STANDARS FOR EFFICIENT CRYPTOGRAPHY

SEC X.2: Recommended Elliptic Curve Domain
Parameters

Nippon Telephone and Telegraph Corporation
Contact: Kazumaro Aoki, Tetsutaro Kobayashi, and Akira Nagai(publickey@lab.ntt.co.jp)
Working Draft
August 6, 2008
Version 0.6
c NTT 2008

SEC 2.X: Recommended Elliptic Curve Domain Parameters

1

2

Recommended Elliptic Curve Domain Parameters over
Fpm

This section specifies the elliptic curve domain parameters over Fpm recommended in this document. The section is organized as follows. First Section 1.1 describes relevant properties of therecommended parameters over Fpm . Then Section 1.2 specifies recommended 305-bit elliptic curve
domain parameters over Fpm , Section 1.3 specifies recommended 427-bit elliptic curve domain parameters over Fpm , Section 1.4 specifies recommended 671-bit elliptic curve domain parameters
over Fpm ,1.1

Properties of Elliptic Curve Domain Parameters over Fpm

Following SEC X.1 [1] , elliptic curve domain parameters over Fpm are an octuple:
T = (p, m, f (x), a, b, G, n, h)
consisting of an integer p and m specifying the finite field Fpm , an irreducible polynomial f (x) ofdegree m specifying the polynomial basis representation of Fpm , two elements a, b ∈ Fpm specifying
an elliptic curve Fpm defined by the equation:
E : y 2 = x3 + ax + b in Fpm
a base point G = (xG , yG ) on E(Fpm ), a prime n which is the order of G, and an integer h whichis the cofactor h = #E(Fpm )/n.
When elliptic curve domain parameters are specified in this document, each component of this
ocptuple is represented as an octet string converted using the conventions specified in SEC X.1[1].
Again following SEC X.1 [1], elliptic curve domain parameters over E(Fpm ) must have:(p, m) ∈ {(261 − 1, 5), (261 − 1, 7), (261 − 1, 11)}This restriction is designed to encourage interoperability while allowing implementers to supply
commonly required security levels. For a Koblitz curve, domain parameters over E(Fpm ) with
dlog2 pm e = 2t supply approximately t bits of security. Meanwhile, for the verifiably random
elliptic curve, domain parameters over E(Fpm ) with dlog2 pm−1 e = 2t supply approximately t bitsof security. This means that solving the logarithm problem on the associated elliptic curve isbelieved to take approximately 2t operations.
Furthermore elliptic curve domain parameters over Fpm must use the reduction polynomials listed
in Table 1 below.
This restriction is designed to encourage interoperability while allowing implementers to supply
efficient implementations at commonly required security levels.
Here recommended elliptic curve domain parameters are supplied at each of the sizes allowed by
SEC X.1 [1].
The elliptic curve domain parameters over Fpm supplied at the field size consist of examples of two

SEC 2.X: Recommended Elliptic Curve Domain Parameters
Field
F(261 −1)5
F(261 −1)7
F(261 −1)113

Reduction Polynomial(s)f (x) = x5 − 3
f (x) = x7 − 3
f (x) = x11 − 3Table 1: Representations of Fpm

different types of parameters. Concretely speaking, one type being parameters associated with a
Koblitz curve and the other type being parameters chosen verifiably at random.
Verifiably random parameters offer some additional conservative features. These parameters arechosen from a seed using SHA-1 as specified in SEC X.1 [1]. This process ensures that theparameters cannot be predetermined. The parameters are therefore extremely unlikely to besusceptible to future special-purpose attacks, and no trapdoors can have been placed in theparameters during their generation. When elliptic curve domain parameters are chosen verifiably
at random, the seed S used to generate the parameters may optionally be stored along with theparameters so that users can verify the parameters were chosen verifiably at random.
See SEC X.1 [1] for further guidance on the selection of elliptic curve domain parameters overFpm .
The example elliptic curve domain parameters over Fpm have been given nicknames to enable
them to be easily identified. The nicknames were chosen as follows. Each name begins with sec
to denote ‘Standards for Efficient Cryptography’, followed by an o to denote parameters over Fpm ,followed by a number denoting the field size n, followed by a k to denote parameters associatedwith Koblitz curves or an r to denote random parameters, followed by a sequence number.
Table 2 summarizes salient properties of the recommended elliptic curve domain parameters overFpm . Information is represented in Table 2 as follows. The column labelled ‘parameters’ gives
the nickname of the elliptic curve domain parameters. The column labelled ‘section’ refers to thesection of this document where the parameters are specified. The column labelled ‘strength’ gives
the approximate number of bits of security the parameters offer. The column labelled ‘size’ gives
the field size. The column labelled ‘RSA/DSA’ gives the approximate size of an RSA or DSA
modulus at comparable strength. (See SEC 1 [2] for precise technical guidance on the strengthof elliptic curve domain parameters.) Finally the column labelled ‘Koblitz or random’ indicates
whether the parameters are associated with a Koblitz curve — ‘k’ — or were chosen verifiably at
random — ‘r’.

