SEC 2: Recommended Elliptic Curve Domain Parameters
|
|
|
- Sharon Mills
- 8 years ago
- Views:
Transcription
1 STANDARDS FOR EFFICIENT CRYPTOGRAPHY SEC 2: Recommended Elliptic Curve Domain Parameters Certicom Research Contact: September 20, 2000 Version 1.0 c 2000 Certicom Corp. License to copy this document is granted provided it is identified as Standards for Efficient Cryptography (SEC), in all material mentioning or referencing it.
2
3 SEC 2 - Contents Page i Contents 1 Introduction Overview Compliance DocumentEvolution IntellectualProperty Organization Recommended Elliptic Curve Domain Parameters over p Properties of Elliptic Curve Domain Parameters over p Recommended 112-bit Elliptic Curve Domain Parameters over p Recommended Parameters secp112r Recommended Parameters secp112r Recommended 128-bit Elliptic Curve Domain Parameters over p Recommended Parameters secp128r Recommended Parameters secp128r Recommended 160-bit Elliptic Curve Domain Parameters over p Recommended Parameters secp160k Recommended Parameters secp160r Recommended Parameters secp160r Recommended 192-bit Elliptic Curve Domain Parameters over p Recommended Parameters secp192k Recommended Parameters secp192r Recommended 224-bit Elliptic Curve Domain Parameters over p Recommended Parameters secp224k Recommended Parameters secp224r Recommended 256-bit Elliptic Curve Domain Parameters over p Recommended Parameters secp256k Recommended Parameters secp256r Recommended 384-bit Elliptic Curve Domain Parameters over p Recommended Parameters secp384r
4 Page ii SEC 2: Recommended Elliptic Curve Domain Parameters Ver Recommended 521-bit Elliptic Curve Domain Parameters over p Recommended Parameters secp521r Recommended Elliptic Curve Domain Parameters over 2 m Properties of Elliptic Curve Domain Parameters over 2 m Recommended 113-bit Elliptic Curve Domain Parameters over 2 m Recommended Parameters sect113r Recommended Parameters sect113r Recommended 131-bit Elliptic Curve Domain Parameters over 2 m Recommended Parameters sect131r Recommended Parameters sect131r Recommended 163-bit Elliptic Curve Domain Parameters over 2 m Recommended Parameters sect163k Recommended Parameters sect163r Recommended Parameters sect163r Recommended 193-bit Elliptic Curve Domain Parameters over 2 m Recommended Parameters sect193r Recommended Parameters sect193r Recommended 233-bit Elliptic Curve Domain Parameters over 2 m Recommended Parameters sect233k Recommended Parameters sect233r Recommended 239-bit Elliptic Curve Domain Parameters over 2 m Recommended Parameters sect239k Recommended 283-bit Elliptic Curve Domain Parameters over 2 m Recommended Parameters sect283k Recommended Parameters sect283r Recommended 409-bit Elliptic Curve Domain Parameters over 2 m Recommended Parameters sect409k Recommended Parameters sect409r Recommended 571-bit Elliptic Curve Domain Parameters over 2 m Recommended Parameters sect571k
5 SEC 2 - Contents Page iii Recommended Parameters sect571r A ASN.1 Syntax 40 A.1 Syntax for Elliptic Curve Domain Parameters A.2 Object Identifiers for Recommended Parameters A.2.1 OIDs for Recommended Parameters over p A.2.2 OIDs for Recommended Parameters over 2 m A.2.3 TheInformationObject Set SECGCurveNames B References 45
6 Page iv SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 1.0 List of Tables 1 Properties of Recommended Elliptic Curve Domain Parameters over p Status of Recommended Elliptic Curve Domain Parameters over p Representations of 2 m Properties of Recommended Elliptic Curve Domain Parameters over 2 m Status of Recommended Elliptic Curve Domain Parameters over 2 m
7 SEC 2-1 Introduction Page 1 1 Introduction 1.1 Overview This document lists example elliptic curve domain parameters at commonly required security levels for use by implementers of SEC 1 [12] and other ECC standards like ANSI X9.62 [1], ANSI X9.63 [3], and IEEE P1363 [8]. It is strongly recommended that implementers select parameters from among the example parameters listed in this document when they deploy ECC-based products in order to encourage the deployment of interoperable ECC-based solutions. 1.2 Compliance Implementations may claim compliance with the recommended parameters specified in this document provided some subset of the recommended parameters are used by the cryptographic schemes based on elliptic curve cryptography included in the implementation. It is envisioned that implementations choosing to comply with this document will typically choose also to comply with its companion document, SEC 1 [12]. It is intended to make a validation system available so that implementors can check compliance with this document - see the SECG website, for further information. 1.3 Document Evolution This document will be reviewed every five years to ensure it remains up to date with cryptographic advances. The next scheduled review will therefore take place in September Additional intermittent reviews may also be performed from time-to-time as deemed necessary by the Standards for Efficient Cryptography Group. 1.4 Intellectual Property The reader s attention is called to the possibility that compliance with this document may require use of an invention covered by patent rights. By publication of this document, no position is taken with respect to the validity of this claim or of any patent rights in connection therewith. The patent holder(s) may have filed with the SECG a statement of willingness to grant a license under these rights on reasonable and nondiscriminatory terms and conditions to applicants desiring to obtain such a license. Additional details may be obtained from the patent holder and from the SECG website,
![63 [3], and IEEE P1363 [8].](/docs-images/48/18325825/images/page_7.jpg "It is strongly recommended that implementers select parameters from among the example parameters listed in this document when they deploy ECC-based products in order to encourage the deployment of")
8 Page 2 SEC 2: Recommended Elliptic Curve Domain Parameters Ver Organization This document is organized as follows. The main body of the document focuses on the specification of recommended elliptic curve domain parameters. Section 2 describes recommended elliptic curve domain parameters over p, and Section 3 describes recommended elliptic curve domain parameters over 2 m. The appendices to the document provide additional relevant material. Appendix A provides reference ASN.1 syntax for implementations to use to identify the parameters. Appendix B lists the references cited in the document.
9 SEC 2-2 Recommended Elliptic Curve Domain Parameters over p Page 3 2 Recommended Elliptic Curve Domain Parameters over p This section specifies the elliptic curve domain parameters over p recommended in this document. The section is organized as follows. First Section 2.1 describes relevant properties of the recommended parameters over p. Then Section 2.2 specifies recommended 112-bit elliptic curve domain parameters over p, Section 2.3 specifies recommended 128-bit elliptic curve domain parameters over p, Section 2.4 specifies recommended 160-bit elliptic curve domain parameters over p, Section 2.5 specifies recommended 192-bit elliptic curve domain parameters over p, Section 2.6 specifies recommended 224- bit elliptic curve domain parameters over p, Section 2.7 specifies recommended 256-bit elliptic curve domain parameters over p, Section 2.8 specifies recommended 384-bit elliptic curve domain parameters over p, Section 2.9 specifies recommended 521-bit elliptic curve domain parameters over p, 2.1 Properties of Elliptic Curve Domain Parameters over p Following SEC 1 [12], elliptic curve domain parameters over p are a sextuple: T p a b G n hµ consisting of an integer p specifying the finite field p, two elements a b ¾ p specifying an elliptic curve E pµ defined by the equation: E : y 2 x 3 a x b mod pµ a base point G x G y G µ on E pµ, aprimen which is the order of G, and an integer h which is the cofactor h #E pµ n. When elliptic curve domain parameters are specified in this document, each component of this sextuple is represented as an octet string converted using the conventions specified in SEC 1 [12]. Again following SEC 1 [12], elliptic curve domain parameters over p must have: log 2 p ¾ This restriction is designed to encourage interoperability while allowing implementers to supply commonly required security levels recall that elliptic curve domain parameters over p with log 2 p 2t supply approximately t bits of security meaning that solving the logarithm problem on the associated elliptic curve is believed to take approximately 2 t operations. Here recommended elliptic curve domain parameters are supplied at each of the sizes allowed in SEC 1. All the recommended elliptic curve domain parameters over p use special form primes for their field order p. These special form primes facilitate especially efficient implementations like those described in [5]. Recommended elliptic curve domain parameters over p which use random primes for their field order p may be added later if commercial demand for such parameters increases. The elliptic curve domain parameters over p supplied at each security level typically consist of examples of two different types of parameters one type being parameters associated with a Koblitz curve and the
10 Page 4 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 1.0 other type being parameters chosen verifiably at random although only verifiably random parameters are supplied at export strength and at extremely high strength. Parameters associated with a Koblitz curve admit especially efficient implementation. The name Koblitz curve is best-known when used to describe binary anomalous curves over 2m which have a b ¾ 0 1 [9]. Here it is generalized to refer also to curves over p which possess an efficiently computable endomorphism [7]. The recommended parameters associated with a Koblitz curve were chosen by repeatedly selecting parameters admitting an efficiently computable endomorphism until a prime order curve was found. Verifiably random parameters offer some additional conservative features. These parameters are chosen from a seed using SHA-1 as specified in ANSI X9.62 [1]. This process ensures that the parameters cannot be predetermined. The parameters are therefore extremely unlikely to be susceptible to future special-purpose attacks, and no trapdoors can have been placed in the parameters during their generation. When elliptic curve domain parameters are chosen verifiably at random, the seed S used to generate the parameters may optionally be stored along with the parameters so that users can verify the parameters were chosen verifiably at random. Here verifiably random parameters have been chosen either so that the associated elliptic curve has prime order, or so that scalar multiplication of points on the associated elliptic curve can be accelerated using Montgomery s method [10]. The recommended verifiably random parameters were chosen by repeatedly selecting a random seed and counting the number of points on the corresponding curve until appropriate parameters were found. Typically the parameters were chosen so that a p 3 because such parameters admit efficient implementation. For a given p, approximately half the isomorphism classes of elliptic curves over p contain a curve with a p 3. See SEC 1 [12] for further guidance on the selection of elliptic curve domain parameters over p. The recommended elliptic curve domain parameters over p have been given nicknames to enable them to be easily identified. The nicknames were chosen as follows. Each name begins with sec to denote Standards for Efficient Cryptography, followed by a p to denote parameters over p, followed by a number denoting the length in bits of the field size p, followed by a k to denote parameters associated with a Koblitz curve or an r to denote verifiably random parameters, followed by a sequence number. Table 1 summarizes salient properties of the recommended elliptic curve domain parameters over p. Information is represented in Table 1 as follows. The column labelled parameters gives the nickname of the elliptic curve domain parameters. The column labelled section refers to the section of this document where the parameters are specified. The column labelled strength gives the approximate number of bits of security the parameters offer. The column labelled size gives the length in bits of the field order. The column labelled RSA/DSA gives the approximate size of an RSA or DSA modulus at comparable strength. (See SEC 1 [12] for precise technical guidance on the strength of elliptic curve domain parameters.) Finally the column labelled Koblitz or random indicates whether the parameters are associated with a Koblitz curve k or were chosen verifiably at random r. Table 2 summarizes the status of the recommended elliptic curve domain parameters over p with respect to their alignment with other standards.
