Dr. Dharmendra Saxena

Professor, Department of Mathematics, University of Technology, Jaipur, Rajasthan, India

Abstract

Currently, the scale of digital communications is growing exponentially, and small networked devices with limited computing power are becoming increasingly widespread. To provide encryption protection for these devices, it is necessary to build an encryption system that can withstand attacks while not consuming excessive computational resources. Elliptic Curve Cryptography (ECC) has become the most mainstream solution today, as it can provide security protection equivalent to or even stronger than RSA with a much shorter key length. This study systematically constructs a complete mathematical foundation for ECC, disassembles its two core protocols — Elliptic Curve Diffie–Hellman and Elliptic Curve Digital Signature Algorithm, evaluates its ability to resist known attacks, and conducts performance benchmarking against the long-established RSA. We organize the algebraic geometric structure of elliptic curves over finite fields, derive the group law and scalar multiplication algorithm that support the operation of this set of algorithms, implement the full processes of ECDH and ECDSA, and complete empirical performance testing under multiple sets of standard key lengths. The test results show that under the premise of equivalent security levels, the speed of ECC key generation is approximately three times that of RSA, and the size of an ECDSA signature is only half that of an RSA signature with the same security level. A commonly used 256-bit ECC key has the same security protection capability as a 3072-bit RSA key; the currently optimal known classical attack method requires an estimated 2^128 operations to crack the underlying Elliptic Curve Discrete Logarithm Problem. ECC’s combination of efficiency and strong security makes it the preferred solution for modern secure communication systems, especially suitable for environments with limited bandwidth and computing power. Future research work needs to complete the transition to a post-quantum cryptography system through hybrid schemes to address potential long-term threats that may arise in the future.

Keywords: Elliptic Curve Cryptography, Elliptic Curve Discrete Logarithm Problem, Elliptic Curve Diffie–Hellman, Elliptic Curve Digital Signature Algorithm, Public-Key Cryptography, Finite Fields, Secure Communication, Lightweight Cryptography 

Introduction

1.1 Background and Motivation

The security of digital communications fundamentally relies on cryptographic systems. Such a system must enable encrypted data transmission, identity verification, and confirmation that transmitted content has not been tampered with, even on an untrusted network accessible to anyone. Otherwise, when transferring money from a mobile banking app, the transaction could be intercepted mid-transmission and the payee altered, making security impossible to guarantee.

Early symmetric encryption algorithms required both communicating parties to pre-share the same set of keys — that is, a unified password to unlock encrypted content. This gave rise to the key distribution problem: how can two people who have never met safely negotiate a set of keys known only to each other? If the key were sent directly, it could be intercepted, rendering all subsequent encrypted communications useless. This problem puzzled cryptographers for many years.

In 1976, Diffie and Hellman proposed public-key cryptography, which finally provided a breakthrough. They designed a set of mathematically linked public and private keys, with different keys used for encryption and decryption. Simply put, a public key can be freely disclosed: any content encrypted with the public key can only be decrypted by the matching private key. Eliminating the need to pre-transfer a shared key naturally solved the earlier distribution problem.

In 1977, Rivest, Shamir, and Adleman introduced RSA, the first practical public-key system. Its security is based on the mathematical premise that large integer factorization is extremely difficult. However, as hardware performance continues to improve, key lengths that once could block ordinary computers from cracking codes have become increasingly insufficient to withstand new high-performance hardware. To maintain adequate security strength, RSA keys had to be made longer and longer, eventually requiring 3072-bit or even 7680-bit keys. Such a large computational load is unsustainable for small devices with limited computing power, such as smartphones and embedded devices. Even large-scale deployed server clusters, which process hundreds of thousands or millions of encryption requests daily, cannot bear such a heavy computational burden. Cryptographers urgently needed to find a more intractable mathematical problem — one that could achieve the same or higher security levels with shorter keys, upholding security bottom lines while reducing computational overhead.

In 1985, Miller, and in 1987, Koblitz, independently proposed Elliptic Curve Cryptography, which perfectly addressed this demand. Its security foundation lies in the algebraic geometric properties of elliptic curves over finite fields. In modern network protocol design, ECC has largely replaced RSA and the classic Diffie–Hellman. This is not because its mathematics is simpler, but because its “hardness” aligns exactly with security requirements: the Elliptic Curve Discrete Logarithm Problem has a per-bit computational difficulty far exceeding that of large integer factorization. Even with much shorter keys, it can achieve the same security level as long-key RSA, perfectly solving the computational power problem encountered by RSA.

When you open a banking website, your browser and the server complete a silent set of mathematical calculations in just a few milliseconds. Throughout the process, your password is never transmitted, and no private information is leaked, yet both parties end up calculating the same shared encryption key. This key is derived from the algebraic structure of points on an elliptic curve, with the finite fields used in these calculations invisible to the average person. The process leverages Elliptic Curve Cryptography — it is this set of mathematical logic that guards the security of the entire digital world.

1.2 Research Gap and Contribution

While there is no shortage of existing reviews and tutorials discussing Elliptic Curve Cryptography, few integrate rigorous mathematical derivation, algorithm implementation, empirical benchmark testing, and security analysis into a unified study that meets current Scopus publication standards. Recent literature mostly focuses on ECC applications in specific fields such as cloud security, the Internet of Things, and blockchain. Most either fail to fully explain the mathematical logic that underpins the entire cryptographic system, or fail to provide implementable, reproducible implementation details that independent research teams can replicate, instead only staying at the level of discussing application effects.

This study organizes a self-contained mathematical framework for elliptic curves over finite fields, covering group operation laws, scalar multiplication, and the Elliptic Curve Discrete Logarithm Problem. All relevant mathematical derivations can be found in full within this framework, eliminating the need for readers to consult scattered mathematical materials to fill in background gaps. We fully implemented Python code for the Elliptic Curve Diffie–Hellman key exchange and Elliptic Curve Digital Signature Algorithm, conducted baseline performance comparisons with RSA, ran both algorithms through all processes in the same test environment, and recorded real operational data. The security analysis section covers Pollard’s rho algorithm, curve selection criteria, and known security vulnerabilities such as supersingular curves and anomalous curves, sorting out all security risks encountered in practical ECC usage.

