Elliptic Curve Cryptography

Corresponds to Chapter 15.1–15.3, entirely new territory — number-theory-for-cryptography only lists elliptic curve groups as a pointer, without developing them. The points on an elliptic curve $y^2 = x^3+ax+b$ over a field, together with a point at infinity, form an abelian group under a chord-and-tangent construction: draw a line through two points, and the third intersection (reflected) is their “sum” — this group is the setting for a discrete-log-style hardness assumption (ECDLP), believed harder (per key bit) than the multiplicative-group discrete log underlying classical Diffie-Hellman/ElGamal, which is why elliptic curve cryptography uses much shorter keys for comparable security. Over finite fields, Montgomery and Edwards curve parameterizations give alternative coordinate systems with faster, more uniform (side-channel- resistant) arithmetic than the naive short Weierstrass form. Covers the standard deployed curves secp256r1/secp256k1 (used in TLS and Bitcoin respectively), a documented security subtlety (“security twist”) affecting naive implementations, and Curve25519, designed specifically to avoid such pitfalls by construction.

Outline (TODO — flesh out each)

• The group of points of an elliptic curve
• Elliptic curves over finite fields
• Montgomery and Edwards curves
• Elliptic curve cryptography in practice
• The curves secp256r1 and secp256k1
• A security twist
• Curve25519