11 SEC 2-2 Recommended Elliptic Curve Domain Parameters over p Page 5 Parameters Section Strength Size RSA/DSA Koblitz or random secp112r r secp112r r secp128r r secp128r r secp160k k secp160r r secp160r r secp192k k secp192r r secp224k k secp224r r secp256k k secp256r r secp384r r secp521r r Table 1: Properties of Recommended Elliptic Curve Domain Parameters over p Information is represented in Table 2 as follows. The column labelled parameters gives the nickname of the elliptic curve domain parameters. The column labelled section refers to the section of this document where the parameters are specified. The remaining columns give the status of the parameters with respect to various other standards which specify mechanisms based on elliptic curve cryptography: ANSI X9.62 refers to the ANSI X9.62 standard [1], ANSI X9.63 refers to the draft ANSI X9.63 standard [3], echeck refers to the draft FSML standard [6], IEEE P1363 refers to the draft IEEE P1363 standard [8], IPSec refers to the recent internet draft related to ECC [11] submitted to the IETF s IPSec working group, NIST refers to the list of recommended parameters recently released by the U.S. government [5], and WAP refers to the Wireless Application Forum s WTLS standard [13]. In these columns, a - denotes parameters non-conformant with the standard, a c denotes parameters conformant with the standard, and an r denotes parameters explicitly recommended in the standard. Note that ANSI X9.62 is currently being updated. The set of recommended parameters in the proposed ANSI X [2] is identical to the set of recommended parameters in this document.
12 Page 6 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 1.0 Parameters Section ANSI X9.62 ANSI X9.63 echeck IEEE P1363 IPSec NIST WAP secp112r c c - r secp112r c c - c secp128r c c - c secp128r c c - c secp160k c r c c c - c secp160r c c c c c - r secp160r c r c c c - c secp192k c r c c c - c secp192r r r c c c r c secp224k c r c c c - c secp224r c r c c c r c secp256k c r c c c - c secp256r r r c c c r c secp384r c r c c c r c secp521r c r c c c r c Table 2: Status of Recommended Elliptic Curve Domain Parameters over p 2.2 Recommended 112-bit Elliptic Curve Domain Parameters over p This section specifies the two recommended 112-bit elliptic curve domain parameters over p in this document: verifiably random parameters secp112r1, and verifiably random parameters secp112r2. Section specifies the elliptic curve domain parameters secp112r1, and Section specifies the elliptic curve domain parameters secp112r Recommended Parameters secp112r1 The verifiably random elliptic curve domain parameters over p secp112r1 are specified by the sextuple T p a b G n hµ where the finite field p is defined by: p ¾ ¾ ¼ ¾¼ µ 76439
13 SEC 2-2 Recommended Elliptic Curve Domain Parameters over p Page 7 The curve E: y 2 x 3 ax b over p is defined by: a ¾ ¾ ¼ ¾¼ b ¼ ½ ½½ ¼¾ ¾¾ E was chosen verifiably at random as specified in ANSI X9.62 [1] from the seed: S ¼¼ ¼ ¼¾ ½ ½ ¾ ¼ ¾ ½ G ¼¾¼ ¾ ¾ ¼ G ¼ ¼ ¾ ¾ ¼ ¾ ¼ ¾ ¼ ¼ ¼¼ n ¾ ¾ ¾ ½ h ¼½ Recommended Parameters secp112r2 The verifiably random elliptic curve domain parameters over p secp112r2 are specified by the sextuple T p a b G n hµ where the finite field p is defined by: p ¾ ¾ ¼ ¾¼ µ The curve E: y 2 x 3 ax b over p is defined by: a ½¾ ¾ ¼ ¼ ¼ ¼¾ b ½ ½ ½ ¼ E was chosen verifiably at random as specified in ANSI X9.62 [1] from the seed: S ¼¼¾ ½ ½½ ½ ½ ½ ¼ ¼ G ¼ ¼ ¾ ½ ¼ ¾ G ¼ ¼ ¾ ½ ¼ ¾ ¾
![[1] from the seed: S ¼¼ ¼ ¼¾ ½ ½ ¾ ¼ ¾ ½ G ¼¾¼ ¾ ¾ ¼ G ¼ ¼ ¾ ¾ ¼ ¾ ¼ ¾ ¼ ¼ ¼¼ n ¾ ¾ ¾ ½ h ¼½ 2.](/docs-images/48/18325825/images/page_13.jpg "2.2 Recommended Parameters secp112r2 The verifiably random elliptic curve domain parameters over p secp112r2 are specified by the sextuple T p a b G n hµ where the finite field p")
14 Page 8 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 1.0 n ¼ ½ ¼ ¾¼ ¼ h ¼ 2.3 Recommended 128-bit Elliptic Curve Domain Parameters over p This section specifies the two recommended 128-bit elliptic curve domain parameters over p in this document: verifiably random parameters secp128r1, and verifiably random parameters secp128r2. Section specifies the elliptic curve domain parameters secp128r1, and Section specifies the elliptic curve domain parameters secp128r Recommended Parameters secp128r1 The verifiably random elliptic curve domain parameters over p secp128r1 are specified by the sextuple T p a b G n hµ where the finite field p is defined by: p The curve E: y 2 x 3 ax b over p is defined by: a b ½ ½¼ ¾ ¾ E was chosen verifiably at random as specified in ANSI X9.62 [1] from the seed: S ¼¼¼ ¼ ½ ½ ¼ ¼ ¼ G ¼ ½ ½ ¾ ¾ ¼ ¾ ¼ ¾ G ¼ ½ ½ ¾ ¾ ¼ ¾ ¼ ¾ ½ ¼¾ ¾ ¾ n ¼¼¼¼¼¼¼¼ ¼ ½ ¼ ½½ h ¼½
15 SEC 2-2 Recommended Elliptic Curve Domain Parameters over p Page Recommended Parameters secp128r2 The verifiably random elliptic curve domain parameters over p secp128r2 are specified by the sextuple T p a b G n hµ where the finite field p is defined by: p The curve E: y 2 x 3 ax b over p is defined by: a b ¼ ½ ½ ½ ¼ ¼¾ ½ ¾ E was chosen verifiably at random as specified in ANSI X9.62 [1] from the seed: S ¼¼ ½ ½ ½¾ ¼ ½ G ¼¾ ¾ ¾ ½ ¼ G ¼ ¾ ¾ ½ ¼ ¾ ½ ½¼ ¼ n ¼¼¾ ¾ ¼ ½ h ¼ 2.4 Recommended 160-bit Elliptic Curve Domain Parameters over p This section specifies the three recommended 160-bit elliptic curve domain parameters over p in this document: parameters secp160k1 associated with a Koblitz curve, verifiably random parameters secp160r1, and verifiably random parameters secp160r2. Section specifies the elliptic curve domain parameters secp160k1, Section specifies the elliptic curve domain parameters secp160r1, and Section specifies the elliptic curve domain parameters secp160r Recommended Parameters secp160k1 The elliptic curve domain parameters over p associated with a Koblitz curve secp160k1 are specified by the sextuple T p a b G n hµ where the finite field p is defined by:
16 Page 10 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 1.0 p The curve E: y 2 x 3 ax b over p is defined by: a b ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼ G ¼¾ ¾ ½ ¾ ¼½ ¼ G ¼ ¾ ½ ¾ ¼½ ¼ ½ ¾ ¾ ½ ¼ n ¼½ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼½ ½ ½ h ¼½ Recommended Parameters secp160r1 The verifiably random elliptic curve domain parameters over p secp160r1 are specified by the sextuple T p a b G n hµ where the finite field p is defined by: p The curve E: y 2 x 3 ax b over p is defined by: a b ½ ½ E was chosen verifiably at random as specified in ANSI X9.62 [1] from the seed: S ½¼ ¾ ½ ½ ½ G ¼¾ ¾ ½ ¾ G ¼ ¾ ½ ¾ ¾ ¾ ½ ½¾ ¼ ¾ ½ ¾
17 SEC 2-2 Recommended Elliptic Curve Domain Parameters over p Page 11 n ¼½ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼½ ¾ ¾¾ h ¼½ Recommended Parameters secp160r2 The verifiably random elliptic curve domain parameters over p secp160r2 are specified by the sextuple T p a b G n hµ where the finite field p is defined by: p The curve E: y 2 x 3 ax b over p is defined by: a b ¼ ½ ¾ ¼ ¼ E was chosen verifiably at random as specified in ANSI X9.62 [1] from the seed: S ¼ ¾ ¼ ¾ ¼ ½ ½ ½ G ¼¾ ¾ ¼ ¾ ½½ ½ ½½ ¼ ½ ½ G ¼ ¾ ¼ ¾ ½½ ½ ½½ ¼ ½ ½ ¾ ½ ¾ ¼ ½ ¼ ¾ ¾ n ¼½ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼ ½ ½ ½ ½ h ¼½ 2.5 Recommended 192-bit Elliptic Curve Domain Parameters over p This section specifies the two recommended 192-bit elliptic curve domain parameters over p in this document: parameters secp192k1 associated with a Koblitz curve, and verifiably random parameters secp192r1. Section specifies the elliptic curve domain parameters secp192k1, and Section specifies the elliptic curve domain parameters secp192r1.
