0

I will be working with a Sentinel dongle. In the 3rd tab, it says it supports ECC 163. I will be both encrypting and decrypting with the dongle, as well as on a server. The server uses PHP but I can wrap any binary as needed or shell_exec them.

I don't want to implement ECC 163 myself of course. I'm looking into proper existing implementations made by experts but I find it hard to find information about it. It seems like Elliptic curve Diffie–Hellman (ECDH) is the "usual" implementation but honestly I have no idea. According to OpenSSL's wiki, OpenSSL supports ECDH, but is it compatible with ECC 163?

And so my question is: what should I use on the server to encrypt/decrypt with ECC 163 ?

1

"ECC 163" is not an encryption scheme.

There are some algorithms that work with elliptic curves. One of them is Elliptic Curve Diffie-Hellman (ECDH) which is a key agreement scheme. ECDH can be used as the basis for an asymmetric encryption scheme by coupling it with a symmetric encryption algorithm: to encrypt a piece of data, you run an ECDH instance with the ECDH public key of the intended recipient, and use the resulting shared secret as key in some symmetric encryption system such as AES.

While the principle is clear enough, saying "ECC 163" is nowhere sufficient to actually specify what the dongle is doing in practice. It is more a declaration of intent than anything else.

ECDH works in some elliptic curve. While generating random elliptic curve for cryptography is doable, it is complex and expensive, so (almost) nobody does that. Instead, systems that use elliptic curve (for ECDH, ECDSA...) rely on a handful of standard curves that have been generated once and for all. NIST has defined 15 standard curves, two of which having "163" in their name: B-163 and K-163. It is conceivable that by using the terminology "ECC 163", the vendor for your dongle really means to say that his hardware supports some EC-related cryptographic algorithm using one of these two curves.

If you want to interoperate with that dongle, then you need much more detailed information about what it does. Such information is obtained through documentation from the vendor, and/or analysis and trials, a process known as "reverse engineering" (there can be legal subtleties with regards to reverse engineering, depending on context and jurisdiction, so using vendor documentation is normally preferred; also, reverse engineering can be very time consuming, and may fail, especially for a physically hardened dongle).

  • I see, that makes sense. I understand why I had so much trouble finding information. I'm waiting for documentation from them already so I'll see when I get it. Thanks. – 0xFF Feb 1 '16 at 16:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.