!!! Overview
[{$pagename}] [cryptography] ([ECC]) is an approach to [Public Key] [cryptography] based on the algebraic structure of [{$pagename}]s over finite fields. 

One of the main benefits in comparison with non-ECC cryptography (with plain Galois fields as a basis) is the same level of security provided by keys of smaller size.

[{$pagename}] [cryptography] can be used for [Key-Exchange], [Asymmetric Key] [encryption], or for [Digital Signature],, [pseudorandom generators] and other tasks. 

[{$pagename}]s are also used in several integer factorization algorithms that have applications in cryptography, such as Lenstra elliptic curve factorization.

Among widely implemented [Public Key] primitives, elliptic curves offer the best resistance to [Cryptanalysis] [attacks] on classical computers, and as a result can be used with smaller [key sizes] than [RSA] or finite field based discrete logarithm schemes.


From a high level, Crypto++ offers a numbers of schemes and algorithms which operate over [{$pagename}]. 

Fields include both Fp and F2m, and schemes include:
* [Elliptic Curve Diffie-Hellman] [Key Agreement] ([ECDH])
* [Elliptic Curve Menezes-Qu-Vanstone] [Key Agreement] ([ECMQV])
* Hashed [Menezes-Qu-Vanstone] [Key agreement] ([HMQV])
* [Fully Hashed Menezes-Qu-Vanstone] [Key Agreement] ([FHMQV])
* Elliptic Curve Integrated Encryption Scheme ([ECIES])
* [Elliptic Curve Digital Signature Algorithm] ([ECDSA])
* Elliptic Curve Nyberg Rueppel Signature Scheme ([ECNR])
* Point Compression

!! What Is an Elliptic Curve?
[{$pagename}]s are a class of curves that satisfy certain mathematical criteria. Specifically, a planar curve is elliptic if it is smooth and takes the commonly used “Weierstrass form” of
{{{y2=x3+Ax+B}}}
where
{{{4A3+27B2≠0}}}
You’ll often see these curves depicted as planar slices of what might otherwise be a 3D plot.

!! [{$pagename}] and [Trapdoor Function]
There does not appear to be a shortcut that is narrowing the gap in a [Trapdoor Function] based around [{$pagename}]. This means that for numbers of the same size, solving [{$pagename}] discrete logarithms is significantly harder than factoring. Since a more [Computational Hardness Assumption] means a stronger [cryptographic] system, it follows that [{$pagename}] cryptosystems are harder to break than [RSA] and [Diffie-Hellman].

To visualize how much harder it is to break, Lenstra, Kleinjung and Thome introduced in 2013 the concept of "Global Security.";
''You can compute how much energy is needed to break a cryptographic algorithm, and compare that with how much water that energy could boil. This is a kind of cryptographic carbon footprint. By this measure, breaking a 228-bit RSA key requires less energy to than it takes to boil a teaspoon of water. Comparatively, breaking a 228-bit elliptic curve key requires enough energy to boil all the water on earth. For this level of security with RSA, you'd need a key with 2,380-bits.''

!! [{$pagename}] [Security Considerations]
There have been some questions and uncertainties that have held them back from being fully embraced by everyone in the industry.

The [Dual Elliptic Curve Deterministic Random Bit Generator] ([Dual_EC_DRBG]), a [Pseudorandom number generator] standardized by the [National Institute of Standards and Technology] ([NIST]) and promoted by the [NSA] which generates random-looking numbers using the mathematics of [{$pagename}]s. There have been reports are that it could have been designed with a [backdoor], meaning that the sequence of numbers returned could be fully predicted by someone with the right secret number.

There has been progress in developing curves with efficient arithmetic outside of [NIST], including [Curve25519] created by Daniel Bernstein (djb) and more recently computed curves by Paulo Baretto and collaborators.

! [{$pagename}] and [Intellectual Property] ([Patents])
Another uncertainty about [ECC] is related to patents. There are over 130 [patents] that cover specific uses of elliptic curves owned by BlackBerry (through its [2009|Year 2009] acquisition of Certicom). Many of these patents were licensed for use by private organizations and even the [NSA]. This has given some developers pause over whether their implementations of ECC infringe upon this patent portfolio. In 2007, Certicom filed suit against Sony for some uses of [{$pagename}]s, but that lawsuit was dismissed in 2009. There are now many implementations of ECC that are thought to not infringe upon these patents and are in wide use.

! [{$pagename}] [Random] [Number]
The [ECDSA] [Digital Signature] has a drawback compared to [RSA] in that it requires a good source of [entropy]. Without proper randomness, the [Private Key] could be revealed. A good source of [random] [numbers] is needed on the machine making the signatures. [Dual_EC_DRBG] is [NOT RECOMMENDED].


!! More Information
There might be more information for this subject on one of the following:
[{ReferringPagesPlugin before='*' after='\n' }]
----
* [#1] - [How Elliptic Curve Cryptography Works|https://www.allaboutcircuits.com/technical-articles/elliptic-curve-cryptography-in-embedded-systems/|target='_blank'] - based on information obtained 2019-07-06 
* [#2] - [Elliptic_curve|Wikipedia:Elliptic_curve|target='_blank'] - based on information obtained 2019-07-06 
* [#2] - [UNDERSTANDING ELLIPTIC CURVE CRYPTOGRAPHY AND EMBEDDED SECURITY|https://hackaday.com/2019/07/04/understanding-elliptic-curve-cryptography-and-embedded-security/|target='_blank'] - based on information obtained 2019-07-06