18 Page 12 SEC 2: Recommended Elliptic Curve Domain Parameters Ver Recommended Parameters secp192k1 The elliptic curve domain parameters over p associated with a Koblitz curve secp192k1 are specified by the sextuple T p a b G n hµ where the finite field p is defined by: p The curve E: y 2 x 3 ax b over p is defined by: a b ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼ G ¼ ½¼ ¼ ¾ ¼ ¼¾ ¼ ½ ½ ½ ¼ G ¼ ½¼ ¼ ¾ ¼ ¼¾ ¼ ½ ½ ½ ¼ ¾ ¾ ¾ ½ ¼ ½ ¼ ¾ ¾ n ¾ ¾ ½ ¼ h ¼½ Recommended Parameters secp192r1 The verifiably random elliptic curve domain parameters over p secp192r1 are specified by the sextuple T p a b G n hµ where the finite field p is defined by: p The curve E: y 2 x 3 ax b over p is defined by: a b ¾½¼ ½ ¼ ¼ ¾¾ ¼ ½ ½ E was chosen verifiably at random as specified in ANSI X9.62 [1] from the seed: S ¼ ¾¾ ¾ ½¾¼ ½¾½ G ¼ ½ ¼ ¼ ¼ ¼ ¾¼ ½ ¼¼ ¼ ¾ ½¼½¾
19 SEC 2-2 Recommended Elliptic Curve Domain Parameters over p Page 13 G ¼ ½ ¼ ¼ ¼ ¼ ¾¼ ½ ¼¼ ¼ ¾ ½¼½¾ ¼ ½ ¾ ½¼½½ ¾ ½ ½ ½½ n ½ ½ ¾¾ ½ h ¼½ 2.6 Recommended 224-bit Elliptic Curve Domain Parameters over p This section specifies the two recommended 224-bit elliptic curve domain parameters over p in this document: parameters secp224k1 associated with a Koblitz curve, and verifiably random parameters secp224r1. Section specifies the elliptic curve domain parameters secp224k1, and Section specifies the elliptic curve domain parameters secp224r Recommended Parameters secp224k1 The elliptic curve domain parameters over p associated with a Koblitz curve secp224k1 are specified by the sextuple T p a b G n hµ where the finite field p is defined by: p The curve E: y 2 x 3 ax b over p is defined by: a b ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼ G ¼ ½ ¼ ¼ ¾ ½ ¼ ¼ ¼ G ¼ ½ ¼ ¼ ¾ ½ ¼ ¼ ¼ ¼ ¾ ¾ ½ ¼ ¼ ¾ ½
20 Page 14 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 1.0 n ¼½ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼½ ¾ ½ ¼ ½ ½ h ¼½ Recommended Parameters secp224r1 The verifiably random elliptic curve domain parameters over p secp224r1 are specified by the sextuple T p a b G n hµ where the finite field p is defined by: p ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼½ The curve E: y 2 x 3 ax b over p is defined by: a b ¼ ¼ ¼ ¼ ½ ¾ ¼ ¼ ¾ ¼ ¾ E was chosen verifiably at random as specified in ANSI X9.62 [1] from the seed: S ½ G ¼¾ ¼ ¼ ¾½ ¼ ¼ ½ ¾½½¾¾ ¾ ¼ ½½ ½ ¾½ G ¼ ¼ ¼ ¾½ ¼ ¼ ½ ¾½½¾¾ ¾ ¼ ½½ ½ ¾½ ¾ ¾¾ ¼ ¼ ½ ¼¼ n ½ ¾ ¼ ¼ ½ ¾ ¾ h ¼½ 2.7 Recommended 256-bit Elliptic Curve Domain Parameters over p This section specifies the two recommended 256-bit elliptic curve domain parameters over p in this document: parameters secp256k1 associated with a Koblitz curve, and verifiably random parameters secp256r1. Section specifies the elliptic curve domain parameters secp256k1, and Section specifies the
21 SEC 2-2 Recommended Elliptic Curve Domain Parameters over p Page 15 elliptic curve domain parameters secp256r Recommended Parameters secp256k1 The elliptic curve domain parameters over p associated with a Koblitz curve secp256k1 are specified by the sextuple T p a b G n hµ where the finite field p is defined by: p ¾ The curve E: y 2 x 3 ax b over p is defined by: a b ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼ G ¼¾ ¼ ¾ ¼ ¼ ¼¾ ¾ ¾ ¾ ½ ½ ½ G ¼ ¼ ¾ ¼ ¼ ¼¾ ¾ ¾ ¾ ½ ½ ½ ¾ ¼ ½½¼ ½ ½ ¼ ½¼ n ¼ ¾ ¼ ½ ½ h ¼½ Recommended Parameters secp256r1 The verifiably random elliptic curve domain parameters over p secp256r1 are specified by the sextuple T p a b G n hµ where the finite field p is defined by:
22 Page 16 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 1.0 p ¼¼¼¼¼¼¼½ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ µ The curve E: y 2 x 3 ax b over p is defined by: a b ¼¼¼¼¼¼¼½ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ½ ¼ ¼ ¼ ¾ ¾ ¼ E was chosen verifiably at random as specified in ANSI X9.62 [1] from the seed: S ¼ ¼ ½ ½ ¾ ½ ¼ G ¼ ½ ½ ¾ ½¾ ¾ ¼ ¾ ¼ ½ ¾ ¼ ½ ¾ G ¼ ½ ½ ¾ ½¾ ¾ ¼ ¾ ¼ ½ ¾ ¼ ½ ¾ ¾ ¾ ½ ¼ ½ ¾ ½ ¼ ½ n h ¼¼¼¼¼¼¼¼ ½ ¾ ¼½ ¾ ½ 2.8 Recommended 384-bit Elliptic Curve Domain Parameters over p This section specifies the recommended 384-bit elliptic curve domain parameters over p in this document: verifiably random parameters secp384r1. Section specifies the elliptic curve domain parameters secp384r Recommended Parameters secp384r1 The verifiably random elliptic curve domain parameters over p secp384r1 are specified by the sextuple T p a b G n hµ where the finite field p is defined by:
23 SEC 2-2 Recommended Elliptic Curve Domain Parameters over p Page 17 p ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ The curve E: y 2 x 3 ax b over p is defined by: a b ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ½¾ ¾ ¼ ¾ ½ ½ ½ ½ ½½¾ ¼ ½ ¼ ¼½ ¾ ½ ¾ ¾ E was chosen verifiably at random as specified in ANSI X9.62 [1] from the seed: S ¾ ½ ¾ ½ ¼¼ ¾ G ¼ ¾¾ ¼ ½ ½ ¾¼ ½ ¾ ½ ¼ ¾ ¾ ¼¾ ¾ ¾ ¾ ¼ G ¼ ¾¾ ¼ ½ ½ ¾¼ ½ ¾ ½ ¼ ¾ ¾ ¼¾ ¾ ¾ ¾ ¼ ½ ¾ ¾ ¾ ¾ ¾ ½ ¾ ½ ½½ ¼ ¼ ¼ ¼ ½ ½ ½ ½ ¼ ¼ n ½ ¾ ½ ¼ ¾ ¼ ½ ¾ h ¼½ 2.9 Recommended 521-bit Elliptic Curve Domain Parameters over p This section specifies the recommended 521-bit elliptic curve domain parameters over p in this document: verifiably random parameters secp521r1. Section specifies the elliptic curve domain parameters secp521r1.
24 Page 18 SEC 2: Recommended Elliptic Curve Domain Parameters Ver Recommended Parameters secp521r1 The verifiably random elliptic curve domain parameters over p secp521r1 are specified by the sextuple T p a b G n hµ where the finite field p is defined by: p ¼½ The curve E: y 2 x 3 ax b over p is defined by: a ¼½ b ¼¼ ½ ½ ½ ½ ¾ ¾½ ¼ ¼ ¾ ¾ ½ ½ ½¼ ½ ½ ½ ½ ¾ ¼ ½ ¼ ¾ ½ ½ ¼ ¼¼ E was chosen verifiably at random as specified in ANSI X9.62 [1] from the seed: S ¼ ¼¼ ¾ ½ ½ ¾ ¼ G ¼¾¼¼ ¼ ¼ ¼ ¾ ¾ ½ ¼ ¾½ ¾ ¼ ½ ¾ ½ ½¾ ¾ ½ ¾ ½ ¾ G ¼ ¼¼ ¼ ¼ ¼ ¾ ¾ ½ ¼ ¾½ ¾ ¼ ½ ¾ ½ ½¾ ¾ ½ ¾ ½ ¾ ¼½½ ¾ ¼¼ ¾ ½ ½ ½ ¾ ¾ ¾ ¾ ¼ ¼ ¼½ ¼ ½ ¼ ¾ ¾ ¾ ¼ ½ ¼
25 SEC 2-2 Recommended Elliptic Curve Domain Parameters over p Page 19 n ¼½ ½ ¾ ¼½ ¼ ¼ ½ ½ ¼ h ¼½
26 Page 20 SEC 2: Recommended Elliptic Curve Domain Parameters Ver Recommended Elliptic Curve Domain Parameters over 2 m This section specifies the elliptic curve domain parameters over 2m recommended in this document. The section is organized as follows. First Section 3.1 describes relevant properties of the recommended parameters over 2m. Then Section 3.2 specifies recommended 113-bit elliptic curve domain parameters over 2 m, Section 3.3 specifies recommended 131-bit elliptic curve domain parameters over 2m, Section 3.4 specifies recommended 163-bit elliptic curve domain parameters over 2m, Section 3.5 specifies recommended 193-bit elliptic curve domain parameters over 2m, Section 3.6 specifies recommended 233-bit elliptic curve domain parameters over 2m, Section 3.7 specifies recommended 239-bit elliptic curve domain parameters over 2m, Section 3.8 specifies recommended 283-bit elliptic curve domain parameters over 2m, Section 3.9 specifies recommended 409-bit elliptic curve domain parameters over 2 m, and Section 3.10 specifies recommended 571-bit elliptic curve domain parameters over 2 m. 3.1 Properties of Elliptic Curve Domain Parameters over 2 m Following SEC 1 [12], elliptic curve domain parameters over 2m are a septuple: T m f xµ a b G n hµ consisting of an integer m specifying the finite field 2m, an irreducible binary polynomial f xµ of degree m specifying the polynomial basis representation of 2 m, two elements a b ¾ 2m specifying an elliptic curve E 2mµ defined by the equation: E : y 2 x y x 3 a x 2 b in 2 m a base point G x G y G µ on E 2mµ, aprimen which is the order of G, and an integer h which is the cofactor h #E 2 mµ n. When elliptic curve domain parameters over 2m are specified in this document, m is represented directly as an integer, f xµ is represented directly as a polynomial, and the remaining components are represented as octet strings converted using the conventions specified in SEC 1 [12]. Again following SEC 1 [12], elliptic curve domain parameters over 2m must have: m ¾ Furthermore elliptic curve domain parameters over 2 m Table 3 below. must use the reduction polynomials listed in This restriction is designed to encourage interoperability while allowing implementers to supply efficient implementations at commonly required security levels. Here recommended elliptic curve domain parameters are supplied at each of the sizes allowed by SEC 1. The elliptic curve domain parameters over 2 m supplied at each security level typically consist of examples of two different types of parameters one type being parameters associated with a Koblitz curve
27 SEC 2-3 Recommended Elliptic Curve Domain Parameters over 2m Page 21 Field Reduction Polynomial(s) f xµ x113 x f xµ x131 x 8 x 3 x f xµ x 163 x 7 x 6 x f xµ x193 x f xµ x233 x f xµ x239 x 36 1orx 239 x f xµ x283 x 12 x 7 x f xµ x409 x f xµ x 571 x 10 x 5 x 2 1 Table 3: Representations of 2 m and the other type being parameters chosen verifiably at random although only verifiably random parameters are supplied at export strength. Parameters associated with a Koblitz curve admit especially efficient implementation. Koblitz curves over 2m are binary anomalous curves which have a b ¾ 0 1 [9]. Verifiably random parameters offer some additional conservative features. These parameters are chosen from a seed using SHA-1 as specified in ANSI X9.62 [1]. This process ensures that the parameters cannot be predetermined. The parameters are therefore extremely unlikely to be susceptible to future special-purpose attacks, and no trapdoors can have been placed in the parameters during their generation. When elliptic curve domain parameters are chosen verifiably at random, the seed S used to generate the parameters may optionally be stored along with the parameters so that users can verify the parameters were chosen verifiably at random. The recommended verifiably random parameters were chosen by repeatedly selecting a random seed and counting the points on the corresponding curve using Schoof s algorithm until appropriate parameters were found. The parameters were chosen so that either a is random or a 1. For a given m, approximately half the isomorphism classes of elliptic curves over 2m contain a curve with a 1. See SEC 1 [12] for further guidance on the selection of elliptic curve domain parameters over 2 m. The example elliptic curve domain parameters over 2m have been given nicknames to enable them to be easily identified. The nicknames were chosen as follows. Each name begins with sec to denote Standards for Efficient Cryptography, followed by a t to denote parameters over 2 m,followedbya number denoting the field size m, followedbyak to denote parameters associated with a Koblitz curve or an r to denote verifiably random parameters, followed by a sequence number. Table 4 summarizes salient properties of the recommended elliptic curve domain parameters over 2 m.