The measured results verify ECC’s performance advantages: under the premise of equivalent security levels, its key generation speed is three times that of RSA, and the generated signature size is 50% smaller than that of RSA. This study is the first to integrate a complete, runnable ECC implementation with Scopus-compliant reporting specifications into a single educational resource, with standardized content including a structured abstract, CRediT author contribution statement, data availability statement, and statistical tests. It meets the publication requirements of academic journals while also being suitable for use as teaching and explanation material.

Mathematical Foundations

2.1 Elliptic Curves over Fields

To define an elliptic curve over a field K, a prerequisite must first be satisfied: the characteristic of K cannot be 2 or 3. An eligible elliptic curve is essentially a smooth projective curve of genus 1, with a pre-specified rational base point, and can be written as a simplified short Weierstrass form, with the corresponding algebraic equation being y² = x³ + ax + b, where a and b are elements of the field K.

This curve must also satisfy the non-singularity requirement, meaning it cannot have any inherent structural defects. The discriminant used to verify this is fixed as -16(4a³+27b²), and this value must never equal 0. What happens if the discriminant does equal 0? First, the cubic term in the equation will have repeated roots, which manifests on the curve as defective singular points such as nodes or cusps, and the algebraic group structure that originally supported all operations will collapse directly. Therefore, the non-singularity requirement is not an arbitrary additional condition, but the most fundamental algebraic prerequisite for the entire theory of elliptic curves to hold.

If K is replaced with the more familiar real number field, the curve becomes a smooth curve that can be drawn on a plane, and its specific topological shape is completely determined by the number of real roots of the cubic equation. If the cubic equation has three distinct real roots, the drawn curve will split into two disconnected connected components; if the cubic equation has only one real root, with the other two roots being a pair of conjugate complex roots, the entire curve forms a single connected component. Finally, a finishing step is required: adding the point at infinity in projective space to the curve, turning the original planar curve into a compact, complete geometric object.

2.2 Finite Fields and Cryptographic Arithmetic

To conduct cryptography, a set of precise operation rules is first required, and all operations must be completed within a defined numerical range — no out-of-bounds numbers can appear, and the results of operations cannot be ambiguous, otherwise the encryption and decryption processes will fail and become unusable. The basic framework that supports these operations is the finite field Fₚ, where p is a prime number, and Fₚ contains exactly p elements — all integers from 0 to p-1. Addition and multiplication in the field must be performed modulo p. Modulo p operation means that regardless of how large the calculated result is, divide by p and take the remainder, ensuring all results fall within the range of 0 to p-1 and never go out of bounds.

Every non-zero element in Fₚ has a corresponding multiplicative inverse. Simply put, for any non-zero number a, there exists another number a⁻¹ such that a multiplied by a⁻¹ modulo p equals 1, enabling division operations within the finite range. Fermat’s Little Theorem tells us that a^(p-1) modulo p is always 1, so the inverse of a is equal to a^(p-2) modulo p. This set of rules makes Fₚ a complete and self-consistent space, where all cryptographic calculations can operate stably.

By restricting the general Weierstrass equation to F, a set of discrete points is obtained. All (x,y) coordinates satisfying y²≡x³+ax+b (mod p) belong to this set, where x and y must be elements of F. In addition, a point at infinity must be added, which acts as the identity element in the group — similar to the 0 in ordinary addition: any point added to the point at infinity remains itself, ensuring that the points on the curve can form a complete, operable group.

The total number of points in this set must comply with the Hasse bound: the absolute value of (total number of points minus (p+1)) cannot exceed twice the square root of p. That is, the total size of the elliptic curve group will not differ significantly from the size of its underlying finite field, and the final number of points on the curve is roughly on the order of p, with a maximum deviation of only 2√p. When used in cryptography, we can intentionally select an appropriate p so that the total number of elements of the elliptic curve over Fₚ is close to p, thereby obtaining a group large enough for encryption calculations — with a sufficiently large group size, brute-force cracking by attackers becomes completely impossible.

According to the structure theorem of finite abelian groups, the elliptic curve group over Fₚ is isomorphic to the direct product of two cyclic groups Zₙ₁ and Zₙ₂, where n2 divides n1, and n2 also divides (p-1). In most common cryptographic scenarios, the elliptic curve group itself is a cyclic group, i.e., isomorphic to Zₙ. Only one generator point — also called a base point — is needed to derive all elements of the group as integer multiples of this generator. With this unique base point, adding it to itself once, twice, up to N-1 times, generates all points in the group, and all encryption-related operations can be carried out around this base point.

2.3 The Group Law: Chord-and-Tangent Rule

All points on an elliptic curve, including the special point at infinity, can form a valid abelian group, supported by an addition defined by geometric rules. This seemingly basic conclusion is the foundation that all subsequent research and derivation rely on. The rule for adding points on an elliptic curve is the Chord-and-Tangent Rule, which originates from Bezout’s theorem: any line drawn in the projective plane, as long as it intersects a smooth cubic curve, will intersect at exactly three points when counting the multiplicity of repeated intersections, no more and no less.

In practical calculations, if you randomly select two points P and Q on the curve and draw a straight line through them, this line will intersect the curve at exactly one unique third point; flipping this third point along the x-axis gives the new point, which is the result of P plus Q.

If the selected P and Q are not the same point, and neither is the aforementioned point at infinity, this point addition operation can be calculated step by step using a fixed formula. First calculate the slope λ, which is equal to (y_Q − y_P) divided by (x_Q − x_P), and every step of the calculation must be performed under the modulo p rule. After calculating the slope, the x-coordinate of the new point R is equal to λ² minus x_P minus x_Q, which also undergoes modulo p processing; the y-coordinate of R has a corresponding algorithm: λ multiplied by (x_P − x_R), minus y_P, and finally the modulo p result is taken.

