How can I tell which curve a given ECDSA implementation uses? (P-521 or something else)

I'd like to test and see if certain software uses P-521 ECC curves, or if it uses another variant.

Without having access to the sourcecode, or the specification, is there any way for me to test which ECC curve a given implementation of software uses?

Take a x509 certificate as an example, aside from ASN.1 information that may exist in the file, is there any way to look at raw cryptographic outputs and determine the curve used?

What is the minimum information needed to understand what curve is being used? (What variables on the client, or on the issuer/CA are needed)?

migrated from security.stackexchange.comJul 22 '13 at 15:54

This question came from our site for information security professionals.

• A public key is a curve point $(X,Y)$ which fulfils the curve equation $Y^2 = X^3 + aX + b$ where $a$ and $b$ are part of the curve definition. This allows you to match the public key point with some standard curves.
• If point compression is used, you might have only the $X$ coordinate. You can still match that with standard curves, because $X$ is part of the base field on which the curve is defined. If you find a $X$ which is a 521-bit integer or not much smaller (e.g. no smaller than 500 bits) then chances are high that the curve is P-521. Although it could be a custom non-standard curve of the same size.
• If you only see the signature themselves, then you can still try to match that to standard curves. An ECDSA signature is a pair of integers $(r,s)$, where both $r$ and $s$ are in the $1..q-1$ range, $q$ being the size of the curve. There again, if both $r$ and $s$ are in the 500 to 521 bits, then chances are that the curve is P-521, because $r$ and $s$ would be too large for the smaller curves (the previous ones are 401-bit only), and it would be very improbable to obtain both values below 521 bits if the curve is B-571 or K-571 (the next ones, among the standard curves).