Selecting Secure Curves

Cryptography · Axiom Academy

LESSON Selecting Secure Curves Learn how to choose elliptic curves for cryptographic applications with confidence and understanding of security tradeoffs The National Institute of Standards and Technology (NIST) standardized several elliptic curves in the late 1990s. These curves are widely implemented but come with controversy. P-256 (secp256r1): 128-bit security, most common P-384 (secp384r1): 192-bit security, high security P-521 (secp521r1): 256-bit security, maximum security These curves use the Weierstrass form and provide proven security levels. However, they face two major criticisms: 2. Modern Alternatives: Curve25519 & Ed25519 Daniel J. Bernstein designed Curve25519 in 2005 with explicit security and performance goals. It has become the preferred choice for new cryptographic systems. Montgomery curve: y² = x³ + 486662x² + x 128-bit security level (comparable to P-256) Designed for efficient, constant-time implementation Used in Signal, WhatsApp, SSH, TLS 1.3 Twisted Edwards form of Curve25519 Optimized for digital signatures (not key exchange) Deterministic signatures (no random number needed) Used in: OpenSSH, GnuPG, Tor, cryptocurrencies When Satoshi Nakamoto designed Bitcoin, they chose secp256k1, a curve that was standardized but rarely used at the time. This choice has proven both fortunate and interesting. Koblitz curve with special mathematical structure Prime: 2²⁵⁶ - 2³² - 977 (clean, simple) Cofactor = 1 (prime order group)

This is the written version of the interactive lesson above. See the full Cryptography course.