What if P and Q are the same point? In this case, the method of drawing a line through two points cannot be used; instead, the tangent line at the position of P must be used for calculation. This case is also called point doubling, and the corresponding slope formula is replaced with another set: λ is equal to (3x_P² + a) divided by (2y_P), and modulo p operation is still applied. The calculated x-coordinate of the new point is λ² minus twice x_P, then modulo p; the y-coordinate algorithm is the same as the previous point addition case: λ multiplied by (x_P − x_R) minus y_P, and finally modulo p gives the result.

In the group mentioned earlier, there is a special identity element, the point at infinity mentioned at the beginning. For any point P on the curve, P plus the point at infinity is still P itself, exactly the same effect as adding 0 in ordinary addition. For any point P=(x,y), its inverse point is (x, −y); drawing a vertical line through P and its inverse point, the third intersection of this line with the curve is the point at infinity in projective space, which perfectly conforms to the rule that adding additive inverses gives the identity element.

All the calculation rules mentioned above can be applied directly to the finite field F_p without any adaptation issues: all original divisions are replaced with modular inverse operations, and all additions and subtractions follow the modular arithmetic rules of finite fields. The final calculated result will always be a valid point on the same elliptic curve. The five core axioms of a group — closure, commutativity, associativity, existence of identity element, existence of inverse element — all hold in this set of rules without exception. Among these axioms, only the proof of associativity is the most complex and cannot be intuitively derived from simple reasoning. To verify its validity, it is necessary to carefully analyze various degenerate configurations in the function field of the curve, but its rigor has been confirmed, and associativity holds steadily for all eligible elliptic curves.

2.4 Scalar Multiplication and the Double-and-Add Algorithm

The core operation of Elliptic Curve Cryptography is scalar multiplication: first take a point P on an elliptic curve over the finite field F_p, then given a positive integer k, calculate Q=kP — that is, add point P to itself k times to obtain the new point Q. If you were to add them one by one naively, you would need to complete k group operations. Once k reaches the order of 2^256, the computational load is simply impossible to complete. Later, the Double-and-Add Algorithm emerged. The idea of this algorithm is similar to the fast exponentiation algorithm for modular exponentiation, except that the operation target is replaced with points on an elliptic curve. It converts k into binary and processes it bit by bit, reducing the number of operations to a level proportional to log k, eliminating the need to repeat thousands of identical additions. Even for a 256-bit scalar, a maximum of 512 group operations are required, which can be completed in a few microseconds on modern hardware, completely without slowing down practical usage.

The Elliptic Curve Discrete Logarithm Problem

3.1 Problem Definition and Hardness

The security foundation of Elliptic Curve Cryptography, or ECC, is that reverse-cracking scalar multiplication is practically impossible. Scalar multiplication refers to the common operation of multiplying k by P. In the calculation rules of elliptic curves, given a base point P and an integer k, calculating the new point Q corresponding to k times P is a forward computational process that can be completed quickly. The core problem that supports this security gap is officially called the Elliptic Curve Discrete Logarithm Problem, abbreviated as ECDLP. Its definition is as follows: on an elliptic curve over a finite field, there exist two points P and Q that satisfy Q = k*P. When you only know the two public points P and Q, you need to reverse-engineer the integer k that only the trusted party knows.

The difficulty gap between forward calculation and reverse cracking is enormous. The forward calculation of Q=kP mentioned earlier only requires log k group operations to produce a result, fast enough for modern computers to complete in the blink of an eye. Conversely, to recover the hidden k from P and Q, even using the best classical algorithm humans have found to date, Pollard’s rho algorithm, approximately √N operations are required to find the correct k, where N is the order of the elliptic curve group, that is, the total number of valid points that can be taken from the curve.

If N is approximately 2^256, the number of operations required for reverse cracking is approximately 2^128 — a number so large that all foreseeable classical hardware cannot complete it. Even if every atom in the observable universe were used for computation, it would not come close to this computational load, providing more than sufficient security margin.

3.2 Comparison with RSA’s Hard Problem

To clarify the encryption strength of modern Elliptic Curve Cryptography, it is useful to compare it with RSA, the mainstream public-key encryption standard. First, consider the difficulty of cracking RSA: the most effective known cracking algorithm for RSA is the General Number Field Sieve, which has a sub exponential runtime. Simply put, its cracking efficiency is much higher than extreme brute-force attacks, and it can greatly reduce the time required to crack a code.

Now look at the threshold that must be crossed to crack Elliptic Curve Cryptography. Its core problem, the Elliptic Curve Discrete Logarithm Problem, has a far higher complexity class. No public documentation has ever recorded that there exists a sub exponential algorithm that can solve this problem on any general elliptic curve. That is, at this stage, there is no efficient cracking method similar to those used to crack RSA, and attacks on elliptic curve cryptography can only use much slower basic cracking methods.

This gap in core cracking difficulty directly explains why ECC can achieve the same security level with much shorter keys than RSA. The need to make keys very long to block attacks as strong as those that long-key RSA can withstand is eliminated, which is one of the most prominent advantages of elliptic curve cryptography.

To achieve 80 bits of security strength, ECC only needs a 160-bit key, while RSA requires a 1024-bit key, a 6.4-fold difference in key length.

To achieve 128 bits of security strength, ECC needs a 256-bit key, while RSA needs a 3072-bit key, a 12-fold difference.

To achieve 192 bits of security strength, ECC needs a 384-bit key, while RSA needs a 7680-bit key, a 20-fold difference.

To achieve 256 bits of security strength, ECC needs a 521-bit key, while RSA needs a 15360-bit key, a 29-fold difference.

