9

I am a bit confused with different notations of elliptic curves. Specifically, I am comparing the NIST specification with the SECG specification.

More specifically I want to know if the NIST curve $Curve P-384$ (NIST D.1.2.4) corresponds to $secp384r1$ specified in SECG (2.5.1).

I found a related question here on crypto.SE where it is said that these are the same curves and its just different notation.

This would mean:

  • Curve-P 384 = secp384r1
  • Curve-P-256 = secp256r1
  • ...

However, I compared the curve parameters mentioned in both documents and found that there are deviations.

  • Equation: $a$ is fixed in the NIST case
    • NIST defines the curve as: $ E: y^{2} \equiv x^{3} - 3x + b (\mod p)$
    • SECG defines the curve as: $ E: y^{2} \equiv x^3 + a.x + b (\mod p)$
  • Basepoint G
    • NIST defines the basepoint as:
      • $G_{x}$ = aa87ca22 be8b0537 8eb1c71e f320ad74 6e1d3b62 8ba79b98 59f741e0 82542a38 5502f25d bf55296c 3a545e38 72760ab7
      • $G_{y}$ = 3617de4a 96262c6f 5d9e98bf 9292dc29 f8f41dbd 289a147c e9da3113 b5f0b8c0 0a60b1ce 1d7e819d 7a431d7c 90ea0e5f
    • SEC defines the basepoint as:
      • $G$ = 04 aa87ca22 be8b0537 8eb1c71e f320ad74 6e1d3b62 8ba79b98 59f741e0 82542a38 5502f25d bf55296c 3a545e38 72760ab7 3617de4a 96262c6f 5d9e98bf 9292dc29 f8f41dbd 289a147c e9da3113 b5f0b8c0 0a60b1ce 1d7e819d 7a431d7c 90ea0e5f
      • which is the NIST versions $G_{x}$, $G_{y}$ concatenated and preceded by 04

I am not an expert on the math behind ECC, so I need help assessing if the mentioned deviations of the two specification mean that they are not equal and if so, what are the differences and why are they different?

Thanks!

grees
  • 391
  • 1
  • 3
  • 10

1 Answers1

6

Yes, they refer to the same curve. I'm not sure why the equations' different, but I believe that's just a transcription error. The 04 in basepoint is just standard way to encode a point in SECG #1.

EDIT: (Answer extracted from the comments)

In the SECG case:

a = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFFFF 00000000 00000000 FFFFFFFC

and

p = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFFFF 00000000 00000000 FFFFFFFF

so $a = (p-3) \bmod p$

the Nist version does $x^3 - 3x + b \mod p$, whereas the SECG version does $x^3 + (p-3)x + b \mod p$. Subtracting $3x$ or adding $(p-3)x$ is equal $\bmod p$

Geoffroy Couteau
  • 19,919
  • 2
  • 46
  • 68
DannyNiu
  • 9,207
  • 2
  • 24
  • 57
  • I don't think it is an transcription error because they actually define a value for $a$ in the specification, namely $a$ = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFFFF 00000000 00000000 FFFFFFFC – grees May 29 '19 at 09:00
  • That's p-3 in modular arithmetic, where p is FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFFFF 00000000 00000000 FFFFFFFF. – DannyNiu May 29 '19 at 09:03
  • You're right but generally thats not the same right? say p = 9, x = 5, then

    3 * 5 mod 9 is not equal to 6 * 5 mod 9

     – grees May 29 '19 at 09:08
  • I can't make sense of your last comment, as p is a parameter of the curve, so it's fixed and will never be 9. – DannyNiu May 29 '19 at 09:12
  • Okay, now I figured it out... the Nist version does $x^3 - 3x + b \mod p$, whereas the SECG version does $x^3 + (p-3) + b \mod p$. Subtracting 3x or adding (p-3) x is equal mod p... that was what I was missing – grees May 29 '19 at 09:21