RSA and ElGamal can be implemented using the technique of Elliptic curves. I am confused on why the it seems that Elliptic curves are not so popular in cryptographic applications since they provide the same security with smaller key sizes?
$\begingroup$
$\endgroup$
1
-
$\begingroup$ "RSA [...] can be implemented using the technique of Elliptic curves" Generally you don't implement an RSA equivalent on elliptic curves. I think it doesn't offer a real advantage of normal RSA. Typically we use Diffie-Hellman or DSA (and some very similar algorithms) on elliptic curves. $\endgroup$– CodesInChaosAug 5, 2013 at 7:26
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
3
It is true that elliptic curves allow the same security with smaller key sizes. However, the size is not the only important aspect. Familiarity of algorithm, ease of implementation, performance, how many independent implementations exist, etc. affect how widely algorithm is implemented.
For Elliptic Curves, like many other technologies one factor slowing down the adoption has been patents. EC2m was previously considered "patent mine field" and there are also some patents on ECP techniques.
Elliptic Curves are still fairly new, and for security levels usually deployed, it is very common that in practice performance of RSA, DSA or DH exceeds ECC of similar security strength.
For larger security levels (around 192-bit or 256-bit security strength, i.e. 384-bit - 521-bit ECC curves), the required DSA/DH primes or RSA modulus grow so large that ECC usually wins in performance.
So, in my experience the reasons for smaller adoption are: difference in complexity, smaller speed on usual key lengths, patent risks, and the fact that there are less implementations than of, say RSA.
I have seen Elliptic Curves getting some attention and deployments and it seems to be growing. The drivers for that (which help with ECC adoption) seem to NIST's transition to higher key lengths (see SP 800-131A) and NSA Suite B. There are very few applications where the difference in key length is significant differentiator.
-
1$\begingroup$ Actually, in my experience, even at the 128-bit security strength, ECC still wins easily in performance over DSA/DH/RSA (unless you're specifically timing 'signature verification time') $\endgroup$– ponchoAug 3, 2013 at 16:18
-
$\begingroup$ Another point is: it is hard to implement ECC crypto without timing (or power) side channel, for example rijndael.ece.vt.edu/schaum/papers/2010hostf.pdf $\endgroup$– osgxAug 4, 2013 at 10:53
-
1$\begingroup$ I would like to add that EC cryptography can be very tough to understand. It is not impossible to explain RSA signing and encryption to somebody without strong understanding of mathematics and group theory. This is not the case for EC cryptography in my opinion. It is therefore much easier to mess up an implementation, or to use an API incorrectly. Furthermore, not all libraries have support for all ECC features. Some only support named curves, some only $F(p)$ etc. etc. $\endgroup$– Maarten Bodewes ♦Jun 12, 2014 at 13:20