Elliptic-curve cryptography

As explained in Software Security for Developers

Elliptic-curve cryptography is public-key cryptography based on the algebraic structure of elliptic curves over finite fields.

Elliptic-curve cryptography (ECC) is public-key cryptography built on operations involving points on elliptic curves over finite fields. It offers security comparable to RSA with much smaller keys, improving performance, bandwidth, and battery use. Its security depends on the difficulty of solving the elliptic-curve discrete-logarithm problem; the mathematics can remain an abstraction for most developers. section 7.0 section 7.1

Use ECC through established algorithms, approved curves, and security protocols:

• Choose a named, tested curve rather than inventing one. Curve25519 emphasizes speed and security; Curve448-Goldilocks offers higher security; P-256 is widely standardized; secp256k1 is associated with Bitcoin. section 7.1.1
• Use ECDH to establish shared symmetric keys across an insecure network, as modern TLS does, rather than sending the shared secret directly. section 7.5 section 10.1.1
• Use ECDSA for digital signatures that provide authenticity, integrity, and nonrepudiation. Keep signing and encryption key pairs separate. section 7.5
• Configure the same curve for communicating parties and follow current organizational guidance for curve and key-size choices. section 7.1.1 section 7.3

Encrypting a refunds file in Java

A warehouse application can encrypt refunds.json with a recipient's public key, while a payments application decrypts the resulting file with the matching private key. Java's EC key-pair APIs generate the keys; Bouncy Castle simplifies ECIES encryption and decryption. Decrypting with another private key or changing the ciphertext causes the operation to fail. section 7.2.1 section 7.2

Figure 7.1 An example elliptic curve. This curve, named Curve25519, is one of the curves most used with the ECC algorithm.

Inspect Curve25519 as a concrete elliptic-curve example before treating curve selection as a configuration decision. section 7.1

ECC is widely used in TLS, SSH, secure messaging, cloud systems, and mobile applications. It is generally preferred for new applications because a 256-bit ECC key is considered roughly comparable to a 3,072-bit RSA key. Powerful quantum computers or a fast solution to the elliptic-curve discrete-logarithm problem would eventually undermine it, so configuration and standards guidance still matter. section 7.3 section 10.5

How Software Security for Developers covers it

How deep it goes

Explains security intuition, curve selection, Java workflows, ECDH, and ECDSA while deferring mathematical equations and proofs.

Examples

Uses Curve25519, named-curve choices, TLS key agreement, and Java ECIES encryption of a refunds JSON file.

What it assumes

Assumes basic public-key cryptography while introducing elliptic-curve operations, discrete-logarithm security, named curves, ECDH, and ECDSA.

What you can do after

Apply ECC via Java security APIs, approved curves, ECIES, ECDH, ECDSA, and TLS configuration without implementing the underlying mathematics.

How it connects

Connects ECC with RSA, ECDH, ECDSA, digital signatures, symmetric-key cryptography, TLS, SSH, and X.509 certificates.

liveBookmanning.com

Read Software Security for Developers on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Real-World CryptographyElliptic curve cryptography is public-key cryptography based on the algebraic structure of elliptic curves over finite fields.
• 

  liveBookmanning.com
  Elliptic Curve Cryptography for DevelopersElliptic curve cryptography is public-key cryptography based on algebraic operations over elliptic curves.

Compare how 3 books explain elliptic-curve cryptography →

Related concepts

• elliptic curveuses · An elliptic curve is a nonsingular algebraic curve defined by a cubic equation whose points, including a point at infinity, support a group operation.
• finite fielduses · A finite field is a field containing finitely many elements, with addition, subtraction, multiplication, and division by nonzero elements defined within it.
• discrete logarithmuses · A discrete logarithm is an exponent or scalar that relates a specified group element to a base or generator under the group operation.
• RSAalternative to · RSA is a public-key cryptosystem based on the computational difficulty of factoring large composite integers and supporting encryption and digital signatures.
• ECDSAused by · ECDSA is a public-key digital signature algorithm that uses elliptic-curve arithmetic to generate and verify signatures.
• cryptographic keyproduces · A cryptographic key is a value supplied to a cryptographic algorithm to control operations such as encryption, decryption, signing, authentication, or verification.

This explainer was generated by Manning's knowledge graph from the text of Software Security for Developers. The section links point to the parts of the book it draws on.