How are curve names constructed?

Question

I started with the question: Brainpool curves exist in a variant ending in ..r1 and ..t1. What does it mean?

But there are also "secp.." and "sect.." just like NIST's "..r1" and "k1".

What do all of those mean?

Answer 1

The prefix sec stands for "Standards for Efficient Cryptography" (per the eponymous group, in the sense of assembly of experts). Brainpool stands for the name of another assembly of experts.

After this, p (or P after Brainpool) stands for Prime, and is used for curves with an equation over field $\mathbb F_p$ of prime order. After sec, t is used when the field is $\mathbb F_{2^k}$ for $k>1$, but I don't know why t was chosen or if the curves have further properties.

The typically 3 digits that follow are, in decimal, the bit size of the field order (not necessarily the bit size of the curve order, which is different for sect curves).

After this, k stands for Koblitz, and is used for Koblitz curves and, as a generalization, for curves with field $\mathbb F_p$ that have an efficient endomorphism (per this paper). r stands for Random, and is used for somewhat random curves without this property. For Brainpool curves, t stands for twisted, and I leave it to others to explain what that means.

The last digit(s) form an index in decimal, starting from 1 for the first curve standardized with the same designation before that index.

---

There is also the "NIST curves" of FIPS 186-4 appendix D. These start with P (for Prime, meaning as p and r above combined), K (for Koblitz curve on a field binary $\mathbb F_{2^k}$ for $k>1$, combined with r above), or B (for Binary field $\mathbb F_{2^k}$, combined with r above). That's followed by a minus sign or dash, and 3 digits as above. The curves P-UVW match their secpUVWr1 counterparts (P-256 is secp256r1). I did not check in detail but I think that extends to K-UVW for sectUVWk1, perhaps B-UVW for sectUVWr1.

---

Much of the information in this answer is sourced from sec2v2 of SECG, sections 2.1 and 3.1; and from FIPS 186-4.

Note: Some other curves are named according to inspiration of the author. For example Curve25519 got it's name because the prime field has order $2^{255}-19$. By this convention Curve1174 would be Curve2519 but I guess the single-digit difference with the pre-existing Curve25519 would have caused endless confusion, so it got it's name from the constant 1174 in it's equation. Ed448-Goldilocks tells it's an Edwards curves and uses a field of order a 448-bit prime with some rare-as-gold property.