Slides · 13 slides
Elliptic Curve Cryptography (ECC / ECDSA)
The same module told visually, ready to present. Speaker notes carry the full explanation.
Public-key
Elliptic curve cryptography
The same guarantees as RSA with far smaller keys, because the hard problem is different maths
The hard problem
ECDLP: find k from Q = kG
The building block
Point addition: chord and tangent
Point addition on a real curve (y² = x³ − 3x + 3): P + Q = R
P and Q sit on the right-hand branch of the curve. The line through them crosses the curve a third time on the left, at −R; reflecting that point across the x-axis gives R = P + Q. Every point drawn here is on the actual curve y² = x³ − 3x + 3 — nothing is approximated for effect.
Worked example · mod 17
Multiples of G on a toy curve
The algebra
2G + 3G, by formula
Fast and safe
Double-and-add versus Montgomery's ladder
Curve order
The order must have a large prime factor
Hasse: the point count stays within 2√p of p + 1
Which curve
P-256 and Curve25519
Signatures
ECDSA
The nonce is the key
Leak or reuse k, lose d
Even a few biased nonce bits across many signatures can be enough for lattice attacks
The defence
Deterministic and hedged nonces
Advanced · CVE-2020-0601
Curveball
Post-quantum
Shor breaks ECC too
Keys: ← → move, F full screen, G all slides, N notes