Derive a shared secret between different curves [closed]

1. Is it possible to derive a shared secret between different curves?
An explanation would be nice.

2. How can I decide which curve I should use in my software?
Highest amount of bits has in my case the `brainpoolP320r1` curve, but on this site https://safecurves.cr.yp.to/ the brainpool curves are rated as not safe. The German Federal Office for Information Security recommend amongst others the `brainpoolP320r1`.

These curves can I use with my HSM (hardware security module):

• secp192r1 (aka prime192v1)
• secp256r1 (aka prime256v1)
• brainpoolP192r1
• brainpoolP224r1
• brainpoolP256r1
• brainpoolP320r1
• secp192k1
• secp256k1 (the Bitcoin curve)

closed as off-topic by Stephane, Matthew, S.L. Barth, RoraΖ, XanderDec 7 '16 at 16:12

• This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer

For two parties using ECC, both must use the same curve. The reason for this is that ECC algorithms use an operation (EC addition) which is defined over a set (points on the given curve). Adding 2 points on a curve gives you another point on the same curve. For ElGamal encryption, for example, Alice adds and scalar-multiplies (which is the same thing as repeatedly adding) her plaintext (represented by points on her curve) with Bob's public key (points on his curve) to get a new EC points, which is the ciphertext. If Alice and bob are not using the curves, then these operations are not defined (i.e. points from different curves are like apples and oranges). Applying the EC addition algorithm to 2 points from different curves may be technically possible, but will give you meaningless results. This is true of all ECC primitives (encryption, key-exchange, authentication, etc.)

As for the "safety" of a curve, these is some subjectivity. If there is a theoretical attack that could lead to a \$100 000 000 computer breaking your cipher in 250 years, do you consider this "safe"? Some organizations will say "yes", others "no". To independently asses the security of a curve, you would need at the minimum a PhD in Group Theory, so I would just defer to a credible standard. If you're limited to pre-packaged curves, I would have no problem using such a curve that is approved by the Federal Office on for Information Security, where teams of said PhD-holding experts work on these problems.