3
Recommended Elliptic Curve Domain Parameters over
F2m
Page 17
Field
Reduction Polynomial(s)
+x9
+1
F 2113
f
(x)
= x113
+x8
+x3
+x2
+1
F 2131
f
(x)
= x131
+x7
+x6
+x3
+1
F 2163
f
(x)
= x163
+x15
+1
F 2193
f
(x)
= x193
+x74
+1
F 2233
f
(x)
= x233
+x36
+x158
+1 or x239
+1
F 2239
f
(x)
= x239
+x12
+x7
+x5
+1
F 2283
f
(x)
= x283
+x87
+1
F 2409
f
(x)
= x409
+x10
+x5
+x2
+1
F 2571
f
(x)
= x571
Table 3: Representations of
F 2m
but recommended parameters at these sizes may be added later if commercial demand for extremely high
strength parameters increases.
The elliptic curve domain parameters over
F 2m supplied at each security level typically consist of exam-
ples of two different types of parameters — one type being parameters associated with a Koblitz curve
and the other type being parameters chosen veriﬁably at random — although only veriﬁably random
parameters are supplied at export strength.
Parameters associated with a Koblitz curve admit especially efﬁcient implementation. Koblitz curves
over
F 2m are binary anomalous curves which have a ;b
2
f0 ;1 g [6].
Veriﬁably random parameters offer some additional conservative features. These parameters are chosen
from a seed using SHA-1 as speciﬁed in ANSI X9.62 [1]. This process ensures that the parameters
cannot be predetermined. The parameters are therefore extremely unlikely to be susceptible to future
special-purpose attacks, and no trapdoors can have been placed in the parameters during their generation.
When elliptic curve domain parameters are chosen veriﬁably at random, the seed S used to generate the
parameters may optionally be stored along with the parameters so that users can verify the parameters
were chosen veriﬁably at random.
The recommended veriﬁably random parameters were chosen by repeatedly selecting a random seed and
counting the points on the corresponding curve using Schoof’s algorithm until appropriate parameters
were found. The parameters were chosen so that either a is random or a
= 1. For a given m, approximately
half the isomorphism classes of elliptic curves over
F 2m contain a curve with a
= 1.
See SEC 1 [10] for further guidance on the selection of elliptic curve domain parameters over
F 2m.
The example elliptic curve domain parameters over
F 2m have been given nicknames to enable them to
be easily identiﬁed. The nicknames were chosen as follows. Each name begins with sec to denote