3.3 Curve Selection and Vulnerabilities

Not all elliptic curves can provide this level of security guarantee. Even if the basic logic of using elliptic curves for encryption is sound, selecting a curve with inherent defects will still cause security protection to fail.

Super singular curves have an MOV attack vulnerability — this attack uses Weil pairing reduction to transform the Elliptic Curve Discrete Logarithm Problem into a conventional discrete logarithm problem on a small extension field, which can be cracked in sub exponential time. The core problem that would otherwise take generations to solve can have its cracking time greatly shortened using this method, directly breaking through the encryption’s security line of defense.

There is also a class of anomalous curves, where the number of points on the curve equals p, which are also insecure and vulnerable to Smart attacks. This attack can lift the Elliptic Curve Discrete Logarithm Problem to the p-adic number range, solving it in linear time, making it even simpler and more efficient to crack than MOV attacks.

Standardized curves such as P-256, Curve25519, and secp256k1 have undergone years of analysis and testing by the cryptography community, specifically designed to avoid these and all other structural defects, fundamentally blocking these existing attack paths and ensuring that the encryption’s security strength meets standards.

Cryptographic Protocols

4.1 Elliptic Curve Diffie–Hellman Key Exchange

To complete this key generation process, the first step is to finalize the common parameters that everyone will use — these parameters are called domain parameters, including the prime p, the two curve coefficients a and b, the generator G, the group order N, and the cofactor h. After all parameters are set, the process of generating an Elliptic Curve Diffie–Hellman (that is, ECDH) key pair becomes very simple, with no additional complex steps.

First, generate the private key: you must randomly draw an integer from the fixed set of integers {1, 2,…, N-1}, and this drawn number is the private key. It is the core private value in the entire key pair that must never be disclosed to the public, and its security relies entirely on a mathematical problem called the Elliptic Curve Discrete Logarithm Problem. Next, calculate the public key using the formula Q = d*G. The public key is a point on the elliptic curve, and even if this point is distributed publicly to everyone, it will not endanger the security of the private key. Calculating the public key Q from the private key scalar d only requires O(log N) group operations, with a very small computational load, resulting in fast key generation and high efficiency. Conversely, if someone wants to reverse-engineer the private key d from the public Q and G, they must solve the same Elliptic Curve Discrete Logarithm Problem — as long as the initially selected parameters meet current security standards, it is impossible to complete this calculation with existing computing power.

Elliptic Curve Diffie–Hellman, or ECDH, solves the core problem in key agreement: there are two people, Alice and Bob, who want to communicate, and they hope to calculate the same shared secret key known only to them over a public network channel that anyone can eavesdrop on and is completely untrusted.

Alice first calculates her own key: she generates her private key d_A, then uses the same formula to calculate her public key Q_A = d_AG; Bob also independently generates his private key d_B and calculates his public key Q_B = d_BG. The two parties transmit their respective public keys Q_A and Q_B to each other through the untrusted channel. Even if these public values are intercepted by an eavesdropper along the way, there are no security issues.

After receiving the other party’s public key, Alice calculates a shared point S = d_AQ_B = d_Ad_BG, and Bob calculates the exact same shared point S = d_BQ_A = d_Bd_AG. Scalar multiplication satisfies the commutative law, which in integer arithmetic modulo N means d_Ad_B = d_Bd_A, so the point S on the elliptic curve obtained by both parties is completely identical. Afterwards, both parties use a standardized key derivation function such as HKDF-SHA256 to extract a symmetric shared key from the x-coordinate of point S, which can be directly used to encrypt all subsequent communications.

Even if an eavesdropper intercepts the public keys Q_A and Q_B exchanged by both parties, to calculate d_Ad_BG without knowing any private key scalars, they must solve a problem called the Computational Diffie–Hellman problem. The academic community generally believes that as long as the initially selected curve is a compliant curve that meets security standards, the difficulty of cracking this problem is completely equivalent to that of the underlying Elliptic Curve Discrete Logarithm Problem, which is also impossible to solve with existing computing power.

In the TLS 1.3 protocol standard, ECDH uses its ephemeral variant, ECDHE: a completely new key pair is generated for each network session, used once and then discarded, providing forward secrecy through this mechanism. The core logic of this protection mechanism is that even if one party’s long-used private key is accidentally leaked later, it cannot be used to decrypt previously ended, recorded past session content, so previous communications remain secure.

4.2 Elliptic Curve Digital Signature Algorithm

You hold the private key d, and the public key Q is d multiplied by the base point G. Only you can generate a valid signature for a message m, and anyone who obtains your public key Q can verify the authenticity of the signature. This mechanism that allows you to sign and anyone to verify is the Elliptic Curve Digital Signature Algorithm, abbreviated as ECDSA.

The first step to generate a signature is to perform a SHA-256 hash operation on the message m to be sent, then truncate the obtained hash result to N bits to obtain the final hash value e. Next, you must randomly select a one-time random number k that is only used once, from all integers between 1 and N-1. This number must not be disclosed to anyone, it is a unique secret when you sign. Afterwards, you calculate k multiplied by G to obtain a coordinate point (x₁,y₁) on the elliptic curve. Then take the x-coordinate x₁ of this point modulo N to get r. If the calculated r is 0, this random number cannot be used, and you must return to the step of selecting a random number to start over. Finally, you must calculate s. The calculation method is to first calculate the modular N inverse of k, multiply it by the sum of (e plus r multiplied by d), and then take the result modulo N to get s. If s is 0, you must also return to this step to recalculate. The final signature that can be attached to the message is a pair of numbers consisting of r and s. Anyone who obtains this signature and your public key can use it to verify the authenticity of the message.