1.2

Recommended 305-bit Elliptic Curve Domain Parameters over an
odd characteristic extension field Fpm

This section specifies the two recommended 305-bit elliptic curve domain parameters over Fpm
in this document: parameters seco305k associated with a Koblitz curve, and verifiably randomparameters seco305r.
Section 1.2.1 specifies the elliptic curve domain parameters seco305k, and Section 1.2.2 specifies

SEC 2.X: Recommended Elliptic Curve Domain Parameters
Parameters
seco305k
seco305r
seco427k
seco427r
seco671k
seco671r

Section
1.2.1
1.2.2
1.3.1
1.3.2
1.4.1
1.4.2

Strength
112
128
160
192
256
256

Size
305
305
427
427
671
671

RSA/DSA
2048
3072
3072
7680
15360
15360

4
Koblitz or random
k
r
k
r
k
r

Table 2: Properties of Recommended Elliptic Curve Domain Parameters over an odd charateristic
extension field Fpm

the elliptic curve domain parameters seco305r.
1.2.1

Recommended Parameters seco305k

The elliptic curve domain parameters over Fpm associated with a Koblitz curve seco305k are
specified by the ocptuple T = (p, m, f (x), a, b, G, n, h) where p = 261 − 1, m = 5 and the representation of Fpm is defined by:
p = 261 − 1= 1FFFFFFF FFFFFFFF
f (x) = x5 − 3
The curve E: y 2 = x3 + ax + b over Fpm is defined by:a =00000000000000b =00000000000000

00000000
1FFFFFFF
00000000
0FE3A248

00000000 00000000 00000000 00000000 00000000
FFFFFFFC
00000000 00000000 00000000 00000000 00000000
499DD27E

E was chosen verifiably at random from the seed:
S = 4E545420 436F7270 6F726174 696F6E00 04A90700
E was selected from S as specified in SEC X.1 [1] in section 3.1.3.1.
The base point G in compressed form is:
G = 0300595E EA64AD0D 9495D3AC CC43EEBE E2DD7E75 DDA8E143 08EC3E80
C68B117C C51D0B73 19455C8B
and in uncompressed form is:
G =040059 5EEA64AD 0D9495D3 ACCC43EE BEE2DD7E 75DDA8E1 4308EC3E
80C68B11 7CC51D0B 7319455C 8B0129D3 6A8F0366 C35FED32 C256A940
65F0B440 E504DE2A E86E7586 C4658836 F1D7FD89 9E59288F

SEC 2.X: Recommended Elliptic Curve Domain Parameters

5

G was selected from S as specified in SEC X.1 [1] in section 3.1.3.2.
Finally the order n of G and the cofactor are:n =100000 00012E8C BC001659 05BE2A45 1CE16B8A 290B3477 AE30812C
3C2D0183h = 1FFFFFFF FDA2E683

1.2.2

Recommended Parameters seco305r

The verifiably random elliptic curve domain parameters over Fpm seco305r are specified by theocptuple T = (p, m, f (x), a, b, G, n, h) where p = 261 − 1, m = 5 and the representation of Fpm isdefined by:
p = 261 − 1= 1FFFFFFF FFFFFFFF
f (x) = x5 − 3
The curve E: y 2 = x3 + ax + b over Fpm is defined by:a =00000000000000b =00CE6A
79A295C400000000
1FFFFFFF
C542EE65
7407C791

00000000 00000000 00000000 00000000 00000000
FFFFFFFC
694530D7 770BF7DA 97B0B987 1FD7E363 5F312903
6C5490A9

E was chosen verifiably at random from the seed:
S = 4E545420 436F7270 6F726174 696F6E00 03EB0100
E was selected from S as specified in SEC X.1 [1] in section 3.1.3.1.
The base point G in compressed form is:
G = 02000000 00000000 00000000 00000000 00000000 36A8C2E2 137228E0
9A4D8A2C A664293E 1FDE3D99
and in uncompressed form is:
G =020000 00000000 00000000 00000000 00000000 0036A8C2 E2137228
E09A4D8A 2CA66429 3E1FDE3D 99003F79 D371C332 AEDB593A 79AF160B
C75FCA4D 37FD3D10 EA05D658 BAD0B23F A3BF7EBC C239EA30