28 Page 22 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 1.0 Parameters Section Strength Size RSA/DSA Koblitz or random sect113r r sect113r r sect131r r sect131r r sect163k k sect163r r sect163r r sect193r r sect193r r sect233k k sect233r r sect239k k sect283k k sect283r r sect409k k sect409r r sect571k k sect571r r Table 4: Properties of Recommended Elliptic Curve Domain Parameters over 2 m
29 SEC 2-3 Recommended Elliptic Curve Domain Parameters over 2m Page 23 Information is represented in Table 4 as follows. The column labelled parameters gives the nickname of the elliptic curve domain parameters. The column labelled section refers to the section of this document where the parameters are specified. The column labelled strength gives the approximate number of bits of security the parameters offer. The column labelled size gives the field size m. The column labelled RSA/DSA gives the approximate size of an RSA or DSA modulus at comparable strength. (See SEC 1 [12] for precise technical guidance on the strength of elliptic curve domain parameters.) Finally the column labelled Koblitz or random indicates whether the parameters are associated with a Koblitz curve k or were chosen verifiably at random r. Parameters Section ANSI X9.62 ANSI X9.63 echeck IEEE P1363 IPSec NIST WAP sect113r c c - r sect113r c c - c sect131r c c - c sect131r c c - c sect163k c r r c r r r sect163r c c r c r - c sect163r c r r c c r c sect193r c r c c c - c sect193r c r c c c - c sect233k c r c c c r c sect233r c r c c c r c sect239k c c c c c - c sect283k c r r c r r c sect283r c r r c r r c sect409k c r c c c r c sect409r c r c c c r c sect571k c r c c c r c sect571r c r c c c r c Table 5: Status of Recommended Elliptic Curve Domain Parameters over 2 m Table 5 summarizes the status of the recommended elliptic curve domain parameters over 2m with respect to their alignment with other standards. Information is represented in Table 5 as follows. The column labelled parameters gives the nickname
30 Page 24 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 1.0 of the elliptic curve domain parameters. The column labelled section refers to the section of this document where the parameters are specified. The remaining columns give the status of the parameters with respect to various other standards which specify mechanisms based on elliptic curve cryptography: ANSI X9.62 refers to the ANSI X9.62 standard [1], ANSI X9.63 refers to the draft ANSI X9.63 standard [3], echeck refers to the draft FSML standard [6], IEEE P1363 refers to the draft IEEE P1363 standard [8], IPSec refers to the recent internet draft related to ECC [11] submitted to the IETF s IPSec working group, NIST refers to the list of recommended parameters recently released by the U.S. government [5], and WAP refers to the Wireless Application Forum s WTLS standard [13]. In these columns, a - denotes parameters non-conformant with the standard, a c denotes parameters conformant with the standard, and an r denotes parameters explicitly recommended in the standard. Note that ANSI X9.62 is currently being updated. The set of recommended parameters in the proposed ANSI X [2] is identical to the set of recommended parameters in this document. 3.2 Recommended 113-bit Elliptic Curve Domain Parameters over 2 m This section specifies the two recommended 113-bit elliptic curve domain parameters over 2m in this document: verifiably random parameters sect113r1, and verifiably random parameters sect113r2. Section specifies the elliptic curve domain parameters sect113r1, and Section specifies the elliptic curve domain parameters sect113r Recommended Parameters sect113r1 The verifiably random elliptic curve domain parameters over 2m sect113r1 are specified by the septuple T m f xµ a b G n hµ where m 113 and the representation of is defined by: f xµ x 113 x 9 1 The curve E: y 2 xy x 3 ax 2 b over 2m is defined by: a ¼¼ ¼ ¾ ¼ ¾¼ b ¼¼ ¾¾ ¼ ½ ¼ ¾ E was chosen verifiably at random as specified in ANSI X9.62 [1] from the seed: S ½¼ ¾ ½ ½ ½ G ¼ ¼¼ ½ ½ ¼ ¾ ½¼ G ¼ ¼¼ ½ ½ ¼ ¾ ½ ¼ ¼¼ ¾ ¼¾ ½ ½ ½
31 SEC 2-3 Recommended Elliptic Curve Domain Parameters over 2m Page 25 n ¼½¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼ h ¼¾ Recommended Parameters sect113r2 The verifiably random elliptic curve domain parameters over 2m sect113r2 are specified by the sep- 113 is defined by: tuple T m f xµ a b G n hµ where m 113 and the representation of 2 f xµ x 113 x 9 1 The curve E: y 2 xy x 3 ax 2 b over 2m is defined by: a ¼¼ ½ ¼ ¼ b ¼¼ ¾ ¼ ½ E was chosen verifiably at random as specified in ANSI X9.62 [1] from the seed: S ½¼ ¼ ½ ¼ ¼ ½ ½ ½ G ¼ ¼½ ¾ ¾ ½ G ¼ ¼½ ¾ ¾ ½ ¼¼ ½ ¼ ½ n ¼½¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼½¼ ¾ h ¼¾ 3.3 Recommended 131-bit Elliptic Curve Domain Parameters over 2 m This section specifies the two recommended 131-bit elliptic curve domain parameters over 2m in this document: verifiably random parameters sect131r1, and verifiably random parameters sect131r2. Section specifies the elliptic curve domain parameters sect131r1, and Section specifies the elliptic curve domain parameters sect131r2.
