Linked Questions
17 questions linked to/from Should we trust the NIST-recommended ECC parameters?
23
votes
2
answers
8k
views
Is there a feasible method by which NIST ECC curves over prime fields could be intentionally rigged?
The NIST elliptic curves P-192, P-224, P-256, P-384, and P-521, prescribed in FIPS 186-4 appendix D.1.2, are generated according to a well defined process, but using an arbitrary random-looking seed ...
- 144k
16
votes
2
answers
5k
views
How do I get the equivalent strength of an ECC key?
I know how to calculate the comparable symmetric strength of an RSA modulus: calculate the running time for a field sieve. This is how NIST gives approximate symmetric sizes for asymmetric algos in ...
- 501
9
votes
1
answer
5k
views
Curve25519 vs "Million Dollar Curve"
Quoting from the Million Dollar Curve website:
By using publicly verifiable randomness produced in February 2016 by many national lotteries from all around the world, we propose to generate a ...
- 2,874
8
votes
2
answers
853
views
Rely on NSA Suite B Cryptography?
NSA's Suite B Cryptography suggests some cryptographic algorithms for encryption, digital signatures, message digests and key agreements. The selected algorithms and their key size are suggested by ...
8
votes
2
answers
5k
views
Do Weak Elliptic Curves Exist?
I'm running into very contradictory opinions when try to understand if weak elliptic curves exist. I'm not interested in the case when a curve's weakness is attributed to properties of an EC's prime, ...
- 366
6
votes
1
answer
4k
views
What EC curve is used by Apple iOS platform?
I can't find information about EC curve used by Apple's iOS platform. The algorithm name that I could see in their docs is:
...
- 366
4
votes
1
answer
2k
views
Why is the strength of an Elliptic Curve Cryptography (ECC) half the size of the prime field size?
I've looked around and couldn't find a direct answer. As a general rule, I've read from various sources (here here, and here) that the strength of an elliptical curve key is half of the size of the ...
- 173
4
votes
1
answer
296
views
Elliptic curves with field sizes that not byte-aligned
Why there are abnormal field size like 521, 571, 233, 283 bits in prime and binary fields that are defined by NIST?
- 492
3
votes
1
answer
716
views
Proving Non-Existence of ECC Backdoors
In light of the NIST Dual EC DRBG scandal, I was intrigued by a NIST slide (slide 9) that said the two points P and Q can be chosen so that the chooser can prove they don't have a backdoor. This ...
- 131
3
votes
2
answers
2k
views
How to interpret the article claiming NIST P-256 curve to be unsafe?
Here: http://safecurves.cr.yp.to/ , I read that the NIST P-256 elliptic-curve is not safe.
The article lists several aspects (off-curve point, side-channel, etc.) where implementing P256 can fail the ...
- 31
3
votes
1
answer
270
views
Why do we use $a=1$ in elliptic curves?
$y^2 + xy = x^3 + ax^2 + b$ is the elliptic curve over $\mathbb F_{2^m}$.
In the elliptic curve standard, most of the curves use $a=1$ a lot.
Is there any mapping for this such that $y^2 + xy = x^3 +...
- 31
2
votes
1
answer
4k
views
Limitations of Elliptic Curve Cryptography?
Simple question, what are the limitations of ECC, both in terms of application and how secure it is?
I heard that the NSA were able to read emails a few years back due to a backdoor they had ...
- 481
2
votes
0
answers
397
views
Kleptographic attack of ECDSA key generation?
Kleptographic attacks can be designed for RSA key generation, Diffie–Hellman key exchange, DSA/ECDSA signing, etc. Is it also possible for ECDSA key generation?
More detailed: Is it possible for an ...
- 121
1
vote
2
answers
403
views
Severity of Cooking NIST P Curve Constants
Bruce Schneier and Gregory Maxwell have both stated that they believe the constants chosen for NIST's P curves (i.e. P-256r) are cooked. DJB has put together a detailed list of red flags but, outside ...
- 361
1
vote
1
answer
449
views
P256 seed problem
I'm reading up on elliptic curves and their history and it seems that people don't trust P256 seed which is defined in FIPS 186-3 on page 89 to be
SEED = c49d3608 86e70493 6a6678e1 139d26b7 819f7e90
...
- 11