Selecting elliptic curves for cryptography: an efficiency and security analysis

Abstract

We select a set of elliptic curves for cryptography and analyze our selection from a performance and security perspective. This analysis complements recent curve proposals that suggest (twisted) Edwards curves by also considering the Weierstrass model. Working with both Montgomery-friendly and pseudo-Mersenne primes allows us to consider more possibilities which help to improve the overall efficiency of base field arithmetic. Our Weierstrass curves are backwards compatible with current implementations of prime order NIST curves, while providing improved efficiency and stronger security properties. We choose algorithms and explicit formulas to demonstrate that our curves support constant-time, exception-free scalar multiplications, thereby offering high practical security in cryptographic applications. Our implementation shows that variable-base scalar multiplication on the new Weierstrass curves at the 128-bit security level is about 1.4 times faster than the recent implementation record on the corresponding NIST curve. For practitioners who are willing to use a different curve model and sacrifice a few bits of security, we present a collection of twisted Edwards curves with particularly efficient arithmetic that are up to 1.42, 1.26 Michael Naehrig E-mail: mnaehrig@microsoft.com and 1.24 times faster than the new Weierstrass curves at the 128-, 192-and 256-bit security levels, respectively. Finally, we discuss how these curves behave in a realworld protocol by considering different scalar multiplication scenarios in the transport layer security (TLS) protocol. The proposed curves and the results of the analysis are intended to contribute to the recent efforts towards recommending new elliptic curves for Internet standards.

Efficient and Secure Algorithms for GLV-Based Scalar Multiplication and Their Implementation on GLV-GLS Curves

“…Our algorithm is generic (i.e., it does not exploit endomorphisms) and is as efficient as Hamburg's algorithm during the on-line computation but has a slightly cheaper off-line precomputation phase. The algorithm has already been exploited in the implementation of the new elliptic curves recently proposed by Bos et al in [10] and integrated to the MSR Elliptic Curve Cryptography Library (MSR ECCLib) [37].…”

Efficient Ephemeral Elliptic Curve Cryptographic Keys

“…For the latter, the group can be embedded in the multiplicative group F × p k of F p k for a low embedding degree k. To avoid those curves, we follow the approach from [34] which ties the smallest permissible value for k to the published difficulty of finding discrete logarithms in F × p k . It would be trivial, and would have negligible effect on our performance results, to adopt the "overkill" approach favored by [9,39,13], but we see no good reason to do so.…”

“…In [1] they are complemented with their counterparts at approximate security levels 112, 192, and 256. In [13] the scope of [7] is broadened by allowing more curve parameterizations and more types of special primes, while handling exceptions more strictly. This leads to eight new twist-secure curves of (approximately) 128-bit security, in addition to eight and ten twist-secure curves at approximate security levels 192 and 256, respectively.…”

“…A variety of ECC parameters has been proposed or standardized [58,16,17,5,1,39,13,9], with or without all kinds of properties that are felt to be desirable or undesirable, and as reviewed in Section 2. All these proposals and standards contain a fixed number of possible ECC parameter choices.…”

“…Using addition where doubling should have been used may be leveraged by an attacker to learn information about the secret key [31]. Either a check must be included (while maintaining constant-time execution, as in [13]) or a "complete" addition formula must be used, i.e., one that works even if the two points are not distinct. This leads to a somewhat slower group law for our Weierstrass curve parameterizations, but if they are used along with f = 4 in Table 3 the parameterization can be converted to Edwards or Montgomery form, which are both endowed with fast complete formulae for the group law [8], [5].…”