The SafeCurves project provides a Sage script to verify the SafeCurves criteria for given curves, https://safecurves.cr.yp.to/verify.html

According to the description, the script works simply as:

$ sage verify.sage curves/nistp256/, where curves/nistp256/ is a folder containing the following files:

p: the field prime, in decimal.
l: the prime order of the base point, in decimal.
x1: the x-coordinate of the base point.
y1: the y-coordinate of the base point.
x0: the x-coordinate of a point generating the entire curve.
y0: the y-coordinate of a point generating the entire curve.
shape: the curve shape, either shortw or montgomery or edwards.
a and b, if the curve shape is shortw: the coefficients in the short Weierstrass equation.
A and B, if the curve shape is montgomery: the coefficients in the Montgomery equation.
d, if the curve shape is edwards: the coefficient in the Edwards equation.
primes: all prime divisors of of p, the curve order p+1-t, the twist order p+1+t, and t^2-4p; and, recursively, all prime divisors of q-1 for each q in the list. 

Unfortunately all these files are not provided and this is really a pity after so much work.


  1. Does anybody know where to find all such missing files? can anyone provide an example for one curve?
  2. Why a base point (x1,y1) and a point generating the entire curve (x0,y0) must be specified?
  3. How do I find a point (x0,y0) generating the entire curve for a given curve?
  4. What is q?
  5. What does it mean "for each q in the list", which list?

Thank you for any hints.


1 Answer 1


I started looking at SafeCurves a while back, and now I'm trying to use it - which brought me here. After getting an email from Dr. Lange, I copied the script to safecurves.sage, and then ran "sage safecurves.sage". This gave an output file safecurves.sage.py. I then created a directory with separate files for p, l, ... primes, and rigid. I had no list of primes other than p and 1 followed by p+1-t and p+1+t. No q values at all. It ran just fine. I then ran "sage safecurves.sage.py dir" and it gave me all the outputs (many with "unverified" as the result).

So if you know enough number theory to fill in the file, that's great. But it is not required.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.