32 Page 26 SEC 2: Recommended Elliptic Curve Domain Parameters Ver Recommended Parameters sect131r1 The verifiably random elliptic curve domain parameters over 2m sect131r1 are specified by the sep- 131 is defined by: tuple T m f xµ a b G n hµ where m 131 and the representation of 2 f xµ x 131 x 8 x 3 x 2 1 The curve E: y 2 xy x 3 ax 2 b over 2m is defined by: a ¼ ½½ ¼ ¾½ ½ ¾ ¼ b ¼¾ ½ ¼ ½¼ ¾ ½ ½ E was chosen verifiably at random as specified in ANSI X9.62 [1] from the seed: S ½ ½ ¾½ ¾ G ¼ ¼¼ ½ ½ ¼ ½ ½ G ¼ ¼¼ ½ ½ ¼ ½ ½ ¼ ¼¼½ ½ ½ ½ ¼ n ¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¾ ½¾ h ¼¾ Recommended Parameters sect131r2 The verifiably random elliptic curve domain parameters over 2m sect131r2 are specified by the sep- 131 is defined by: tuple T m f xµ a b G n hµ where m 131 and the representation of 2 f xµ x 131 x 8 x 3 x 2 1 The curve E: y 2 xy x 3 ax 2 b over 2m is defined by: a ¼ ½ ½ ¼ ¾ ½ ¾ b ¼ ¾ ¼½ ¾½ ¾ E was chosen verifiably at random as specified in ANSI X9.62 [1] from the seed: S ½ ½ ¾½ G ¼ ¼ ¾ ¼ ½ ¾ ¾ ½
33 SEC 2-3 Recommended Elliptic Curve Domain Parameters over 2m Page 27 G ¼ ¼ ¾ ¼ ½ ¾ ¾ ½ ¼ ¼ ¼ ¾ ¾ ¼ n ¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼½ ¾ ¼ h ¼¾ 3.4 Recommended 163-bit Elliptic Curve Domain Parameters over 2 m This section specifies the three recommended 163-bit elliptic curve domain parameters over 2 m in this document: parameters sect163k1 associated with a Koblitz curve, verifiably random parameters sect163r1, and verifiably random parameters sect163r2. Section specifies the elliptic curve domain parameters sect163k1, Section specifies the elliptic curve domain parameters sect163r1, and Section specifies the elliptic curve domain parameters sect163r Recommended Parameters sect163k1 The elliptic curve domain parameters over 2m associated with a Koblitz curve sect163k1 are specified by the septuple T m f xµ a b G n hµ where m 163 and the representation of is defined by: f xµ x 163 x 7 x 6 x 3 1 The curve E: y 2 xy x 3 ax 2 b over 2m is defined by: a ¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼½ b ¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼½ G ¼ ¼¾ ½ ¼ ½½ ¼ G ¼ ¼¾ ½ ¼ ½½ ¼ ¼¾ ¼ ¼ ¼ ¾½ ¾ ¼ ¼ n ¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¾¼½¼ ¾ ¼ ¼ h ¼¾
34 Page 28 SEC 2: Recommended Elliptic Curve Domain Parameters Ver Recommended Parameters sect163r1 The verifiably random elliptic curve domain parameters over 2m sect163r1 are specified by the septuple T m f xµ a b G n hµ where m 163 and the representation of is defined by: f xµ x 163 x 7 x 6 x 3 1 The curve E: y 2 xy x 3 ax 2 b over 2m is defined by: a ¼ ¾ ¾ ¾ ¾ ¾ ¾ b ¼ ½ ½¾ ¼ ¾ ½ E was chosen verifiably at random from the seed: S ¾ ½ ½ ½ ½ ¼ ¾ However for historical reasons the method used to generate E from S differs slightly from the method described in ANSI X9.62 [1]. Specifically the coefficient b produced from S is the reverse of the coefficient that would have been produced by the method described in ANSI X9.62. G ¼ ¼ G ¼ ¼ ¼¼ ¾ ¾ ½ ¼ ½ n ¼ ¾ ½¼¾ h ¼¾ Recommended Parameters sect163r2 The verifiably random elliptic curve domain parameters over 2m sect163r2 are specified by the septuple T m f xµ a b G n hµ where m 163 and the representation of is defined by: f xµ x 163 x 7 x 6 x 3 1 The curve E: y 2 xy x 3 ax 2 b over 2m is defined by: a ¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼½ b ¼¾ ¼ ¼½ ¼ ½ ½ ½¼ ½¾ ¾¼ E was chosen verifiably at random from the seed: S ¾ ¾¾ ½¾¼½ ¼ ¾
35 SEC 2-3 Recommended Elliptic Curve Domain Parameters over 2m Page 29 E was selected from S as specified in ANSI X9.62 [1] in normal basis representation and converted into polynomial basis representation. G ¼ ¼ ¼ ½ ¾ ¾ ¼ ½½ G ¼ ¼ ¼ ½ ¾ ¾ ¼ ½½ ¼¼ ½ ½ ¼¼ ¾ ½½ ¼ ¾ ½ n ¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¾ ¾ ¼ ½¾ ¾ h ¼¾ 3.5 Recommended 193-bit Elliptic Curve Domain Parameters over 2 m This section specifies the two recommended 193-bit elliptic curve domain parameters over 2m in this document: verifiably random parameters sect193r1, and verifiably random parameters sect193r1. Section specifies the elliptic curve domain parameters sect193r1, and Section specifies the elliptic curve domain parameters sect193r Recommended Parameters sect193r1 The verifiably random elliptic curve domain parameters over 2m sect193r1 are specified by the septuple T m f xµ a b G n hµ where m 193 and the representation of is defined by: f xµ x 193 x 15 1 The curve E: y 2 xy x 3 ax 2 b over 2m is defined by: a ¼¼ ½ ½ ½ ½ ¼ ¼ ½½ ¼½ b ¼¼ ½ ½ ¾ ½ ½ E was chosen verifiably at random as specified in ANSI X9.62 [1] from the seed: S ½¼ ½ ½ ½ ½ ¼ G ¼ ¼½ ½ ¼ ½ ¾ ¾ ¼ ½
36 Page 30 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 1.0 G ¼ ¼½ ½ ¼ ½ ¾ ¾ ¼ ½¼¼ ¾ ¾ ¼ ½¾ ½ ½ ¼ ¾¼½ ½ ¼ n ¼½ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¾¼ h ¼¾ Recommended Parameters sect193r2 The verifiably random elliptic curve domain parameters over 2m sect193r2 are specified by the sep- 193 is defined by: tuple T m f xµ a b G n hµ where m 193 and the representation of 2 f xµ x 193 x 15 1 The curve E: y 2 xy x 3 ax 2 b over 2m is defined by: a ¼½ ½ ¾ ½ ¼ ¼ ¼¾ ¼ b ¼¼ ¾ ¾ ¾ ½ ½ ½ E was chosen verifiably at random as specified in ANSI X9.62 [1] from the seed: S ½¼ ½ ½ ½ ½ ¼ ¾¾½½ G ¼ ¼¼ ½ ¾ ¼ ¼ ½ ¾ ½ ½ ¼ ½ G ¼ ¼¼ ½ ¾ ¼ ¼ ½ ¾ ½ ½ ¼ ½ ¼½ ¼ ¼ ¾ ¼½ ¾ ¾¾ n ¼½ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼½ ½ ¼¼ ½ h ¼¾ 3.6 Recommended 233-bit Elliptic Curve Domain Parameters over 2 m This section specifies the two recommended 233-bit elliptic curve domain parameters over 2m in this document: parameters sect233k1 associated with a Koblitz curve, and verifiably random parameters sect233r1. Section specifies the elliptic curve domain parameters sect233k1, and Section specifies the elliptic curve domain parameters sect233r1.
37 SEC 2-3 Recommended Elliptic Curve Domain Parameters over 2m Page Recommended Parameters sect233k1 The elliptic curve domain parameters over 2m associated with a Koblitz curve sect233k1 are specified by the septuple T m f xµ a b G n hµ where m 233 and the representation of is defined by: f xµ x 233 x 74 1 The curve E: y 2 xy x 3 ax 2 b over 2m is defined by: a ¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ b ¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼½ G ¼¾¼½ ¾ ¾ ½ ½ ¾ ¾¾ ½ ½ ¾ ¼ ½¾ G ¼ ¼½ ¾ ¾ ½ ½¾ ¾ ¾ ½ ½ ¾ ¼ ½¾ ¼½ ½ ¼ ¾ ½ ¼ ½½¼ n ¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼ ½ ½ ½ h ¼ Recommended Parameters sect233r1 The verifiably random elliptic curve domain parameters over 2m sect233r1 are specified by the septuple T m f xµ a b G n hµ where m 233 and the representation of is defined by: f xµ x 233 x 74 1 The curve E: y 2 xy x 3 ax 2 b over 2m is defined by: a ¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼½ b ¼¼ ¾ ¼ ¾ ¾½ ¾¼ ¾ ½ ½½ ¼
38 Page 32 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 1.0 E was chosen verifiably at random from the seed: S ¼ ½ ¼ ½ ¾¼ ¾ ¼ ¼ E was selected from S as specified in ANSI X9.62 [1] in normal basis representation and converted into polynomial basis representation. G ¼ ¼¼ ½ ¾½ ½ ½ ½ G ¼ ¼¼ ½ ¾½ ½ ½ ½ ¼½¼¼ ¼ ½ ¼ ¼ ¾ ¼ ½ ¼½ ½¼ ¾ n ¼½¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼½ ¾ ¾¾¼ ½ ¾ ¼ ¼ h ¼¾ 3.7 Recommended 239-bit Elliptic Curve Domain Parameters over 2 m This section specifies the recommended 239-bit elliptic curve domain parameters over 2m in this document: parameters sect239k1 associated with a Koblitz curve. Section specifies the elliptic curve domain parameters sect239k Recommended Parameters sect239k1 The elliptic curve domain parameters over 2m associated with a Koblitz curve sect239k1 are specified by the septuple T m f xµ a b G n hµ where m 239 and the representation of is defined by: f xµ x 239 x The curve E: y 2 xy x 3 ax 2 b over 2m is defined by: a ¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ b ¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼½
39 SEC 2-3 Recommended Elliptic Curve Domain Parameters over 2m Page 33 G ¼ ¾ ¼ ¼ ¾ ¾ ½¾ ¾ ¾ ½ ¼ G ¼ ¾ ¼ ¼ ¾ ¾ ½¾ ¾ ¾ ½ ¼ ½ ¼ ¼ ½¾ ¼½ ½ ½¼ ¼ ½¼ ¾ ½ ¾ ¼ n ¾¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼ ½ ½ ½ ¼¼ h ¼ 3.8 Recommended 283-bit Elliptic Curve Domain Parameters over 2 m This section specifies the two recommended 283-bit elliptic curve domain parameters over 2m in this document: parameters sect283k1 associated with a Koblitz curve, and verifiably random parameters sect283r1. Section specifies the elliptic curve domain parameters sect283k1, and Section specifies the elliptic curve domain parameters sect283r Recommended Parameters sect283k1 The elliptic curve domain parameters over 2m associated with a Koblitz curve sect283k1 are specified 283 is defined by: by the septuple T m f xµ a b G n hµ where m 283 and the representation of 2 f xµ x 283 x 12 x 7 x 5 1 The curve E: y 2 xy x 3 ax 2 b over 2m is defined by: a b ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼½ G ¼¾ ¼ ¼ ¾½ ½ ½ ¾ ½ ¾ ¾ ½ ½ ½ ¼ ¾ ¾ ¾
