Naming elliptic curves for cryptography

There are an infinite number of elliptic curves, but a small number that are used in cryptography, and these special curves have names. Apparently there are no hard and fast rules for how the names are chosen, but there are patterns.

The named elliptic curves are over a prime field, i.e. a finite field with a prime number of elements p. The curve names usually contain a number which is the number of bits in the binary representation of p. Let’s see how that plays out with a list of elliptic curves.

    |------------------+-----------|
    | Name             | bits in p |
    |------------------+-----------|
    | ANSSI FRP256v1   |       256 |
    | BN(2, 254)       |       254 |
    | brainpoolP256t1  |       256 |
    | Curve1174        |       251 |
    | Curve25519       |       255 |
    | Curve383187      |       383 |
    | E-222            |       222 |
    | E-382            |       382 |
    | E-521            |       521 |
    | Ed448-Goldilocks |       448 |
    | M-211            |       221 |
    | M-383            |       383 |
    | M-511            |       511 |
    | NIST P-224       |       224 |
    | NIST P-256       |       256 |
    | secp256k1        |       256 |
    |------------------+-----------|

The first three curves in the list use a prime p that does not have a simple binary representation.

In Curve25519, p = 2255 – 19 and in Curve 383187, p = 2383 – 187. Here the number of bits in p is part of the name but another number is stuck on.

The only mystery on the list is Curve1174 where p has 251 bits. The equation for the curve is

x² + y² = 1 – 1174 y²

and so the 1174 in the name comes from a coefficient rather than from the number of bits in p.

Related posts