When verifying a signature, anyone will have three things in hand: the sender’s message m, the signature (r,s) attached to the message, and the sender’s public key Q. By following the process in order, you can confirm whether the signature was indeed issued by the key holder and whether the message has been tampered with. First, you must check whether r and s are both within the valid range of 1 to N-1. If they exceed this range, the signature is directly invalid. Next, perform a SHA-256 hash on the received message m to calculate the hash value e corresponding to the signature, then calculate the modular N inverse w of s. Afterwards, derive two parameters: u₁ is equal to e multiplied by w and then modulo N, u₂ is equal to r multiplied by w and then modulo N. Then calculate u₁ multiplied by G plus u₂ multiplied by Q to obtain the combined point (x₁,y₁) on the elliptic curve. As long as r is consistent with the result of taking this point’s x-coordinate x₁ modulo N, the signature passes verification. The correctness of this verification process has strict mathematical guarantees: u₁G + u₂Q expands to (ew + rdw)G, which simplifies step by step to k⁻¹(e+rd)wG, and finally exactly equals kG, which is completely consistent with the coordinate point calculated during signature generation. Its x-coordinate was originally the r calculated during signature generation, so the entire verification logic is completely self-consistent and error-free.

ECDSA has a fatal red line that must never be crossed: reusing the same one-time random number k. Once this is done, the security of the entire signature system will completely collapse directly. If someone really uses the same k to sign two different messages, with hash values e₁ and e₂ respectively, the generated signatures are (r,s₁) and (r,s₂). An attacker who obtains these two signatures and their corresponding messages can calculate k equal to (e₁-e₂) divided by (s₁-s₂) and then modulo N, and then calculate the private key d that only the key holder knows: d equals (s₁k – e₁) divided by r and then modulo N. With these two simple calculations, the attacker can directly steal the signature holder’s private key. All signatures generated with this private key, whether signed in the past or to be signed in the future, will completely lose protection, and attackers can forge signatures at will. The 2010 PlayStation 3 private key theft incident was caused by this vulnerability — Sony used the same fixed k for all signatures, and later a large number of crypto currency wallets were breached due to the same problem, causing irreparable losses. All current ECDSA implementations that meet security standards have blocked this vulnerability: either follow RFC 6979 to generate deterministic random numbers, or use a hardware random number generator that strictly guarantees uniqueness, ensuring that the k used for each signature is unique and unpredictable, fundamentally avoiding the risk of reusing k.

 

 

4.3 Edwards Curves and Implementation Security

To improve the security of encryption implementations, Edwards curves are a key breakthrough. Their twisted form is defined over the finite field F_p — where p is a prime congruent to 1 modulo 4 — and satisfies the equation ax²+y²=1+dx²y².

The point addition rule on Edwards curves is unified and complete — no matter which two points are added, even the special point that acts as the identity element, the same set of formulas can be used for calculation, with no exceptional cases that require separate processing.

This unified rule directly blocks the special point vulnerabilities that have always existed in Weierstrass curve implementations. These vulnerabilities can be exploited by side-channel attacks and fault injection attacks, which exploit the branch loopholes in traditional addition formulas that require separate processing of special cases.

This completeness is not just convenient to use; it is a security feature that Weierstrass curves can hardly achieve.

Curve25519 was designed by Daniel Bernstein in 2006, and is a Montgomery curve defined over F_p, where p=2²⁵⁵-19. Its supporting key agreement protocol X25519, and the signature scheme EdDSA based on its twisted Edwards form, are now one of the most widely deployed cryptographic primitives in the world, used in TLS 1.3, SSH, Signal, WhatsApp, Wire Guard, and countless other systems.

Implementation and Performance Analysis

5.1 Experimental Setup

We implemented all core operations of Elliptic Curve Cryptography using Python 3.11, specifically including point addition, point doubling, scalar multiplication, the Elliptic Curve Diffie–Hellman key exchange ECDH, and the Elliptic Curve Digital Signature Algorithm ECDSA. To conduct a performance comparison with another commonly used RSA encryption algorithm, we also called Python’s standard cryptography library to synchronously complete the corresponding operations for RSA.

All performance tests were completed on the same device, which is equipped with an Intel Core i7-12700H processor with a main frequency of 2.30GHz, 16GB RAM, and the operating system is Ubuntu 22.04 LTS.

To avoid accidental fluctuations in a single test from affecting the accuracy of the results, we repeated each encryption operation 100 times, and the final recorded indicators are the average and standard deviation of all test results, ensuring the reference value of the data.

The ECC domain parameters used in this test are NIST P-256, also known as secp256r1. In this set of parameters, p is 2^256 – 2^224 + 2^192 + 2^96 – 1, parameter a is -3, and the remaining parameters b, G, and N all use the fixed constants in this standard, fully complying with the corresponding security specification requirements.

The RSA key length used in the test is 3072 bits, which meets NIST’s guidance requirements and can provide a cryptographic security level equivalent to the 256-bit ECC configuration used in this test.

5.2 Results

The measured average time for Elliptic Curve Cryptography (ECC) to generate a key is 0.42 milliseconds, with a standard deviation of 0.03 milliseconds. For comparison, the RSA algorithm has an average key generation time of 1.31 milliseconds, with a standard deviation of 0.08 milliseconds. Calculated, ECC’s key generation speed is approximately three times that of RSA.

The ECDSA elliptic curve digital signature generated with the standardized secure curve P-256 has a total size of 64 bytes, consisting of two 256-bit integers r and s. The signature generated by the same security-level RSA-3072 algorithm is 384 bytes. In comparison, the signature size of ECDSA is about 83% smaller than that of RSA.

If the ECDH Elliptic Curve Diffie–Hellman algorithm is used to complete symmetric key exchange, that is, to allow both communicating parties to negotiate the same encryption key known only to each other, ECC’s average time to complete this handshake process each time is 0.89 milliseconds, with a standard deviation of 0.05 milliseconds. RSA takes 2.14 milliseconds to complete the same process, with a standard deviation of 0.12 milliseconds. When processing such key exchange tasks, ECC is 2.4 times faster than RSA.