40 Page 34 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 1.0 G ¼ ¼ ¼ ¾½ ½ ½ ¾ ½ ¾ ¾ ½ ½ ½ ¼ ¾ ¾ ¾ ¼½ ¼ ½ ½ ¼ ¼ ¾ ¼ ½ ¾ ½½ ½ ¾¾ n ¼½ ¾ ¼ ¾ ½ ¼ ½ ½ ½ h ¼ Recommended Parameters sect283r1 The verifiably random elliptic curve domain parameters over 2m sect283r1 are specified by the sep- 283 is defined by: tuple T m f xµ a b G n hµ where m 283 and the representation of 2 f xµ x 283 x 12 x 7 x 5 1 The curve E: y 2 xy x 3 ax 2 b over 2m is defined by: a b ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼½ ¼¾ ¼ ½ ¼ ¼ ¼ ¾ ½ ¾ ½ ¾ E was chosen verifiably at random from the seed: S ¾ ¼ ¼ ¼ ¾ ¾ ¼ E was selected from S as specified in ANSI X9.62 [1] in normal basis representation and converted into polynomial basis representation. G ¼ ¼ ¾ ¼ ½ ¼ ¼ ¾ ¾ ¼ ¾ ½ ½¾¼ G ¼ ¼ ¾ ¼ ½ ¼ ¼ ¾ ¾ ¼ ¾ ½ ½¾¼ ¼ ¾ ½ ½ ¾¼ ¼¾ ½ ¼¾ ¼ ¼ ¾ ½ ¼ ½½¾
41 SEC 2-3 Recommended Elliptic Curve Domain Parameters over 2m Page 35 n ¼ ¼ ¼ ¼½ ¼ ¾ ¼ h ¼¾ 3.9 Recommended 409-bit Elliptic Curve Domain Parameters over 2 m This section specifies the two recommended 409-bit elliptic curve domain parameters over 2m in this document: parameters sect409k1 associated with a Koblitz curve, and verifiably random parameters sect409r1. Section specifies the elliptic curve domain parameters sect409k1, and Section specifies the elliptic curve domain parameters sect409r Recommended Parameters sect409k1 The elliptic curve domain parameters over 2m associated with a Koblitz curve sect409k1 are specified by the septuple T m f xµ a b G n hµ where m 409 and the representation of is defined by: f xµ x 409 x 87 1 The curve E: y 2 xy x 3 ax 2 b over 2m is defined by: a b ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼¼ ¼¼¼¼¼¼¼½ G ¼ ¼¼ ¼ ¼ ½ ½ ¼ ½ ¾½ ¼ ¼ ¼ ¾ ¾ ¼½ ¾ ¾¾¾ ½ ¼ ¼¾ G ¼ ¼¼ ¼ ¼ ½ ½ ¼ ½ ¾½ ¼ ¼ ¼ ¾ ¾ ¼½ ¾ ¾¾¾ ½ ¼ ¼¾ ¼½ ¼ ¼ ¾ ½ ¼ ¾ ¼ ¾ ½ ¾ ¾ ½ ½¼ ¾ ¾½ ¾ ¼¾
SEC 4: Elliptic Curve Qu-Vanstone Implicit Certificate Scheme (ECQV)
Standards for Efficient Cryptography SEC 4: Elliptic Curve Qu-Vanstone Implicit Certificate Scheme (ECQV) Contact: Certicom Research Eoin Buckley (mbuckley@blackberry.com) April 3, 2014 Version (Draft)
Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography (Revised)
NIST Special Publication 800-56A Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography (Revised) Elaine Barker, Don Johnson, and Miles Smid C O M P U T E R S E C
Implementation of Elliptic Curve Digital Signature Algorithm
Implementation of Elliptic Curve Digital Signature Algorithm Aqeel Khalique Kuldip Singh Sandeep Sood Department of Electronics & Computer Engineering, Indian Institute of Technology Roorkee Roorkee, India
ARCHIVED PUBLICATION
ARCHIVED PUBLICATION The attached publication, FIPS Publication 186-3 (dated June 2009), was superseded on July 19, 2013 and is provided here only for historical purposes. For the most current revision
Digital Signature Standard (DSS)
FIPS PUB 186-4 FEDERAL INFORMATION PROCESSING STANDARDS PUBLICATION Digital Signature Standard (DSS) CATEGORY: COMPUTER SECURITY SUBCATEGORY: CRYPTOGRAPHY Information Technology Laboratory National Institute
Cryptography and Network Security Chapter 10
Cryptography and Network Security Chapter 10 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 10 Other Public Key Cryptosystems Amongst the tribes of Central
Cryptography and Network Security
Cryptography and Network Security Fifth Edition by William Stallings Chapter 9 Public Key Cryptography and RSA Private-Key Cryptography traditional private/secret/single key cryptography uses one key shared
Outline. Computer Science 418. Digital Signatures: Observations. Digital Signatures: Definition. Definition 1 (Digital signature) Digital Signatures
Outline Computer Science 418 Digital Signatures Mike Jacobson Department of Computer Science University of Calgary Week 12 1 Digital Signatures 2 Signatures via Public Key Cryptosystems 3 Provable 4 Mike
Digital Signatures. Meka N.L.Sneha. Indiana State University. nmeka@sycamores.indstate.edu. October 2015
Digital Signatures Meka N.L.Sneha Indiana State University nmeka@sycamores.indstate.edu October 2015 1 Introduction Digital Signatures are the most trusted way to get documents signed online. A digital
A New Generic Digital Signature Algorithm
Groups Complex. Cryptol.? (????), 1 16 DOI 10.1515/GCC.????.??? de Gruyter???? A New Generic Digital Signature Algorithm Jennifer Seberry, Vinhbuu To and Dongvu Tonien Abstract. In this paper, we study
A blind digital signature scheme using elliptic curve digital signature algorithm
A blind digital signature scheme using elliptic curve digital signature algorithm İsmail BÜTÜN * and Mehmet DEMİRER *Department of Electrical Engineering, University of South Florida, Tampa, FL, USA Department
A Survey of the Elliptic Curve Integrated Encryption Scheme
JOURNAL OF COMPUTER SCIENCE AND ENGINEERING, VOLUME, ISSUE, AUGUST 010 A Survey of the Elliptic Curve Integrated Encryption Scheme 7 V. Gayoso Martínez, L. Hernández Encinas, and C. Sánchez Ávila Abstract
I N F O R M A T I O N S E C U R I T Y
NIST Special Publication 800-78-3 DRAFT Cryptographic Algorithms and Key Sizes for Personal Identity Verification W. Timothy Polk Donna F. Dodson William E. Burr Hildegard Ferraiolo David Cooper I N F
National Security Agency Perspective on Key Management
National Security Agency Perspective on Key Management IEEE Key Management Summit 5 May 2010 Petrina Gillman Information Assurance (IA) Infrastructure Development & Operations Technical Director National
A Security Flaw in the X.509 Standard Santosh Chokhani CygnaCom Solutions, Inc. Abstract
A Security Flaw in the X509 Standard Santosh Chokhani CygnaCom Solutions, Inc Abstract The CCITT X509 standard for public key certificates is used to for public key management, including distributing them
SECURITY IMPROVMENTS TO THE DIFFIE-HELLMAN SCHEMES
www.arpapress.com/volumes/vol8issue1/ijrras_8_1_10.pdf SECURITY IMPROVMENTS TO THE DIFFIE-HELLMAN SCHEMES Malek Jakob Kakish Amman Arab University, Department of Computer Information Systems, P.O.Box 2234,
1720 - Forward Secrecy: How to Secure SSL from Attacks by Government Agencies
1720 - Forward Secrecy: How to Secure SSL from Attacks by Government Agencies Dave Corbett Technical Product Manager Implementing Forward Secrecy 1 Agenda Part 1: Introduction Why is Forward Secrecy important?
A Java implementation of the Elliptic Curve Integrated Encryption Scheme
A Java implementation of the Elliptic Curve Integrated Encryption Scheme V. Gayoso Martínez 1, L. Hernández Encinas 1, and C. Sánchez Ávila 2 1 Department of Information Processing and Coding Institute
Software Implementation of Gong-Harn Public-key Cryptosystem and Analysis
Software Implementation of Gong-Harn Public-key Cryptosystem and Analysis by Susana Sin A thesis presented to the University of Waterloo in fulfilment of the thesis requirement for the degree of Master
NEW DIGITAL SIGNATURE PROTOCOL BASED ON ELLIPTIC CURVES
NEW DIGITAL SIGNATURE PROTOCOL BASED ON ELLIPTIC CURVES Ounasser Abid 1, Jaouad Ettanfouhi 2 and Omar Khadir 3 1,2,3 Laboratory of Mathematics, Cryptography and Mechanics, Department of Mathematics, Fstm,
Signature Schemes. CSG 252 Fall 2006. Riccardo Pucella
Signature Schemes CSG 252 Fall 2006 Riccardo Pucella Signatures Signatures in real life have a number of properties They specify the person responsible for a document E.g. that it has been produced by
Internet Engineering Task Force (IETF) Request for Comments: 5758. EMC D. Brown Certicom Corp. T. Polk NIST. January 2010
Internet Engineering Task Force (IETF) Request for Comments: 5758 Updates: 3279 Category: Standards Track ISSN: 2070-1721 Q. Dang NIST S. Santesson 3xA Security K. Moriarty EMC D. Brown Certicom Corp.
International Journal of Information Technology, Modeling and Computing (IJITMC) Vol.1, No.3,August 2013
FACTORING CRYPTOSYSTEM MODULI WHEN THE CO-FACTORS DIFFERENCE IS BOUNDED Omar Akchiche 1 and Omar Khadir 2 1,2 Laboratory of Mathematics, Cryptography and Mechanics, Fstm, University of Hassan II Mohammedia-Casablanca,
Blinding Self-Certified Key Issuing Protocols Using Elliptic Curves
Blinding Self-Certified Key Issuing Protocols Using Elliptic Curves Billy Bob Brumley Helsinki University of Technology Laboratory for Theoretical Computer Science billy.brumley@hut.fi Abstract Self-Certified
Cryptographic Algorithms and Key Size Issues. Çetin Kaya Koç Oregon State University, Professor http://islab.oregonstate.edu/koc koc@ece.orst.
