Scalar & Attack

Why ECC

Real ECC uses carefully chosen large curves and protocol authentication. This toy only shows exact point arithmetic.

highlighted = computed this step

Why ECC exists

ECC gives compact public-key arithmetic, but only on curves chosen for hard discrete logs. This toy is intentionally small enough to break.

hard discrete log required\text{hard discrete log required}
Toy curve is tinyFinite-field curve points recomputed from p, a, and b.Toy curve is tiny - 18 affine pointsToy curve is tinycurve y^2=x^3+2x+2 over F_17points sorted by xy over F_p0816(0,6)(0,11)(3,1)(3,16)G: (5,1)(5,16)(6,3)(6,14)(7,6)(7,11)(9,1)(9,16)Q: (10,6)(10,11)(13,7)(13,10)(16,4)(16,13)

This curve is not secure

The toy plot has 18 affine points, and G has order 19.

#affine=18\#\text{affine}=18
Toy curve is tinyFinite-field curve points recomputed from p, a, and b.Toy curve is tiny - 18 affine pointsToy curve is tinycurve y^2=x^3+2x+2 over F_17points sorted by xy over F_p0816(0,6)(0,11)(3,1)(3,16)G: (5,1)(5,16)(6,3)(6,14)(7,6)(7,11)(9,1)(9,16)Q: (10,6)(10,11)(13,7)(13,10)(16,4)(16,13)

The attack is visible

The discrete-log table recovers k=3 from Q.

k=3k=3
Toy attack succeedsScalar rows are recomputed until Q appears.Toy attack succeeds - recovered=3quantityvaluek=1(5,1)k=2(6,3)k=3 recovered(10,6)

Summary

Use reviewed curves and protocols. NOTE: toy-modulus; no-side-channel; no-production; never-roll-your-own. Exact point arithmetic over a deliberately tiny prime field; real ECC uses about 256-bit curves such as Curve25519 in reviewed protocols.

real ECC uses large reviewed curves\text{real ECC uses large reviewed curves}
Toy attack succeedsScalar rows are recomputed until Q appears.Toy attack succeeds - recovered=3quantityvaluek=1(5,1)k=2(6,3)k=3 recovered(10,6)