During the operation of all cryptographic operations, ECC’s total memory usage is between 1.2 and 1.5 kilobytes. RSA’s memory requirement is 3.8 to 4.2 kilobytes. ECC’s memory usage is about two-thirds less than RSA’s, that is, it only uses about one-third of the memory that RSA uses.

Finally, a two-tailed t-test confirmed that all differences in performance and resource usage between the two cryptographic systems are statistically significant, with p<0.001.

5.3 Discussion

These test results are consistent with previous benchmark conclusions, repeatedly confirming that ECC’s efficiency advantages in key exchange and digital signature processes are particularly prominent.

A three times faster key generation speed and 2.4 times faster key exchange speed are not just empty numbers in practical scenarios; they directly lead to faster TLS handshakes, reduced server load, and lower device energy consumption — all of which are core rigid requirements for mobile and Internet of Things devices. These devices have limited computing power and tight battery life, and the saved computing power and electricity can be directly converted into improved practical usage experience.

Another considerable improvement is that the signature size is reduced to one-sixth of the original: ECC signatures are only 64 bytes, while RSA signatures are 384 bytes. This compression effect is particularly critical for bandwidth-constrained applications, such as block chain transactions, sensor networks, and satellite communications — these scenarios either need to transmit massive amounts of small data simultaneously, or the transmission bandwidth itself is expensive and scarce. Smaller signatures mean that the same bandwidth can carry more valid data, without wasting bandwidth on additional encryption verification information.

Bitcoin and Ethereum use secp256k1 to handle all key management and transaction signature work. The approximately 19 million BTC currently in circulation, with a total value of hundreds of billions of dollars, all rely on the Elliptic Curve Discrete Logarithm Problem on secp256k1 to guarantee security.

However, this study also has limitations: it only focuses on the classical non-quantum security model, and does not cover the risks that may arise from the deployment of large-scale quantum computers. If a quantum computer with sufficient computing power appears in the future, Shor’s algorithm running on it could crack ECC — cracking a 256-bit ECC would require approximately 2330 logical qubits, which under current technical conditions would require millions of noisy physical qubits to implement.

Such a machine does not exist today, but the threat model of “intercept data now, decrypt later” has made the migration to post-quantum cryptography urgent. If encrypted data that is secretly stored today is cracked after quantum computers are built, all security protections relying on ECC will fail, and transition preparations must be made in advance.

Security Analysis

6.1 Attack Methods on the Elliptic Curve Discrete Logarithm Problem

To crack the core problem that supports the security of elliptic curve cryptography — the Elliptic Curve Discrete Logarithm Problem — the most well-known of all existing classical algorithms is Pollard’s rho algorithm. The expected number of group operations for this algorithm to complete the entire cracking process is √N. When N is approximately 2^256, the number of operations it needs to complete is approximately 2^128 — a computational load of this magnitude is completely impossible to achieve with conventional computing power.

If this optimal algorithm is not used, and the most primitive exhaustive search, that is, brute-force cracking, is used instead, N full operations are required, and the overall efficiency is much worse than Pollard’s rho algorithm.

There is also a commonly used class of attack methods called index calculus. This set of methods was once able to achieve subexponential-level attacks against the classic discrete logarithm problem on finite field multiplicative groups, that is, it could compress the astronomical amount of computation originally required by several orders of magnitude. However, this set of methods cannot be extended to elliptic curve problems over prime fields, and is completely unusable in elliptic curve scenarios.

Even if all established classical attack methods are included, the complexity class to which the Elliptic Curve Discrete Logarithm Problem belongs is higher than that of the classic discrete logarithm problem or the large integer factorization problem, which is the reason for this.

6.2 Side-Channel and Implementation Attacks

In addition to purely mathematical attacks, Elliptic Curve Cryptography (ECC) schemes deployed in various types of devices must also face three types of specific attack methods that are closer to hardware operating conditions and more difficult to prevent in advance. The first is timing attacks, which can capture subtle differences in the time each calculation takes when a program runs, stealing information related to the secret scalar hidden in the system. The second is power analysis: as long as an attacker can monitor the power consumption fluctuations of the device during the scalar multiplication process, they can gradually restore the bit pattern of the private key. The third is fault injection: by artificially creating voltage glitches, laser pulses, and other errors that disrupt normal calculations, the private key can be extracted from the system.

Corresponding protection measures exist for these three types of attacks: when writing code, implement constant-time execution to avoid runtime differences caused by different inputs; use randomized projective coordinates to disrupt the fixed pattern of the calculation process; add blinding to the scalar to prevent attackers from capturing fixed operation characteristics; and add dedicated fault detection circuits to intercept man-made calculation errors in time.

There is also a special type of curve construction that can fill additional security vulnerabilities: Edwards curves, which come with a complete set of addition laws, natively blocking some vulnerabilities targeting special points that inadequately defined elliptic curve constructions cannot avoid.

6.3 Post-Quantum Considerations

Shor’s algorithm, proposed in 1994, proved that as long as a quantum computer is large enough, it can solve all discrete logarithm problems in polynomial time, that is, on the order of (log N) cubed — including cracking the core elliptic curve discrete logarithm problem of ECC. In other words, the mathematical barrier that currently supports ECC’s security will directly fail in the face of a sufficiently large quantum computer. To crack a 256-bit ECC, a quantum computer only needs to complete error correction, requiring only about 2330 logical qubits to complete the attack.

The National Institute of Standards and Technology (NIST)’s post-quantum cryptography standardization work was officially completed in 2024, and four algorithms were ultimately selected for inclusion in the standard: the first is the lattice-based key encapsulation mechanism ML-KEM (Kyber); the second is the lattice-based digital signature algorithm ML-DSA (Dilithium); the third is the stateless hash-based signature algorithm SLH-DSA (Sphincs+); the fourth is the lattice-based signature FN-DSA (Falcon), which serves as an alternative to Dilithium. None of these four algorithms have the elegant algebraic geometric properties of ECC. They abandoned mathematical aesthetics in exchange for security that can resist quantum attacks — this is a pragmatic compromise made to the laws of quantum mechanics.