Cryptographic Algorithms and Key Size Issues Çetin Kaya Koç Oregon State University, Professor http://islab.oregonstate.edu/koc koc@ece.orst.edu Overview Cryptanalysis Challenge Encryption: DES AES Message
Certicom Security for Government Suppliers developing client-side products to meet the US Government FIPS 140-2 security requirement
certicom application notes Certicom Security for Government Suppliers developing client-side products to meet the US Government FIPS 140-2 security requirement THE PROBLEM How can vendors take advantage
Implementing Network Security Protocols
Implementing Network Security Protocols based on Elliptic Curve Cryptography M. Aydos, E. Savaş, and Ç. K. Koç Electrical & Computer Engineering Oregon State University Corvallis, Oregon 97331, USA {aydos,savas,koc}@ece.orst.edu
An Efficient and Secure Key Management Scheme for Hierarchical Access Control Based on ECC
An Efficient and Secure Key Management Scheme for Hierarchical Access Control Based on ECC Laxminath Tripathy 1 Nayan Ranjan Paul 2 1Department of Information technology, Eastern Academy of Science and
IMPLEMENTATION AND PERFORMANCE ANALYSIS OF ELLIPTIC CURVE DIGITAL SIGNATURE ALGORITHM
NABI ET AL: IMPLEMENTATION AND PERFORMANCE ANALYSIS OF ELLIPTIC CURVE DIGITAL SIGNATURE ALGORITHM 28 IMPLEMENTATION AND PERFORMANCE ANALYSIS OF ELLIPTIC CURVE DIGITAL SIGNATURE ALGORITHM Mohammad Noor
FIPS 202 on the CSRC FIPS publications page: http://csrc.nist.gov/publications/pubsfips.html#202
The attached DRAFT FIPS 202 document (provided here for historical purposes) has been superseded by the following publication: Publication Number: FIPS 202 Title: SHA-3 Standard: Permutation-Based Hash
Performance Investigations. Hannes Tschofenig, Manuel Pégourié-Gonnard 25 th March 2015
Performance Investigations Hannes Tschofenig, Manuel Pégourié-Gonnard 25 th March 2015 1 Motivation In we tried to provide guidance for the use of DTLS (TLS) when used in
C O M P U T E R S E C U R I T Y
NIST Special Publication 800-56C Recommendation for Key Derivation through Extraction-then-Expansion Lily Chen Computer Security Division Information Technology Laboratory C O M P U T E R S E C U R I T
CMSS An Improved Merkle Signature Scheme
CMSS An Improved Merkle Signature Scheme Johannes Buchmann 1, Luis Carlos Coronado García 2, Erik Dahmen 1, Martin Döring 1, and Elena Klintsevich 1 1 Technische Universität Darmstadt Department of Computer
I N F O R M A T I O N S E C U R I T Y
NIST Special Publication 800-78-2 DRAFT Cryptographic Algorithms and Key Sizes for Personal Identity Verification W. Timothy Polk Donna F. Dodson William. E. Burr I N F O R M A T I O N S E C U R I T Y
Randomized Hashing for Digital Signatures
NIST Special Publication 800-106 Randomized Hashing for Digital Signatures Quynh Dang Computer Security Division Information Technology Laboratory C O M P U T E R S E C U R I T Y February 2009 U.S. Department
Implementing ECC with Java Standard Edition 7
Implementing ECC with Java Standard Edition 7 V. Gayoso Martínez 1 and L. Hernández Encinas 2 1,2 Information Security Institute (ISI), Spanish National Research Council (CSIC), Madrid, Spain 1 victor.gayoso@iec.csic.es;
Communications security
University of Roma Sapienza DIET Communications security Lecturer: Andrea Baiocchi DIET - University of Roma La Sapienza E-mail: andrea.baiocchi@uniroma1.it URL: http://net.infocom.uniroma1.it/corsi/index.htm
ETSI TS 102 176-1 V2.0.0 (2007-11) Technical Specification
TS 102 176-1 V2.0.0 (2007-11) Technical Specification Electronic Signatures and Infrastructures (ESI); Algorithms and Parameters for Secure Electronic Signatures; Part 1: Hash functions and asymmetric
Algorithms and Parameters for Secure Electronic Signatures V.1.44 DRAFT May 4 th., 2001
Title: Algorithms and Parameters for Secure Electronic Signatures Source: This document is the outcome of the work of the Algorithms group (ALGO) working under the umbrella of - SG (European Electronic
Implementation and Comparison of Various Digital Signature Algorithms. -Nazia Sarang Boise State University
Implementation and Comparison of Various Digital Signature Algorithms -Nazia Sarang Boise State University What is a Digital Signature? A digital signature is used as a tool to authenticate the information
A SOFTWARE COMPARISON OF RSA AND ECC
International Journal Of Computer Science And Applications Vol. 2, No. 1, April / May 29 ISSN: 974-13 A SOFTWARE COMPARISON OF RSA AND ECC Vivek B. Kute Lecturer. CSE Department, SVPCET, Nagpur 9975549138
Computer Security: Principles and Practice
Computer Security: Principles and Practice Chapter 20 Public-Key Cryptography and Message Authentication First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Public-Key Cryptography
Digital Signature. Raj Jain. Washington University in St. Louis
Digital Signature Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-11/
Efficient and Robust Secure Aggregation of Encrypted Data in Wireless Sensor Networks
Efficient and Robust Secure Aggregation of Encrypted Data in Wireless Sensor Networks J. M. BAHI, C. GUYEUX, and A. MAKHOUL Computer Science Laboratory LIFC University of Franche-Comté Journée thématique
Public Key Cryptography. Performance Comparison and Benchmarking
Public Key Cryptography Performance Comparison and Benchmarking Tanja Lange Department of Mathematics Technical University of Denmark tanja@hyperelliptic.org 28.08.2006 Tanja Lange Benchmarking p. 1 What
Constructing Pairing-Friendly Elliptic Curves with Embedding Degree 10
with Embedding Degree 10 University of California, Berkeley, USA ANTS-VII, 2006 Outline 1 Introduction 2 The CM Method: The Basic Construction The CM Method: Generating Families of Curves 3 Outline 1 Introduction
Performance Comparison of Elliptic Curve and RSA Digital Signatures
Performance Comparison of Elliptic Curve and RSA Digital Signatures Nicholas Jansma [njansma@engin.umich.edu] Brandon Arrendondo [barrendo@engin.umich.edu] April 28, 2004 Abstract. This paper compares
The Mathematics of the RSA Public-Key Cryptosystem
The Mathematics of the RSA Public-Key Cryptosystem Burt Kaliski RSA Laboratories ABOUT THE AUTHOR: Dr Burt Kaliski is a computer scientist whose involvement with the security industry has been through
An Approach to Shorten Digital Signature Length
Computer Science Journal of Moldova, vol.14, no.342, 2006 An Approach to Shorten Digital Signature Length Nikolay A. Moldovyan Abstract A new method is proposed to design short signature schemes based
Notes on Network Security Prof. Hemant K. Soni
Chapter 9 Public Key Cryptography and RSA Private-Key Cryptography traditional private/secret/single key cryptography uses one key shared by both sender and receiver if this key is disclosed communications
Lecture 9: Application of Cryptography
Lecture topics Cryptography basics Using SSL to secure communication links in J2EE programs Programmatic use of cryptography in Java Cryptography basics Encryption Transformation of data into a form that
Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths
NIST Special Publication 800-131A Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths Elaine Barker and Allen Roginsky Computer Security Division Information
Quantum Computing Lecture 7. Quantum Factoring. Anuj Dawar
Quantum Computing Lecture 7 Quantum Factoring Anuj Dawar Quantum Factoring A polynomial time quantum algorithm for factoring numbers was published by Peter Shor in 1994. polynomial time here means that
TYPES Workshop, 12-13 june 2006 p. 1/22. The Elliptic Curve Factorization method
Ä ÙÖ ÒØ ÓÙ Ð ÙÖ ÒØ ÓÑ Ø ºÒ Ø TYPES Workshop, 12-13 june 2006 p. 1/22 ÄÇÊÁ ÍÒ Ú Ö Ø À ÒÖ ÈÓ Ò Ö Æ ÒÝÁ. The Elliptic Curve Factorization method Outline 1. Introduction 2. Factorization method principle 3.
Network Security. Chapter 2 Basics 2.2 Public Key Cryptography. Public Key Cryptography. Public Key Cryptography
Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle Encryption/Decryption using Public Key Cryptography Network Security Chapter 2 Basics 2.2 Public Key Cryptography
ALGEBRAIC APPROACH TO COMPOSITE INTEGER FACTORIZATION
ALGEBRAIC APPROACH TO COMPOSITE INTEGER FACTORIZATION Aldrin W. Wanambisi 1* School of Pure and Applied Science, Mount Kenya University, P.O box 553-50100, Kakamega, Kenya. Shem Aywa 2 Department of Mathematics,
ECE 842 Report Implementation of Elliptic Curve Cryptography
ECE 842 Report Implementation of Elliptic Curve Cryptography Wei-Yang Lin December 15, 2004 Abstract The aim of this report is to illustrate the issues in implementing a practical elliptic curve cryptographic
White Paper. Enhancing Website Security with Algorithm Agility
ENHANCING WEBSITE SECURITY WITH ALGORITHM AGILITY White Paper Enhancing Website Security with Algorithm Agility Enhancing Website Security with Algorithm Agility Contents Introduction 3 Encryption Today
EXAM questions for the course TTM4135 - Information Security May 2013. Part 1
EXAM questions for the course TTM4135 - Information Security May 2013 Part 1 This part consists of 5 questions all from one common topic. The number of maximal points for every correctly answered question
Elliptic Curve Cryptography Methods Debbie Roser Math\CS 4890
Elliptic Curve Cryptography Methods Debbie Roser Math\CS 4890 Why are Elliptic Curves used in Cryptography? The answer to this question is the following: 1) Elliptic Curves provide security equivalent
Network Security. Chapter 6 Random Number Generation
Network Security Chapter 6 Random Number Generation 1 Tasks of Key Management (1)! Generation:! It is crucial to security, that keys are generated with a truly random or at least a pseudo-random generation
COMPARISON AND EVALUATION OF DIGITAL SIGNATURE SCHEMES EMPLOYED IN NDN NETWORK
COMPARISON AND EVALUATION OF DIGITAL SIGNATURE SCHEMES EMPLOYED IN NDN NETWORK Al Imem Ali 1 1 PRINCE ISITC, H. Sousse University of Sousse, 4011 Hammam Sousse, Tunisia ABSTRACT It is well known that Named
An Overview of Integer Factoring Algorithms. The Problem
An Overview of Integer Factoring Algorithms Manindra Agrawal IITK / NUS The Problem Given an integer n, find all its prime divisors as efficiently as possible. 1 A Difficult Problem No efficient algorithm
Network Security Services (NSS) Cryptographic Module Version 3.12.4
Network Security Services () Cryptographic Module Version 3.12.4 FIPS 140-2 Security Policy Level 1 Validation Wind River Systems, Inc. Version 1.2 Last Update: 2010-12-13 Table of Contents 1 Introduction...
RSA Question 2. Bob thinks that p and q are primes but p isn t. Then, Bob thinks Φ Bob :=(p-1)(q-1) = φ(n). Is this true?
