P-256 is a standardized elliptic curve over a 256-bit prime finite field. It supplies the curve parameters and fixed base point used for public-key operations and the DUAL_EC_DRBG implementation. section 3.2.2 section 3.2.4
Equation 3.2
\[y^2 = x^3 + ax + b \label{equation:elliptic-curves}\]The curve is defined by an equation of the form y² = x³ + ax + b, evaluated over the curve’s finite field. section 3.2.2
P-256 provides the implementation primitives needed here:
- Represents curve points as coordinate pairs and uses elliptic-curve addition for point operations. section 3.2.2
- Supports scalar multiplication, written nP, through Go’s elliptic.Curve.ScalarMult function. section 3.2.2
- Uses arbitrary-precision integers from math/big for coordinate calculations. section 3.2.2
- Allows candidate x-coordinates to be checked by computing a modular square root and verifying that the resulting point lies on the curve. section 3.2.4
Using P-256 in a DUAL_EC_DRBG attack
The implementation selects elliptic.P256(), obtains its fixed base point P, and performs scalar multiplication. An attacker constructs Q so that P = dQ, where d is secret, then uses that relationship to recover generator state from observed output. Candidate x-values are tested against the P-256 equation until a valid point is found. section 3.2.4