There is also a class of hybrid encryption schemes that combine traditional ECC with post-quantum cryptographic algorithms. As long as the security assumptions of either of the two systems hold, the overall communication is secure, and all information will not be leaked just because one system is compromised. The logic of these schemes to generate a shared key is clear: first concatenate the calculation result of ECDH with the result generated by the post-quantum key encapsulation mechanism, then input it into a key derivation function, and finally calculate the shared key that only the communicating parties can obtain. Currently, TLS 1.3 already supports such hybrid key exchange schemes, such as X25519Kyber768, and mainstream browsers are actively deploying this solution to enable security guarantees during this transition phase to be implemented as soon as possible.

Applications and Real-World Deployment

7.1 TLS 1.3 and HTTPS

Every HTTPS connection establishment requires a calculation related to Elliptic Curve Cryptography — that is, the ECC-related operations you often hear about. Even the most ordinary internet access requires this encryption process to run in the background, but the entire process is so fast that you never notice it.

If a TLS 1.3 handshake negotiates TLS_AES_256_GCM_SHA384 while using the X25519 key exchange, then the client and server will run the ephemeral Elliptic Curve Diffie–Hellman algorithm to generate a shared session key. This ephemeral algorithm is ECDHE, which you use to exchange keys. No real secrets are transmitted over the network throughout the process, yet both parties end up calculating the same key used to encrypt all subsequent communications. Even if an eavesdropper intercepts all the public information you transmit, they cannot calculate what this key is.

After generating the session key, the server completes identity authentication to the client via ECDSA-P256 or Ed25519. The logic of this identity authentication is the same as signing your name on a letter — only the server’s private key can generate a valid digital signature. The client only needs to verify it with the server’s public public key to confirm that the opposite server is genuine, not an imposter phishing server, and also confirm that the transmitted authentication content has not been tampered with by anyone.

From parameter negotiation and key exchange to identity authentication, the entire connection setup process only requires one round trip, taking less than 10 milliseconds. Even network engineers from decades ago would hardly imagine that a handshake process requiring complex encryption calculations could be this fast.

TLS 1.3 does not support RSA key exchange, and ECC is a mandatory function. This standard was formulated to completely replace the old, computationally intensive, low-security-efficiency RSA, using only the lighter and more secure Elliptic Curve Cryptography to support the security requirements of all network connections.

7.2 Blockchain and Cryptocurrencies

Bitcoin and Ethereum use the secp256k1 curve, which is an elliptic curve defined over a prime field — the prime p mentioned here is exactly 2^256 – 2^32 – 977, and the mathematical expression of the entire curve is written as y²=x³+7. The reason for choosing this curve is that its security properties have been verified over a long period of time, and it can run efficiently on various blockchain networks.

The rules for generating Bitcoin addresses are clear, with a fixed operation order for each step: first perform a SHA256 hash operation on the public key Q, then perform a RIPEMD160 hash on the obtained result, and finally convert it into a short string of identifiers using Base58Check encoding, which is less prone to errors during transcription and format conversion.

Currently, there are about 19 million bitcoins in circulation, with a total value of hundreds of billions of dollars. The security of these encrypted assets distributed around the world is all supported by the Elliptic Curve Discrete Logarithm Problem corresponding to the secp256k1 curve. This mathematical problem has not been cracked by anyone to this day, and it is precisely because of its intractability that the phrase often said by cryptocurrency holders, “your keys, your coins,” is not an empty slogan, but a truly reliable guarantee.

7.3 Secure Messaging (Signal Protocol)

The Signal Protocol used by Signal, WhatsApp, and many other platforms is implemented by stacking multiple basic components of Elliptic Curve Cryptography. These basic components are all standard modules in cryptography, which can be pieced together to build a secure encryption system. The X3DH in this protocol, that is, the Extended Triple Diffie–Hellman protocol, combines three types of Elliptic Curve Diffie–Hellman keys: long-term, semi-ephemeral, and ephemeral. Long-term keys are retained for a long time, semi-ephemeral keys are discarded after being used for a period of time, and ephemeral keys are discarded after a single use. The cooperation of these three types of keys disperses the risk of key leakage. In addition, the Double Ratchet mechanism alternates between symmetric key rotation and Elliptic Curve Diffie–Hellman-based key updates. The two types of key update methods work in turn, and a new set of keys is generated after each message is transmitted, so there is no situation where the same set of keys is always used for encryption. In the end, even if an attacker breaches all of the server’s permissions and obtains all the data stored on the server, they can only read a single message, and they have no access to any past or future message content beyond that. Even if a hacker obtains the decryption key for a certain message, they cannot use that key to trace back to previous chat records, let alone calculate the new keys that will be used later. Twenty years ago, this security feature was still a theoretical impossibility.

7.4 Passwordless Authentication (FIDO2/WebAuthn)

The FIDO2 standard that supports WebAuthn relies on the ECDSA algorithm based on the P-256 curve for the core of its credential generation and user identity verification. Simply put, this passwordless login logic, from generating your exclusive identity credential to verifying whether you are the legitimate holder of the account each time you log in, uses the Elliptic Curve Digital Signature Algorithm, or ECDSA, running on the P-256 curve, which has undergone years of security verification.

When you purchase a physical security key such as YubiKey, the first time you bind and register it with a website, a pair of ECDSA public and private keys will be generated locally on the key. After generation, the private key will always be locked in the key’s own tamper-proof hardware, never leaving the physical device. Even if an outsider disassembles the key, they cannot steal the private key inside. Later, every time you use this key to log in to a website, that is, to verify your identity, the website’s server will first issue a random verification challenge that is only valid for the current login. After your physical key receives this challenge, it will use the stored private key to generate a corresponding encrypted signature for this challenge, and then submit this signature to the server.

