BouncyCastle Elliptic Curve implementation

Question

I'm implementing ECDH key exchange in C# using the BouncyCastle library and I'm having a hard time understanding the elliptic curve side (FpCurve).

FpCurve curve = new FpCurve(
    new BigInteger("883423532389192164791648750360308885314476597252960362792450860609699839"), // q
    new BigInteger("7fffffffffffffffffffffff7fffffffffff8000000000007ffffffffffc", 16), // a
    new BigInteger("6b016c3bdcf18941d0d654921475ca71a9db2fb27d1d37796185c2942c0a", 16)); // b

ECDomainParameters ecSpec = new ECDomainParameters(
    curve,
    curve.DecodePoint(Hex.Decode("020ffa963cdca8816ccc33b8642bedf905c3d358573d3f27fbbd3b3cb9aaaf")), // G
    new BigInteger("883423532389192164791648750360308884807550341691627752275345424702807307"), // n
    BigInteger.One); // h

I'm wondering if this is correct, what it means and why would this be static? What are these BigInteger values?

As your question is more about programming and less about cryptography, it is off topic here. StackOverflow might be a better place for this question (they even have a bouncy castle tag). What would you think if I migrated it to SO? — mikeazo, Sep 14 '12 at 16:05
My question is honestly a little bit of both. I understand (from the demo code they provide) that these parameters are necessary for the ECDH to work and they must be the same on both ends of the exchange. My question, from a crypto standpoint is to try and understand the theory of what they are and what they do and if this is a correct implementation programatically. — hobeau, Sep 14 '12 at 17:01
If SO is a better place to migrate this to I'm fine with that. — hobeau, Sep 14 '12 at 17:02
Your first question about what the parameters are and what they do is on topic here. The correct implementation programatically part is probably not. I'll leave it here for a while and see if someone here can answer at least the first part. — mikeazo, Sep 14 '12 at 17:04
Sounds great. Yeah sorry I wasn't sure if this was the right place or not, I guess we shall see. :) — hobeau, Sep 14 '12 at 17:20
Is your question "How does an elliptic curve work", or "Why can we hardcode the curve parameters"? — Paŭlo Ebermann, Sep 14 '12 at 20:01

score 3 · Accepted Answer · edited Apr 13 '17 at 12:48

I am assuming you are throughly familiar with traditional Diffie-Hellman. If not, read up on it first.

For our purposes here, an elliptic curve is a curve whose points satisfy the equation $y^2=x^3+ax+b$. That right there tells you what $a$ and $b$ are, they are coefficients of the curve.

In elliptic curve cryptography, we need an algebraic group for a number of algorithms (such as Diffie-Hellman). For elliptic curves, we can get this by taking the curve equation above modulo a prime number (in this case the $q$ value in your code), i.e. $x$ and $y$ are elements of $\mathbb Z_q$, and the $+$ and $·$ operations are done in this field.

For diffie-hellman we need a point on the curve that can generate a very large subgroup (for more info see this question). That point is the $G$ in your code. $n$ is the order of the subgroup generated by $G$ and $h$ is the cofactor (basically it tells us how much smaller is the subgroup when compared to the original group, don't worry too much about this one).

The reason they are static is that they are public parameters. Think of regular diffie-hellman. There are typically numbers $p$ and $g$ which need to be known to both parties. $p$ describes the group we are working in $\mathbb{Z}_p^*$ (just like $q,a,b$ describe the elliptic curve group) and $g$ is the generator (as is $G$ for elliptic curves). In regular diffie-hellman $p$ and $g$ can be static in your code (otherwise the 2 parties have to agree upon the values some how).

You now know what the values are and why they can be static. So, are the values you've chosen correct? Well, where did they come from? There are a number of standard curves (for example FIPS 186-3). If I were you, I'd stick to recommended/standard curves.

BouncyCastle Elliptic Curve implementation

1 Answers1