2

I'm looking for the most common denominator of ECC curves in consumer devices.

This article describes how a particular ECC curve is ideal for Intel based motherboards. Since I'll be targeting mobile devices (Android, iOS) and also want to leverage the on-device CPU optimizations for signature verification, I'm looking for an ECC curve that is ideal for them too.

Some things I may need to investigate include

  • CPU-specific documentation
  • OS level support
  • Cross platform interoperability of implementation (encodings, compression, etc)

Question

Since a direct answer to my question doesn't probably exist, what are the most specific resources to figure out which ECC curve to choose for most efficient consumer use?

1
  • It's not the curve as is that's good for specific (old, nearly outdated by now) Intel devices, but the specific optimized implementation (they hand-assembled core routines for these specific CPUs). They could've done the same for ARM, but didn't. Thus, they don't advertise their software as being "cool for mobile devices". That's all. If you want to leverage the same amount of optimizations: crack open a book on close-to-the-metal programming for ARMs, and SIMD optimizations, and start implementing. Dec 17, 2018 at 16:05

1 Answer 1

5

The general consensus among cryptographers is that Daniel Bernstein's Curve25519 is ideal. It both provides a good security margin while being very fast and using "nothing-up-my-sleeve" numbers, and is supported by a number of libraries. In key exchange, it is called x25519. When used for signatures, it is called Ed25519. It works very well on mobile and embedded devices. In fact, it is so efficient that it is often the choice curve for passively-powered smart cards that utilize ECC!

If you want a stronger curve with similar properties, there is Curve448, also called Ed448-Goldilocks. It is stronger than Curve25519 but is also moderately slower. For a modern mobile device (as opposed to a low-end and low-power embedded device or microcontroller), it is still fast enough.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .