Elliptic Curve Cryptography Explained: ECC, ECDSA, ECDH

TLS 1.3, the latest version of the Transport Layer Security protocol, uses Elliptic Curve Diffie-Hellman (ECDH) key exchange to provide forward secrecy, ensuring that past communications remain secure even if long-term private keys are compromised; the protocol consists of a handshake protocol for mutual authentication and establishing a shared master secret, followed by a record protocol for encrypting and authenticating all data exchanged using AES-GCM or ChaCha20-Poly1305 authenticated encryption schemes.

ECDH enables secure key exchange: parties agree on curve parameters, generate secret keys and public keys (A = d_A × G, B = d_B × G), exchange public keys, and compute shared secret S = d_A × B = d_B × A. ECDSA provides digital signatures: signing involves hashing message to Z, generating random k, computing R = k × G (x-coordinate mod N), and S = k⁻¹(Z + d_A × R) mod N. Verification computes P = U1 × G + U2 × Q and checks x-coordinate equals R. Only the private key holder can create valid signatures, while anyone can verify. These protocols power TLS, SSH, and other secure communication systems.

ECC provides equivalent cryptographic security to RSA using substantially smaller key sizes, making it ideal for resource-constrained devices like mobile phones. NIST strongly recommends ECC, and it has been widely adopted in protocols including TLS, SSH, and Bitcoin, as well as in digital certificate infrastructure. However, ECC faces quantum computing threats, as quantum algorithms can potentially break cryptographic systems with sufficient computational power. To maintain security against emerging quantum threats, ECC implementations require significantly longer key lengths to achieve equivalent resistance levels.

ECC implements practical security protocols through three mechanisms: ECDH enables secure key exchange where parties derive identical shared secrets without transmitting private values; ECDSA creates verifiable digital signatures proving message authenticity and origin; ECIES encrypts messages using symmetric keys derived from elliptic curve operations. In ECDH, Bob and Alice agree on curve parameters, generate private values, exchange public keys, and compute shared secrets through scalar multiplication. ECDSA generates signatures (R, S) using private keys, allowing verification through public keys. ECIES combines elliptic curve key derivation with symmetric encryption (AES/ChaCha20). These protocols power modern internet security (TLS/SSL) and cryptocurrencies (Bitcoin). The discrete logarithm problem ensures computational infeasibility of deriving private keys from public information, making these protocols secure against interception and tampering.

Elliptic curve cryptography (ECC) is used in TLS for key exchange, providing equivalent security to RSA with smaller key sizes. The elliptic curve is a mathematical curve used to generate public and private key pairs. Public key exchange is the process by which clients and servers establish a shared secret for encryption. The exchange uses asymmetric cryptography, where the public key encrypts and the private key decrypts. This enables secure communication without prior key sharing.

Elliptic Curve Cryptography (ECC) uses curves defined by equations with modular arithmetic. Point addition on the curve produces another point on the curve. Main curves: Curve25519 (Bitcoin), secp256k1 (Bitcoin/Ethereum), NIST P-256. Private keys are 256-bit scalars; public keys are 52-byte points. Compressed points (0x02/0x03 prefix) store only X-coordinate, reducing size by half. Key formats: DER (binary), PEM (text with base64), PFX/P12 (password-protected). Object Identifiers (OIDs) identify cryptography types. Key rings store public keys of communication partners.

Elliptic curve cryptography (ECC) provides equivalent security to RSA with significantly smaller key sizes (256-bit private keys vs. 2048+ bits for RSA). The mathematical foundation is the elliptic curve equation y² = x³ + ax + b mod p, where point multiplication forms the basis of security. ECDSA (Elliptic Curve Digital Signature Algorithm) is used in Bitcoin and Ethereum for transaction signing. Standard curves include secp256k1 (Bitcoin/Ethereum), Curve25519 (Tor), and NIST curves. Wallet addresses derive from private keys through hashing and encoding processes.

This section explains the elliptic curve secp256k1 used in Bitcoin, defined by y² = x³ + 7 over Fp. Satoshi chose this curve because it is not a NIST standard, avoiding potential NSA influence concerns. The curve is now used by many cryptocurrencies including Ethereum. The section explains that not every point on the curve is a valid public key; only points generated by the base point G are valid. It covers different representations: uncompressed (04 prefix with x and y coordinates) and compressed (02 or 03 prefix with only x coordinate, with y recovered from the curve equation).

The secp256k1 curve (y² = x³ + 7) represents the de facto standard for elliptic curve cryptography in cryptocurrencies. Defined over a massive prime field approximately equal to 2²⁵⁶, this curve powers Bitcoin and subsequently Ethereum wallets. A private key d generates a public key through scalar multiplication: d × G, where G is a predetermined base point. Satoshi Nakamoto deliberately selected this non-NIST curve to avoid potential backdoors in standardized algorithms. The curve's widespread adoption led NIST to include it in their standards appendix in February 2023 for interoperability. This demonstrates how foundational mathematical research translates into billions of dollars in economic value through secure digital asset transfers.

