2
Recommended Elliptic Curve Domain Parameters over
F p
Page 3
All the recommended elliptic curve domain parameters over
F p use special form primes for their ﬁeld
order p. These special form primes facilitate especially efﬁcient implementations like those described in
[8]. Recommended elliptic curve domain parameters over
F p which use random primes for their ﬁeld
order p may be added later if commercial demand for such parameters increases.
The two or three elliptic curve domain parameters over
F p supplied at each security level typically consist
of examples of two different types of parameters — one type being parameters associated with a Koblitz
curve and the other type being parameters chosen veriﬁably at random — although only veriﬁably random
parameters are supplied at export strength.
Parameters associated with a Koblitz curve admit especially efﬁcient implementation. The name Koblitz
curve is best-known when used to describe binary anomalous curves over
F2m which have a ;b
2
f0 ;1 g [6].
Here it is generalized to refer also to curves over
F p which possess an efﬁciently computable endo-
morphism. The recommended parameters associated with a Koblitz curve were chosen by repeatedly
selecting parameters admitting an efﬁciently computable endomorphism until a prime order curve was
found.
Veriﬁably random parameters offer some additional conservative features. These parameters are chosen
from a seed using SHA-1 as speciﬁed in ANSI X9.62 [1]. This process ensures that the parameters
cannot be predetermined. The parameters are therefore extremely unlikely to be susceptible to future
special-purpose attacks, and no trapdoors can have been placed in the parameters during their generation.
When elliptic curve domain parameters are chosen veriﬁably at random, the seed S used to generate the
parameters may optionally be stored along with the parameters so that users can verify the parameters
were chosen veriﬁably at random.
Here veriﬁably random parameters have been chosen either so that the associated elliptic curve has prime
order, or so that scalar multiplication of points on the associated elliptic curve can be accelerated using
Montgomery’s method [7]. The recommended veriﬁably random parameters were chosen by repeatedly
selecting a random seed and counting the number of points on the corresponding curve until appropriate
parameters were found. Typically the parameters were chosen so that a
= p
 3 because such parameters
admit efﬁcient implementation. For a given p, approximately half the isomorphism classes of elliptic
curves over
F p contain a curve with a
= p
 3.
See SEC 1 [10] for further guidance on the selection of elliptic curve domain parameters over
F p.
The recommended elliptic curve domain parameters over
F p have been given nicknames to enable them
to be easily identiﬁed. The nicknames were chosen as follows. Each name begins with sec to denote
‘Standards for Efﬁcient Cryptography’, followed by a p to denote parameters over
F p, followed by a
number denoting the length in bits of the ﬁeld size p, followed by a k to denote parameters associated
with a Koblitz curve or an r to denote veriﬁably random parameters, followed by a sequence number.
Table 1 summarizes salient properties of the recommended elliptic curve domain parameters over
F p.
Information is represented in Table 1 as follows. The column labelled ‘parameters’ gives the nickname of
the elliptic curve domain parameters. The column labelled ‘section’ refers to the section of this document
where the parameters are speciﬁed. The column labelled ‘strength’ gives the number of bits of security
the parameters offer. The column labelled ‘size’ gives the length in bits of the ﬁeld order. The column
labelled ‘RSA/DSA’ gives the approximate size of an RSA or DSA modulus at comparable strength.