Explanation of each of the parameters used in ECC

Question

I'm having a very difficult time finding a clear explanation of the parameters used elliptic curve cryptography. I know for certain that $p$ is the number or order or whatever of the given field that a particular curve uses. I know that $k$ is what is used as the secret key and that $Q=(Q_x,Q_y)$ is the public key. But playing around on these two pages and seeing the contents of this file have left me more confused. What is the importance of $P$ and how does it differ from $Q$? Do $a$ and $b$ change depending on the key in question or are they held constant for a curve? What is the function of $n$? It always seems to be slightly less in value than $p$. How do $G$, the order of the curve, and the seed fit in?

Finally, how is a number encrypted? Is it done by multiplying $Q$? And how can I extract the coordinates of Q from its "compact" form used in certficates?

Answer 1

I know that k is what is used as the secret key and that $Q=(Q_x,Q_y)$ is the public key. But playing around on these two pages and seeing the contents of this file have letft me more confused. What is the importance of $P$ and how does it differ from $Q$?

Don't get too caught up with variable names. People usually use $P$ and $Q$ to represent points in general. There's really no notation that says $Q$ is always the public key.

The contents of that github file are parameters for Dual EC DRBG, which uses two points $P$ and $Q$, which are related. They're not public keys (atleast in the typical sense).

Do a and b change depending on the key in question or are they held constant for a curve?

No. $a$, $b$, and $p$ define the curve and do not change.

What is the function of n? It always seems to be slightly less in value than p. How do G, the order of the curve, and the seed fit in?

$n$ is the order of the point $G$. Simply put, it's the number of possible points you can generate through multiplication of $G$.

The private key $k$ is $1 \lt k \lt n$. If $k \geq n$ then it's effectively $k \mod n$. So another way to look at $n$ is the number of possible private keys. That's why when we generate curve parameters we want good parameters that give us a large $n$.

The seed is simply the seed for the random number generate that generated the parameters. This is used to show that the numbers were actually generated randomly.

Finally, how is a number encrypted? Is it done by multiplying Q?

ECC isn't like RSA where you can encrypt a number directly. For encrypting with ECC you basically do half a key exchange by generating a shared secret using the sender's private key and the recipients public key. The sender encrypts the message using this shared secret. The recipient can reconstruct the shared secret key using their private key and the sender's public key, and can decrypt the message.

One common method is ECIES.

And how can I extract the coordinates of Q from its "compact" form used in certficates?

A coordinate in compressed form will be the $X$ value, a value indicating whether to use the positive or negative $Y$ value. You just need to plug the $X$ value into the equation $Y = \sqrt{x^{3} + ax + b}$. There are algorithms to compute square roots $\mod p$.

Answer 2

This web page use unusual variable names, which do not match the names you are used to see in other documents

in the calculator the curve equation is (Y^2 == X^3 + AX + B) mod p

(many documents use a and b in lowercase)

in the calculator n is any number

(many documents use k, while n is usually the reserved name for the order of a point G chosen as group generator)

in the calculator, if you click on nP, the calculator will calculate the addition P + P + P... + P n times, which is the multiplication of the point P by the integer scalar n (this is the ECC point multiplication)

( many documents use the notation [k]P )

if you click on P+Q, the calculator will calculate the addition P + Q following the rules that define the addition of points over an elliptic curve.

(many documents use the notation R = P + Q to design the simple addition of points (Rx,Ry) = (Px, Py) + (Qx, Qy) ). here, R and P and Q are any names, not names of reserved points for any usage.

You might find the calculator usage misleading, because it re-computes one of the curve parameters based on the points (x,y) you provide b = y^2 - x^3 - a^x . The normal usage is to fix the curve, and ensure the point (x,y) is on the curve by verifying the curve equation.

a,b,p,G,n,h are named domain parameters : a,b,p define a curve (y^2 == x^3+a^x +b) mod p G is a point of order n and by definition [n]G = Point_at_infinity h is often 1 (ratio between the number of points on the curve and the number n, prime)

ECC is not generally used for encryption, but rather for key exchange ( http://en.wikipedia.org/wiki/Elliptic_curve_Diffie%E2%80%93Hellman ) and signatures ( http://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm ) . Look at the wiki pages about the public keys pairs (private, public) used for ECDH and ECDSA. A private key is a big integer d, and a public key is the result of the ECC point multiplication [d]G .

if you really want to encrypt using elliptic curves, this is already answered ElGamal with elliptic curves

I am not sure about the last question ? The "compact" form of a point is the encoding of the x coordinate , knowing that y = +/- sqrt(x^3 + ax^2 +b) % p can be recomputed from the x coordinate and a indication about which of y and p-y is the right solution. Modular square root can be computed using Shanks Tonelli algorithm ( http://en.wikipedia.org/wiki/Tonelli%E2%80%93Shanks_algorithm ).

Your link to ECDRBG is a link to a bit generator which implementation is considered by the community as unsecure.