Elliptic Curve Cryptography (ECC) Brainpool Standard Curves and Curve Generation
RFC 5639

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 03

Independent Submission                                        M. Lochter
Request for Comments: 5639                                           BSI
Category: Informational                                        J. Merkle
ISSN: 2070-1721                                secunet Security Networks
                                                              March 2010

          Elliptic Curve Cryptography (ECC) Brainpool Standard
                      Curves and Curve Generation

Abstract

   This memo proposes several elliptic curve domain parameters over
   finite prime fields for use in cryptographic applications.  The
   domain parameters are consistent with the relevant international
   standards, and can be used in X.509 certificates and certificate
   revocation lists (CRLs), for Internet Key Exchange (IKE), Transport
   Layer Security (TLS), XML signatures, and all applications or
   protocols based on the cryptographic message syntax (CMS).

Status of This Memo

   This document is not an Internet Standards Track specification; it is
   published for informational purposes.

   This is a contribution to the RFC Series, independently of any other
   RFC stream.  The RFC Editor has chosen to publish this document at
   its discretion and makes no statement about its value for
   implementation or deployment.  Documents approved for publication by
   the RFC Editor are not a candidate for any level of Internet
   Standard; see Section 2 of RFC 5741.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at
   http://www.rfc-editor.org/info/rfc5639.

Copyright Notice

   Copyright (c) 2010 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.

Lochter & Merkle              Informational                     [Page 1]
RFC 5639    ECC Brainpool Standard Curves & Curve Generation  March 2010

Table of Contents

   1. Introduction ....................................................3
      1.1. Scope and Relation to Other Specifications .................4
      1.2. Requirements Language ......................................4
   2. Requirements on the Elliptic Curve Domain Parameters ............4
      2.1. Security Requirements ......................................5
      2.2. Technical Requirements .....................................6
   3. Domain Parameter Specification ..................................8
      3.1. Domain Parameters for 160-Bit Curves .......................8
      3.2. Domain Parameters for 192-Bit Curves .......................9
      3.3. Domain Parameters for 224-Bit Curves ......................10
      3.4. Domain Parameters for 256-Bit Curves ......................11
      3.5. Domain Parameters for 320-Bit Curves ......................12
      3.6. Domain Parameters for 384-Bit Curves ......................13
      3.7. Domain Parameters for 512-Bit Curves ......................14
   4. Object Identifiers and ASN.1 Syntax ............................15
      4.1. Object Identifiers ........................................15
      4.2. ASN.1 Syntax for Usage with X.509 Certificates ............16
   5. Security Considerations ........................................17
   6. Intellectual Property Rights ...................................18
   7. References .....................................................18
      7.1. Normative References ......................................18
      7.2. Informative References ....................................19
   Appendix A. Pseudo-Random Generation of Parameters ................22
     A.1. Generation of Prime Numbers ................................22
     A.2. Generation of Pseudo-Random Curves .........................24

Lochter & Merkle              Informational                     [Page 2]
RFC 5639    ECC Brainpool Standard Curves & Curve Generation  March 2010

1.  Introduction

   Although several standards for elliptic curves and domain parameters
   exist (e.g., [ANSI1], [FIPS], or [SEC2]), some major issues have
   still not been addressed:

   o  Not all parameters have been generated in a verifiably pseudo-
      random way.  In particular, the seeds from which the curve
      parameters were derived have been chosen ad hoc, leaving out an
      essential part of the security proof.

   o  The primes selected for the base fields have a very special form
      facilitating efficient implementation.  This does not only
      contradict the approach of pseudo-random parameters, but also
      increases the risk of implementations violating one of the
      numerous patents for fast modular arithmetic with special primes.