G was selected from S as specified in SEC X.1 [1] in section 3.1.3.2.
Finally the order n of G and the cofactor are:n =1FFFF FFFFFFFF FFB00000 00000000 04FFFFFF FFCB2305 2FF95755
191DFC31 0D16E689 24D05D97
h =01

SEC 2.X: Recommended Elliptic Curve Domain Parameters

1.3

6

Recommended 427-bit Elliptic Curve Domain Parameters over an
odd characteristic extension field Fpm

This section specifies the two recommended 427-bit elliptic curve domain parameters over Fpm
in this document: parameters seco427k associated with a Koblitz curve, and verifiably randomparameters seco427r.
Section 1.3.1 specifies the elliptic curve domain parameters seco427k, and Section 1.3.2 specifies
the elliptic curve domain parameters seco427r.
1.3.1

Recommended Parameters seco427k

The elliptic curve domain parameters over Fpm associated with a Koblitz curve seco427k are
specified by the ocptuple T = (p, m, f (x), a, b, G, n, h) where p = 261 − 1, m = 7 and the representation of Fpm is defined by:
p = 261 − 1= 1FFFFFFF FFFFFFFF
f (x) = x7 − 3
The curve E: y 2 = x3 + ax + b over Fpm is defined by:
a =

0000
00000000b =0000
00000000

00000000
00000000
00000000
00000000

00000000
00000000
00000000
00000000

00000000
00000000
00000000
00000000

00000000
00000000
00000000
00000000

00000000
1FFFFFFF
00000000
02ADD02E

00000000FFFFFFFC
00000000
768A202C

E was chosen verifiably at random from the seed:
S = 4E545420 436F7270 6F726174 696F6E00 07006400
E was selected from S as specified in SEC X.1 [1] in section 3.1.3.1.
The base point G in compressed form is:
G =020363 0C3DBA08 22C233D0 D60BF2C8 51FB907B 32DA9960 0B1608F2
56FC5D09 963501EF 135D35D6 5C02A14D BAFD5065 C3DD7403 68EF6F2B

and in uncompressed form is:
G =04
08F256FC
6F2B0732
82B90C5E

03630C3D
5D099635
9DD20851
7DC39032

BA0822C2
01EF135D
CBF0648C
BC6E7E5A

33D0D60B
35D65C02
A866E706
DDC8F05B

F2C851FB
A14DBAFD
B4F9EDF5
0431B135

907B32DA
5065C3DD
4B01B380
611F2008

99600B16
740368EF
2D0BD08D
271C2502

G was selected from S as specified in SEC X.1 [1] in section 3.1.3.2.
Finally the order n of G and the cofactor are:n =3FFF FFFF295D 7D42CFD0 66D2958D 0A0A4A6C 1FF5C071 2E26C0D2
5F864565 81E78118 14207946 E4FBC329 32B1872D
h = 20000000 6B514159

SEC 2.X: Recommended Elliptic Curve Domain Parameters
1.3.2

7

Recommended Parameters seco427r

The verifiably random elliptic curve domain parameters over Fpm seco427r are specified by theocptuple T = (p, m, f (x), a, b, G, n, h) where p = 261 − 1, m = 7 and the representation of Fpm isdefined by:
p = 261 − 1= 1FFFFFFF FFFFFFFF
f (x) = x7 − 3
The curve E: y 2 = x3 + ax + b over Fpm is defined by:
a =

0000
00000000b =4DFF
8DA1C1CB

00000000
00000000
B7A2CEC7
1DE92903

00000000
00000000
D877A2F1
EB3E9372

00000000 00000000 00000000 00000000
00000000 00000000 1FFFFFFF FFFFFFFC
416033A6 CCE84DD 9301FA23 6A254818
76E5240C 11A15F48 E8B36379 FA5B579F

E was chosen verifiably at random from the seed:
S = 4E545420 436F7270 6F726174 696F6E00 06BABA00
E was selected from S as specified in SEC X.1 [1] in section 3.1.3.1.
G =020000 00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000 25A0F41E 124C90C2 E3AE8FB8 EE228EAC 1BEAF72A

and in uncompressed form is:
G =0400000000
F72A042F
462C2538

00000000
00000000
38ACC12B
6D34ACC500000000
000025A0
DC9C5CE5
24F20452

00000000
F41E124C
7251C039
6D6C79FC

00000000
90C2E3AE
81863365
065FF797

00000000
8FB8EE22
A9C80199
F426C4D900000000
8EAC1BEA
0F0AB1CE
66B92113

G was selected from S as specified in SEC X.1 [1] in section 3.1.3.2.
Finally the order n of G and the cofactor are:n =7FF FFFFFFFF FFFE4000 00000000 0029FFFF FFFFFFFF FDCFFFFF
FFED95A5 B02D31FF FB2115C1 AB3D0D3B D4477989 A552CAB0 60D8C4AF
h =
01