NIST curves are standardized elliptic curves defined by the NIST FIPS 186-4 standard for cryptographic applications, featuring specific parameters including a prime field p, curve equation coefficients, a generator point, and order n; however, these curves were designed by the NSA and have raised security concerns since the Snowden revelations exposed that nation-states may intentionally embed backdoors in cryptographic standards to compromise encryption systems.

Countermeasures for side-channel attacks include: (1) Input point validation - checking that all input points are valid before processing, which blocks this specific attack but doesn't eliminate leakage; (2) Point blinding - shifting the input to a random location before processing and then shifting back, which blocks chosen ciphertext attacks but has performance costs; (3) Hardware redesign to prevent leakage, which is impractical. The attack demonstrates that even with constant-time implementations, side-channel attacks can extract keys if the underlying arithmetic leaks information. The leakage persists even when the attack is blocked, meaning more advanced attacks may still be possible with more measurements and different techniques.

Nonce@Once is an electromagnetic side channel attack that exploits the systematic bias in conditional swap operations within constant-time ECC implementations (as specified in RFC 7748), allowing attackers to recover private keys from a single signing operation by training a classifier on known nonces and clustering the resulting EM signals to identify bit values, with mitigation achieved through randomization of the swap delta to eliminate leakage amplification.

Constant-time cryptographic implementations are designed to prevent side channel attacks by ensuring execution time and memory access patterns do not depend on secret keys. However, the discovery of data memory dependent prefetchers (DMP) has shown that even properly implemented constant-time cryptography can be compromised through microarchitectural side channels. Researchers demonstrated practical key extraction attacks against both classical (RSA, Diffie-Hellman) and post-quantum cryptographic implementations, proving that side channel defenses must account for all processor microarchitectural features. The attack works by inducing cryptographic operations on crafted inputs and monitoring cache behavior to infer secret key properties.

This section covers side channel attacks that exploit implementation details rather than mathematical weaknesses. Examples include timing attacks (measuring operation duration to infer key bits), power analysis (measuring CPU power consumption), and cache timing attacks. The speaker explains that even logically correct implementations can be vulnerable. NIST's elliptic curves are particularly problematic because they cannot be implemented in constant time, making them susceptible to timing attacks that leak key information. The section emphasizes that correct implementations are essential for security, and that protocols are the most difficult to get right.

Side channels are mechanisms by which adversaries learn internal program state, particularly dangerous in cryptography where learning a few bits of a secret can lead to full key recovery. Timing side channels occur when code branches on secret data, causing different execution times based on cache hits/misses. Differential power analysis measures power consumption patterns. To prevent side channels, code must execute identically regardless of secret values. LLVM's optimizer does not break constant-time properties for x86, but some processors (like certain PowerPC chips) have instructions that return early for zero multiplication, making constant-time guarantees impossible on such platforms. The implementation uses extensive shifting operators and carry propagation to maintain constant-time behavior.

Pairing-based cryptography, developed from elliptic curve mathematics, enables powerful cryptographic applications including ZK-SNARKs (Zero-Knowledge Succinct Non-interactive Arguments of Knowledge), which allow efficient verification of complex computations without revealing underlying data. This technology has become fundamental to modern blockchain scaling solutions like rollups, enabling privacy-preserving transactions and efficient proof systems. The key insight is that pairings provide an additional algebraic structure on elliptic curves that allows efficient computation of inner products on committed data, enabling applications from identity-based encryption to advanced privacy-preserving protocols.

Pairings (bilinear maps) map two elliptic curve points to a target field point. Destructive use involves attacks where adversaries compute pairings between public keys and secret keys, revealing secrets. Constructive use enables elegant applications like identity-based encryption and zero-knowledge proofs. Otto Goldreich's 2000 work demonstrated constructive applications. The embedding degree K must be carefully chosen: large enough for security, small enough for practical computation.

Pairing-based cryptography leverages special elliptic curves (BN and BLS curves) to create bilinear maps between groups G₁ and G₂, enabling advanced cryptographic protocols such as BLS signatures, identity-based encryption, multi-party key exchange, and zero-knowledge proofs (zk-SNARKs). The core mechanism relies on the bilinearity property, which allows operations like e(a×u, b×v) = e(u,v)^(a×b), enabling efficient verification of cryptographic proofs without revealing underlying secrets.

Pairing functions in elliptic curve cryptography enable multiplication of two encrypted values, producing a result that depends on the product of the underlying unencrypted values. This operation satisfies: if a×b = c×d, then pairing(a,b) = pairing(c,d); and if a×b ≠ c×d, then pairing(a,b) ≠ pairing(c,d). This non-degenerate property enables verification of polynomial relationships without revealing the actual values, forming the basis for succinct zero-knowledge proofs.