APPENDIX 6. RECOMMENDED ELLIPTIC CURVES FOR FEDERAL GOVERNMENT USE
July 1999
This collection of elliptic curves is recommended for Federal government use and contains choices of private key length and underlying fields.
1. Parameter Choices
1.1 Choice of Key Lengths
The principal parameters for elliptic curve cryptography are the elliptic curve E and a designated point G on E called the base point. The base point has order r, a large prime. The number of points on the curve is n = fr for some integer f (the cofactor) not divisible by r. For efficiency reasons, it is desirable to take the cofactor to be as small as possible.
All of the curves given below have cofactors 1, 2, or 4. As a result, the private and public keys are approximately the same length. Each length is chosen to correspond to the cryptovariable length of a common symmetric cryptologic. In each case, the private key length is, at least, approximately twice the symmetric cryptovariable length.
1.2 Choice of Underlying Fields
For each cryptovariable length, there are given two kinds of fields.
- A prime field is the field GF(p) which contains a prime number p of elements. The elements of this field are the integers modulo p, and the
24
