1

We all know the basic equation of Elliptic Curve is $y^2 \equiv x^3 + ax + b \pmod p$

  • How the value of the constants $a$ and $b$ are chosen?
  • Suppose $\mathbb P\ni p \approx 2^{256}$ then what approach should I take while selecting the value of constants $a$ and $b$?

I have some basic knowledge of Elliptic Curve, EC Cryptography, EC discrete logarithm problem and EC diffie-hellman.
I need some experts help.

SEJPM
  • 45,967
  • 7
  • 99
  • 205
Arnab Rahman
  • 151
  • 1
  • 6
  • 1
    TL;DR: Choosing EC constants isn't trivial (compared to DH and RSA) and should be delegated to specialized software. Related question with further references: "How to generate own secure elliptic curves?" – SEJPM Oct 15 '16 at 20:48
  • I've edited your question to make the formulae fancier. I've also lower-cased $p$ like its usual and I have changed P such that its size is 256-bit instead of its value (which would be 100% insecure these days). If I changed the intention of your question an you actually wanted to ask about such small parameters, please comment or edit yourself. – SEJPM Oct 15 '16 at 20:49
  • @fkraiem: actually, just choosing $a$ and $b$ at random will, with high probability, give you a considerably weaker curve than if use constants that were well selected. A random $a, b$ would give you a random curve order, which (with high probability) will have a factorization which would make the discrete log problem considerably easier than if you picked a curve with a prime order. For example, with probability circa 1/3, the largest prime factor will be $< 2^{128}$, which would make the DLog problem solvable in $2^{64}$ time. – poncho Oct 16 '16 at 03:12
  • according to my query the value of P will be 2^8. And thanks for modifying the equation.I will consider the security issue later on.At first i need to know how to generate the equation. – Arnab Rahman Oct 16 '16 at 08:33

0 Answers0