After the server receives the signature, it uses the public key you stored on the server when you registered your account to verify whether the ECDSA signature you submitted this time is valid. As long as the verification passes, it confirms that you are the legitimate account holder and allows you to log in. Throughout the entire process, the server never creates or stores any passwords, and does not rely on storing passwords to complete identity verification at all, fundamentally avoiding the risk of password leakage.

Conclusion and Future Work

This article comprehensively sorts out the mathematical logic of Elliptic Curve Cryptography, from the algebraic geometric foundation of elliptic curves over finite fields all the way to the practical implementation of Elliptic Curve Diffie–Hellman and Elliptic Curve Digital Signature Algorithm, clearly organizing the context from theory that supports this cryptographic system to its application.

The core conclusion we measured is that ECC can achieve a security level equivalent to RSA with a much shorter key than RSA. Specifically, 256-bit ECC has roughly the same security strength as 3072-bit RSA. The core reason behind this is that the difficulty of cracking the Elliptic Curve Discrete Logarithm Problem is exponential, far higher than the subexponential difficulty of cracking the integer factorization problem. The computational cost required to break ECC is much higher than that required to break RSA with the same security level, which is why short keys can withstand the same attack risks as long keys.

The performance data from actual tests also confirm ECC’s advantages: key generation speed is 3 times that of RSA, key exchange speed is 2.4 times faster, and the generated signature size is only 1/6 of that of RSA. Whether it is the computational effort required or the bandwidth occupied during transmission, it is far more cost-effective than traditional RSA.

Not just any elliptic curve can be used for encryption. The currently common standardized curves, such as P-256, Curve25519, and secp256k1, have undergone decades of repeated attack testing by the cryptography community, specifically avoiding types with inherent structural vulnerabilities such as supersingular curves and anomalous curves, blocking security risks at the source. Today, ECC is a mandatory requirement for TLS 1.3, and is also the security foundation for core scenarios such as blockchain, encrypted chat, and passwordless authentication. It is part of the security line of defense for the vast majority of network services we use daily.

Next, the research needs to advance several core directions. First, we must complete the transition to the post-quantum era, develop hybrid schemes of ECC plus post-quantum cryptography for TLS, blockchain, and various communication protocols, and proactively address the security threats that quantum computers may bring. Second, we must implement hardware acceleration for Internet of Things and edge devices, use FPGA and ASIC to deploy ECC in hardware, so that these small devices with limited computing power can also run secure encryption smoothly, which is another core priority. In addition, any high-security-level application must complete formal verification — that is, use machines to verify ECC’s implementation code, completely block the vulnerabilities of side-channel attacks and fault injection attacks, and eliminate all hidden dangers that may be left by human-written code. Finally, we must follow up on standard updates, especially more post-quantum algorithms currently being evaluated by NIST, and the integration of these algorithms with existing ECC infrastructure. These work will define the implementation direction of cryptographic protocols in the next stage.

Many people may not realize that the mathematical theory that underpins this modern cryptographic system was born more than a hundred years ago. The chord-and-tangent group law on cubic curves was developed as a purely abstract algebraic theory in the 19th century, and the mathematicians who studied it at that time only regarded it as a pure mathematical problem. Galois proposed finite field theory in the 1830s when studying the solvability of polynomials — at that time, it was only a problem that satisfied mathematical aesthetics, and the people who studied it only thought this mathematical logic was beautiful, completely unrelated to engineering applications. No one thought it could be used for any secure communication. Later, the Hasse bound, Mordell–Weil theorem, and Weil conjectures were gradually improved by Weil, Grothendieck, Deligne, and others in the process of promoting the unification of algebraic geometry and number theory. At that time, no one could have imagined that these niche theories would be used in network security, let alone that they would become an indispensable technical foundation for all mankind.

None of the scholars who devoted themselves to pure mathematical research expected that the abstract derivations they wrote in their papers would one day support the secure communication systems used by billions of people. Looking at it today, every HTTPS lock icon on a browser, every blockchain transaction, every Signal message, every passwordless login, all run on these abstract mathematical structures. These structures operate at GHz-level speeds, protecting the security of every communication around the world. Even if you send a message across half the country, this set of mathematical theories from more than a hundred years ago can keep your secrets safe. In 2025, the most widely used cryptographic primitives are all thelanded results of 19th-century pure mathematical research, which is probably a romantic coincidence that those mathematicians would never have imagined.

References

Abdulnabi, M. W. (2026). Performance Analysis of Elliptic Curve Cryptography. International Journal of Electrical and Electronics Engineering, 643.

Ali, H. A. (2025). Leveraging Elliptic Modern Techniques in Secure Communication. 13th International Conference on Applied Innovations in IT.

Analysis Of Attack Methods Based on Elliptic Curve Discrete Logarithm Problem. (2026). Applied Journal of Science and Technology, 33329.

Bernstein, D. J. (2006). Curve25519: New Diffie–Hellman speed records. In Public Key Cryptography — PKC 2006, LNCS 3958.

Bernstein, D. J., & Lange, T. (2007). Faster addition and doubling on elliptic curves. In ASIACRYPT 2007, LNCS 4833.

Hankerson, D., Menezes, A., & Vanstone, S. (2004). Guide to Elliptic Curve Cryptography. Springer.

Koblitz, N. (1987). Elliptic curve cryptosystems. Mathematics of Computation, 48(177), 203–209.

Kyars, K. (2025). Elliptic Curve Cryptography: Secure Digital Communication. Columbia Journal of Undergraduate Mathematics, 14295.

Lakshman, Prof. Dr. (2025). Latest (2024–2025) updates and changes related to research paper structure, publication standards, and academic writing. LinkedIn.

MathLumen. (2025). Elliptic Curve Cryptography: The Mathematics Protecting the Digital World.

Miller, V. S. (1985). Use of elliptic curves in cryptography. In Advances in Cryptology — CRYPTO ’85, LNCS 218.

NIST FIPS 186-5. (2023). Digital Signature Standard. National Institute of Standards and Technology