Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

It seems that Elliptic Curve Cryptography, being required by the US government, is not being used outside of the government. Why is this? And why does the government support it's use for government?

Is it just because ECC is new and people haven't migrated over. Or is ECC the same as RSA DSA etc...

share|improve this question

closed as not constructive by Polynomial, Scott Pack, Iszi, Terry Chia, AviD♦ Sep 23 '12 at 16:12

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.

2 Answers

up vote 3 down vote accepted

There are a lot of reasons why ECC is not used more widely, among which are:

  • ECC is newer than RSA and Diffie-Hellman (by about a dozen years).
  • ECC mathematics are a bit harder to grasp than RSA/DH maths. Most people should not implement cryptographic algorithms anyway (safe cryptographic implementation is hard; it is much better to rely on existing libraries), but developers really prefer to use algorithms that they could theoretically implement themselves (they want to feel that they understand what is going on).
  • ECC has been covered by some patents. Since patent law is a difficult subject which is typically not well known by people who specialized on cryptography (because it is another specialization), the generic attitude is that of cautious distrust.
  • RSA was there first, and is firmly entrenched. If you want wide usage of ECC, kill RSA first.

You do not tell which government mandates use of elliptic cryptography, so I guess you are talking about the US government. At one point, the US government paid a hefty sum to Certicom (something like 25 millions of dollars) for the right to use the techniques covered by the patents held by Certicom. It is no wonder that they want to use them, then.

share|improve this answer
So RSA 2048 bit is just as strong as ECC? – dongle26 Sep 20 '12 at 12:17
@dongle26, depends on how ECC is configured, but yes you can configure ECC to be just as strong as RSA-2048. See keylength.com – mikeazo Sep 20 '12 at 12:24
Didn't Sony use it an royally screw it up in PS3 DRM? Random number = 4? – ewanm89 Sep 20 '12 at 13:17
@ewanm89: yes, Sony screwed it up badly -- but they would have equally screwed it up with plain DSA; the "elliptic curve" part was not at fault. The fact is that both DSA and ECDSA need randomness for each signature, and it is a hard requirement. Shameless plug: there is a solution which is in the process of being reviewed for publication as a RFC. – Thomas Pornin Sep 20 '12 at 14:06
@ThomasPornin Of course they would, I don't doubt it. They didn't read the documentation! – ewanm89 Sep 20 '12 at 15:13
up vote 0 down vote

It all has to do with patents. Certicom own almost all the patents and the NSA own or have licensed the rest. It is likely that the US government has stipulated that Certicom (owned by RIM I think) will not license the technology to anyone else.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.