1.4

Recommended 671-bit Elliptic Curve Domain Parameters over an
odd characteristic extension field Fpm

This section specifies the two recommended 610-bit elliptic curve domain parameters over Fpm
in this document: parameters seco671k associated with a Koblitz curve, and verifiably randomparameters seco671r.
Section 1.4.1 specifies the elliptic curve domain parameters seco671k, and Section 1.4.2 specifies
the elliptic curve domain parameters seco671r.

SEC 2.X: Recommended Elliptic Curve Domain Parameters
1.4.1

8

Recommended Parameters seco671k

The elliptic curve domain parameters over Fpm associated with a Koblitz curve seco671k are
specified by the ocptuple T = (p, m, f (x), a, b, G, n, h) where p = 261 − 1, m = 11 and therepresentation of Fpm is defined by:
p = 261 − 1= 1FFFFFFF FFFFFFFF
f (x) = x11 − 3The curve E: y 2 = x3 + ax + b over Fpm is defined by:
a = 00000000
00000000
00000000
b = 00000000
00000000
00000000

00000000
00000000
00000000
00000000
00000000
00000000

00000000
00000000
00000000
00000000
00000000
00000000

00000000
00000000
00000000
00000000
00000000
00000000

00000000
00000000
00000000
00000000
00000000
00000000

00000000
00000000
1FFFFFFF
00000000
00000000
07D5B59B

00000000
00000000FFFFFFFC
00000000
00000000
5A5E5429

E was chosen verifiably at random from the seed:
S = 4E545420 436F7270 6F726174 696F6E00 06BC1300
E was selected from S as specified section 3.1.3.1 in SEC X.1 [1] in section 3.1.3.1.
The base point G in compressed form is:G =03 24293b96 4B416E53 BDAB2713 33AE270B 014EDB71 3C6947A5
E747BD9B 276C4F0D 5A95649C AF96C63E 34304E22 04E1DD2B DAFEF27C
C2C3B321 C931E182 34DB653D 216610EC DF661912 33E3AD13 0123B520
52CD0C0A

and in uncompressed form is:
G =04
E747BD9B
C2C3B321
52CD0C0A
735BA461
7A61075E
A039AE5F

24293b96
276C4F0D
C931E182
6BF67DFB
F1241B7D
655F0CD8

4B416E53
5A95649C
34DB653D
B9AF89C3
2A98CB83
962703BB

BDAB2713
AF96C63E
216610EC
2EFDD5B0
621FB1A3
CC239D54

33AE270B
34304E22
DF661912
7E4349D7
5BCED502
6F3D4C59014EDB71
04E1DD2B
33E3AD13
0DD57C57
687C7648
286B4030

3C6947A5DAFEF27C
0123B520
99C7D06B
2925BF20
53DA73E7

G was selected from S as specified in SEC X.1 [1] in section 3.1.3.2.
Finally the order n of G and the cofactor are:n =03
57FA68EF
9CEE7135h = 20000000

FFFFFFF1 8C568094 36B2E5E4 78B92E0A 117C2B3E F36B0E42
DB9F9E62 EE411700 5C737B6B 7FC9989E EE472ACB 99927E19
DB0E5499 6BFAE625 D90B03E1 FF5BA546 8798E6F7
739D4BF2

SEC 2.X: Recommended Elliptic Curve Domain Parameters
1.4.2

9

Recommended Parameters seco671r

The elliptic curve domain parameters over Fpm associated with a Koblitz curve seco671r are
specified by the ocptuple T = (p, m, f (x), a, b, G, n, h) where p = 261 − 1, m = 11 and therepresentation of Fpm is defined by:
p = 261 − 1= 1FFFFFFF FFFFFFFF
f (x) = x11 − 3The curve E: y 2 = x3 + ax + b over Fpm is defined by:
a = 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000 00000000 1FFFFFFF FFFFFFFC
E was chosen verifiably at random from the seed:
S = 4E545420 436F7270 6F726174 696F6E00 ??????00
E was selected from S as specified in SEC X.1 [1] in section 3.1.3.1.

to be completed · · ·References[1] SEC X.1 Supplemental Document for Odd Characteristic Extension Fields. Nippon Telephone
and Telegraph Corporation, June, 2008.
[2] SEC 1. Elliptic Curve Cryptography. Standards for Efficient Cryptography Group, September, 2000. Working Draft. Available from: http://www.secg.org/