ECC (Elliptic Curve Cryptography) is a public key cryptography based on the mathematical properties of elliptic curves, offering greater security with smaller keys.

What is ECC?

ECC uses the mathematical properties of elliptic curves over finite fields to create secure and efficient cryptographic systems.

Mathematical Fundamentals

Elliptic Curve Equation

y² = x³ + ax + b (mod p)

Where:

  • a, b: Curve parameters
  • p: Prime number (finite field)
  • x, y: Point coordinates

Properties

  • Point at infinity: Neutral element
  • Group operation: Point addition
  • Discrete Logarithm Problem: Computational difficulty
  • Generator: Point that generates the group

Standard Curves

NIST P-Curves

  • P-192: 192 bits of security
  • P-224: 224 bits of security
  • P-256: 256 bits of security ✅ Recommended
  • P-384: 384 bits of security
  • P-521: 521 bits of security

Curve25519

  • Ed25519: Digital signature
  • X25519: Key exchange
  • Security: 128 equivalent bits
  • Performance: Very efficient

Curve448

  • Ed448: Digital signature
  • X448: Key exchange
  • Security: 224 equivalent bits
  • Use: High security applications

ECC Algorithms

ECDH (Elliptic Curve Diffie-Hellman)

  • Purpose: Key exchange
  • Use: Establish shared keys
  • Security: Based on DLP
  • Efficiency: Very fast

ECDSA (Elliptic Curve Digital Signature Algorithm)

  • Purpose: Digital signatures
  • Use: Authentication and integrity
  • Security: Resistant to attacks
  • Standard: FIPS 186-4

ECIES (Elliptic Curve Integrated Encryption Scheme)

  • Purpose: Hybrid encryption
  • Use: Data encryption
  • Combination: ECC + symmetric encryption
  • Efficiency: Optimal

Implementation

Python with cryptography

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import padding

# Generate ECC key pair
private_key = ec.generate_private_key(ec.SECP256R1())
public_key = private_key.public_key()

# Sign with ECDSA
message = b"Hello, World!"
signature = private_key.sign(
    message,
    ec.ECDSA(hashes.SHA256())
)

# Verify signature
try:
    public_key.verify(
        signature,
        message,
        ec.ECDSA(hashes.SHA256())
    )
    print("Valid signature")
except:
    print("Invalid signature")

OpenSSL

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# Generate ECC private key
openssl ecparam -genkey -name prime256v1 -noout -out private.pem

# Extract public key
openssl ec -in private.pem -pubout -out public.pem

# Sign file
openssl dgst -sha256 -sign private.pem -out signature.bin file.txt

# Verify signature
openssl dgst -sha256 -verify public.pem -signature signature.bin file.txt

JavaScript (Node.js)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

const crypto = require('crypto');

// Generate ECC key pair
const { publicKey, privateKey } = crypto.generateKeyPairSync('ec', {
    namedCurve: 'prime256v1'
});

// Sign
const sign = crypto.createSign('SHA256');
sign.update('Hello, World!');
const signature = sign.sign(privateKey, 'hex');

// Verify
const verify = crypto.createVerify('SHA256');
verify.update('Hello, World!');
const isValid = verify.verify(publicKey, signature, 'hex');

Advantages over RSA

Key Size

  • ECC-256: Equivalent to RSA-3072
  • ECC-384: Equivalent to RSA-7680
  • ECC-521: Equivalent to RSA-15360
  • Efficiency: Lower memory usage

Performance

  • Generation: Faster than RSA
  • Signatures: Faster than RSA
  • Verification: Faster than RSA
  • Battery: Lower energy consumption

Security

  • Same security: With smaller keys
  • Resistance: To known attacks
  • Forward secrecy: Perfect Forward Secrecy
  • Standards: Widely standardized

Applications

Web Security

  • TLS/SSL: ECDHE handshake
  • HTTPS: ECC certificates
  • HSTS: HTTP Strict Transport Security
  • Certificate Pinning: Certificate pinning

Blockchain

  • Bitcoin: Transaction signing
  • Ethereum: Accounts and signatures
  • Coins: Cryptocurrencies
  • Smart Contracts: Smart contracts

Mobile Security

  • iOS: Touch ID, Face ID
  • Android: Fingerprint API
  • NFC: Mobile payments
  • IoT: Connected devices

Email Security

  • S/MIME: Secure email
  • PGP/GPG: Email encryption
  • DKIM: Domain authentication
  • SPF: Sender verification

For General Applications

  • P-256: NIST P-256 (prime256v1)
  • Curve25519: For key exchange
  • Ed25519: For digital signatures
  • Security: 128 equivalent bits

For High Security

  • P-384: NIST P-384 (secp384r1)
  • P-521: NIST P-521 (secp521r1)
  • Curve448: For maximum security
  • Security: 192-224 equivalent bits

For Performance

  • Curve25519: Very efficient
  • Ed25519: Fast signatures
  • X25519: Fast exchange
  • Use: High performance applications

Security

Strengths

  • Solid mathematics: Robust theoretical basis
  • Small keys: Smaller attack surface
  • Efficiency: High performance
  • Standards: Widely standardized

Considerations

  • Implementation: Critical to implement correctly
  • Random generation: Use secure generators
  • Validation: Validate curve parameters
  • Timing attacks: Protect against timing attacks

Best Practices

  • Standard curves: Use approved curves
  • Secure generation: Use cryptographic generators
  • Validation: Validate all inputs
  • Testing: Test implementations

Comparison with Other Algorithms

ECC vs RSA

  • Size: ECC uses smaller keys
  • Performance: ECC generally faster
  • Security: Both are secure
  • Adoption: ECC gaining ground

ECC vs AES

  • Purpose: ECC for keys, AES for data
  • Combined use: ECC + AES is common
  • Hybrid: Efficient hybrid systems
  • Applications: Complementary

Protocol Implementation

TLS/SSL

  • ECDHE: Key exchange
  • ECDSA: Certificate signatures
  • Cipher suites: ECC suites
  • Perfect Forward Secrecy: PFS with ECC

SSH

  • Ed25519: Host keys
  • ECDSA: Server signatures
  • X25519: Key exchange
  • Performance: Faster connections

IPsec

  • IKEv2: Key exchange
  • ESP: Packet encryption
  • AH: Packet authentication
  • VPN: Secure connections

Tools and Libraries

Python

  • cryptography: Main library
  • ecdsa: ECDSA implementation
  • pycryptodome: Complete cryptography
  • fastecdsa: Fast implementation

C/C++

  • OpenSSL: Standard library
  • libsodium: Modern library
  • mbedTLS: For embedded systems
  • Nettle: Lightweight library

JavaScript

  • Node.js crypto: Native module
  • elliptic: ECC library
  • tweetnacl: Portable implementation
  • libsodium.js: JavaScript version

References