Most ECDSA certificates commonly encountered on the internet are signed using NIST prime curves, e.g., P-256, P-384, etc. Why are the NIST binary curves, Koblitz curves in particular, e.g., K-283, K-409, etc, not so popular? OpenSSL supports them, but I don't feel they are as widely used as the prime curves.

  • I think it's clear P-256 and P-384 in particular benefited for years because they were the two used in NSA's Suite B -- "if it's good enough for spies it's good enough for us". But that just moves the question back a step: why did NSA make this choice? – dave_thompson_085 Nov 2 '16 at 9:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.