names are chosen, but there are patterns. IETF has published a report on the list of alternate elliptic curve representations recently. You can refer to the IETF report here. Following are some of the reference elliptic curve families. A few of them are missing in the diagram.

  1. Curves in short Weierstrass form
  2. Montgomery Curves
  3. Twisted Edwards Curves
  4. Supersingular Edwards Curve
  5. Hessian Curve
  6. Twisted Hessian Curve
  7. Jacobi Quartic Curve
  8. Doubling-oriented Doche–Icart–Kohel Curve

Elliptic Curves were originally written in Weierstrass form. Edwards elliptic curves have their own advantages: addition, doubling and tripling can be done faster on Edwards curves than on curves given by a Weierstrass equation. This is because the addition law on Edwards curves does not have exceptions, while the addition on Weierstrass curves distinguishes several special cases. The Montgomery curve is suggested for application in elliptic curve cryptography because arithmetic in this curve representation is faster and needs less memory than arithmetic in standard Weierstrass form.

Please find an insightful article on the names of some the prominent elliptic curves used in cryptography.

  • $\begingroup$ For every curve Familie there are infinit curves. And one may define infinite families. But for ECC there are only a few used families, all with their own advantages. My primarily questions is: Are the families in the graphic all known and used families in ECC or are there more (maybe newer) families, that are not included? My other question was: Why is Weierstraß not one of the mentioned families (Answer is in the comments above). $\endgroup$
    – Titanlord
    May 16, 2020 at 13:23
  • $\begingroup$ @Titanlord It is not recommended to use all the families of elliptic curves as per NIST. Weierstrass curves should be included in the family of elliptic curves. I have seen a more conclusive graphic on the elliptic curves recently. Please find the list of safe elliptic curves here. safecurves.cr.yp.to $\endgroup$
    – Gokul Alex
    May 16, 2020 at 13:28
  • $\begingroup$ But there is a difference between "ECC-Standards" and "ECC-Curves". The safecurves project just listed the standards and described their security. My question is more theoretically. Do you know another curve familie, that is studied for the use in ECC or is used in ECC but is not displayed in the graphic? $\endgroup$
    – Titanlord
    May 16, 2020 at 13:38
  • 1
    $\begingroup$ Yes @Titanlord. It missing a few important curves such as Twisted Hessian Curve, Jacobi Quartic Curve, doubling-oriented Doche–Icart–Kohel curve etc. $\endgroup$
    – Gokul Alex
    May 16, 2020 at 13:46
  • 2
    $\begingroup$ You are welcome @Titanlord. I found this thesis paper nicely explaining the category of Edwards Curves. fse.studenttheses.ub.rug.nl/10478/1/Marion_Dam_2012_WB_1.pdf $\endgroup$
    – Gokul Alex
    May 16, 2020 at 14:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.