RSA Question 2 Bob thinks that p and q are primes but p isn t. Then, Bob thinks Φ Bob :=(p-1)(q-1) = φ(n). Is this true? Bob chooses a random e (1 < e < Φ Bob ) such that gcd(e,φ Bob )=1. Then, d = e -1
Embedding more security in digital signature system by using combination of public key cryptography and secret sharing scheme
International Journal of Computer Sciences and Engineering Open Access Research Paper Volume-4, Issue-3 E-ISSN: 2347-2693 Embedding more security in digital signature system by using combination of public
Public-Key Infrastructure
Public-Key Infrastructure Technology and Concepts Abstract This paper is intended to help explain general PKI technology and concepts. For the sake of orientation, it also touches on policies and standards
Public Key Cryptography. c Eli Biham - March 30, 2011 258 Public Key Cryptography
Public Key Cryptography c Eli Biham - March 30, 2011 258 Public Key Cryptography Key Exchange All the ciphers mentioned previously require keys known a-priori to all the users, before they can encrypt
A New Efficient Digital Signature Scheme Algorithm based on Block cipher
IOSR Journal of Computer Engineering (IOSRJCE) ISSN: 2278-0661, ISBN: 2278-8727Volume 7, Issue 1 (Nov. - Dec. 2012), PP 47-52 A New Efficient Digital Signature Scheme Algorithm based on Block cipher 1
Final Exam. IT 4823 Information Security Administration. Rescheduling Final Exams. Kerberos. Idea. Ticket
IT 4823 Information Security Administration Public Key Encryption Revisited April 5 Notice: This session is being recorded. Lecture slides prepared by Dr Lawrie Brown for Computer Security: Principles
CUNSHENG DING HKUST, Hong Kong. Computer Security. Computer Security. Cunsheng DING, HKUST COMP4631
Cunsheng DING, HKUST Lecture 08: Key Management for One-key Ciphers Topics of this Lecture 1. The generation and distribution of secret keys. 2. A key distribution protocol with a key distribution center.
2. Cryptography 2.4 Digital Signatures
DI-FCT-UNL Computer and Network Systems Security Segurança de Sistemas e Redes de Computadores 2010-2011 2. Cryptography 2.4 Digital Signatures 2010, Henrique J. Domingos, DI/FCT/UNL 2.4 Digital Signatures
Overview of Public-Key Cryptography
CS 361S Overview of Public-Key Cryptography Vitaly Shmatikov slide 1 Reading Assignment Kaufman 6.1-6 slide 2 Public-Key Cryptography public key public key? private key Alice Bob Given: Everybody knows
Digital Signatures. (Note that authentication of sender is also achieved by MACs.) Scan your handwritten signature and append it to the document?
Cryptography Digital Signatures Professor: Marius Zimand Digital signatures are meant to realize authentication of the sender nonrepudiation (Note that authentication of sender is also achieved by MACs.)
OFFICE OF THE CONTROLLER OF CERTIFICATION AUTHORITIES TECHNICAL REQUIREMENTS FOR AUDIT OF CERTIFICATION AUTHORITIES
OFFICE OF THE CONTROLLER OF CERTIFICATION AUTHORITIES TECHNICAL REQUIREMENTS FOR AUDIT OF CERTIFICATION AUTHORITIES Table of contents 1.0 SOFTWARE 1 2.0 HARDWARE 2 3.0 TECHNICAL COMPONENTS 2 3.1 KEY MANAGEMENT
U.C. Berkeley CS276: Cryptography Handout 0.1 Luca Trevisan January, 2009. Notes on Algebra
U.C. Berkeley CS276: Cryptography Handout 0.1 Luca Trevisan January, 2009 Notes on Algebra These notes contain as little theory as possible, and most results are stated without proof. Any introductory
Review of methods for secret sharing in cloud computing
Review of methods for secret sharing in cloud computing Dnyaneshwar Supe Amit Srivastav Dr. Rajesh S. Prasad Abstract:- Cloud computing provides various IT services. Many companies especially those who
Outline. Performance comparisons of elliptic curve systems in software. Goals. 1. Elliptic curve digital signature algorithm (ECDSA)
Performance comparisons of elliptic curve systems in software Outline 1. Operations in ECDSA. Kenny Fong Darrel Hankerson Julio López Alfred Menezes Matt Tucker October 2001 University of Waterloo Auburn
Secure Network Communication Part II II Public Key Cryptography. Public Key Cryptography
Kommunikationssysteme (KSy) - Block 8 Secure Network Communication Part II II Public Key Cryptography Dr. Andreas Steffen 2000-2001 A. Steffen, 28.03.2001, KSy_RSA.ppt 1 Secure Key Distribution Problem
OFFICIAL SECURITY CHARACTERISTIC MOBILE DEVICE MANAGEMENT
SECURITY CHARACTERISTIC MOBILE DEVICE MANAGEMENT Version 1.3 Crown Copyright 2015 All Rights Reserved 49358431 Page 1 of 12 About this document This document describes the features, testing and deployment
Elliptic Curve Hash (and Sign)
Elliptic Curve Hash (and Sign) (and the 1-up problem for ECDSA) Daniel R. L. Brown Certicom Research ECC 2008, Utrecht, Sep 22-24 2008 Dan Brown (Certicom) Elliptic Curve Hash (and Sign) ECC 2008 1 / 43
NISTIR 7676 Maintaining and Using Key History on Personal Identity Verification (PIV) Cards
NISTIR 7676 Maintaining and Using Key History on Personal Identity Verification (PIV) Cards David A. Cooper NISTIR 7676 Maintaining and Using Key History on Personal Identity Verification (PIV) Cards David
Elements of Applied Cryptography Public key encryption
Network Security Elements of Applied Cryptography Public key encryption Public key cryptosystem RSA and the factorization problem RSA in practice Other asymmetric ciphers Asymmetric Encryption Scheme Let
Study of algorithms for factoring integers and computing discrete logarithms
Study of algorithms for factoring integers and computing discrete logarithms First Indo-French Workshop on Cryptography and Related Topics (IFW 2007) June 11 13, 2007 Paris, France Dr. Abhijit Das Department
THE ADVANTAGES OF ELLIPTIC CURVE CRYPTOGRAPHY FOR WIRELESS SECURITY KRISTIN LAUTER, MICROSOFT CORPORATION
T OPICS IN WIRELESS SECURITY THE ADVANTAGES OF ELLIPTIC CURVE CRYPTOGRAPHY FOR WIRELESS SECURITY KRISTIN LAUTER, MICROSOFT CORPORATION Q 2 = R 1 Q 2 R 1 R 1 As the wireless industry explodes, it faces
A NOVEL STRATEGY TO PROVIDE SECURE CHANNEL OVER WIRELESS TO WIRE COMMUNICATION
A NOVEL STRATEGY TO PROVIDE SECURE CHANNEL OVER WIRELESS TO WIRE COMMUNICATION Prof. Dr. Alaa Hussain Al- Hamami, Amman Arab University for Graduate Studies Alaa_hamami@yahoo.com Dr. Mohammad Alaa Al-
Authentication requirement Authentication function MAC Hash function Security of
UNIT 3 AUTHENTICATION Authentication requirement Authentication function MAC Hash function Security of hash function and MAC SHA HMAC CMAC Digital signature and authentication protocols DSS Slides Courtesy
Cryptography and Network Security. Prof. D. Mukhopadhyay. Department of Computer Science and Engineering. Indian Institute of Technology, Kharagpur
Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Module No. # 01 Lecture No. # 12 Block Cipher Standards
CRYPTOGRAPHY AND NETWORK SECURITY
CRYPTOGRAPHY AND NETWORK SECURITY PRINCIPLES AND PRACTICE SIXTH EDITION William Stallings International Edition contributions by Mohit P Tahiliani NITK Surathkal PEARSON Boston Columbus Indianapolis New
Short Programs for functions on Curves
Short Programs for functions on Curves Victor S. Miller Exploratory Computer Science IBM, Thomas J. Watson Research Center Yorktown Heights, NY 10598 May 6, 1986 Abstract The problem of deducing a function
Suite B Implementer s Guide to NIST SP 800-56A July 28, 2009
1. Introduction Suite B Implementer s Guide to NIST SP 800-56A July 28, 2009 This document specifies the Elliptic Curve Diffie-Hellman (ECDH) key-agreement schemes from NIST SP 800-56A: Recommendation
Breaking The Code. Ryan Lowe. Ryan Lowe is currently a Ball State senior with a double major in Computer Science and Mathematics and
Breaking The Code Ryan Lowe Ryan Lowe is currently a Ball State senior with a double major in Computer Science and Mathematics and a minor in Applied Physics. As a sophomore, he took an independent study
Archived NIST Technical Series Publication
Archived NIST Technical Series Publication The attached publication has been archived (withdrawn), and is provided solely for historical purposes. It may have been superseded by another publication (indicated
Public Key Cryptography Overview
Ch.20 Public-Key Cryptography and Message Authentication I will talk about it later in this class Final: Wen (5/13) 1630-1830 HOLM 248» give you a sample exam» Mostly similar to homeworks» no electronic
Factoring Algorithms
Institutionen för Informationsteknologi Lunds Tekniska Högskola Department of Information Technology Lund University Cryptology - Project 1 Factoring Algorithms The purpose of this project is to understand
The Quadratic Sieve Factoring Algorithm
The Quadratic Sieve Factoring Algorithm Eric Landquist MATH 488: Cryptographic Algorithms December 14, 2001 1 Introduction Mathematicians have been attempting to find better and faster ways to factor composite
Lecture Note 5 PUBLIC-KEY CRYPTOGRAPHY. Sourav Mukhopadhyay
Lecture Note 5 PUBLIC-KEY CRYPTOGRAPHY Sourav Mukhopadhyay Cryptography and Network Security - MA61027 Modern/Public-key cryptography started in 1976 with the publication of the following paper. W. Diffie
SP 800-130 A Framework for Designing Cryptographic Key Management Systems. 5/25/2012 Lunch and Learn Scott Shorter
SP 800-130 A Framework for Designing Cryptographic Key Management Systems 5/25/2012 Lunch and Learn Scott Shorter Topics Follows the Sections of SP 800-130 draft 2: Introduction Framework Basics Goals
Factoring Polynomials
Factoring Polynomials Factoring Factoring is the process of writing a polynomial as the product of two or more polynomials. The factors of 6x 2 x 2 are 2x + 1 and 3x 2. In this section, we will be factoring
CSI 333 Lecture 1 Number Systems
CSI 333 Lecture 1 Number Systems 1 1 / 23 Basics of Number Systems Ref: Appendix C of Deitel & Deitel. Weighted Positional Notation: 192 = 2 10 0 + 9 10 1 + 1 10 2 General: Digit sequence : d n 1 d n 2...