Internet Engineering Task Force (IETF) J. Merkle
Request for Comments: 7027 secunet Security Networks
Updates: 4492 M. Lochter
Category: Informational BSI
ISSN: 2070-1721 October 2013 Elliptic Curve Cryptography (ECC) Brainpool Curves
for Transport Layer Security (TLS)
This document specifies the use of several Elliptic Curve
Cryptography (ECC) Brainpool curves for authentication and key
exchange in the Transport Layer Security (TLS) protocol.
Status of This Memo
This document is not an Internet Standards Track specification; it is
published for informational purposes.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Not all documents
approved by the IESG are a candidate for any level of Internet
Standard; see Section 2 of RFC 5741.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
Copyright (c) 2013 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Test vectors for a Diffie-Hellman key exchange using these elliptic
curves are provided in Appendix A.
3. IANA Considerations
IANA has assigned numbers for the ECC Brainpool curves listed in
Section 2 in the "EC Named Curve" [IANA-TLS] registry of the
"Transport Layer Security (TLS) Parameters" registry as follows:
| Value | Description | DTLS-OK | Reference |
| 26 | brainpoolP256r1 | Y | RFC 7027 |
| 27 | brainpoolP384r1 | Y | RFC 7027 |
| 28 | brainpoolP512r1 | Y | RFC 7027 |
Table 14. Security Considerations
The security considerations of [RFC5246] apply to the ECC Brainpool
curves described in this document.
The confidentiality, authenticity, and integrity of the TLS
communication is limited by the weakest cryptographic primitive
applied. In order to achieve a maximum security level when using one
of the elliptic curves from Table 1 for authentication and/or key
exchange in TLS, the key derivation function; the algorithms and key
lengths of symmetric encryption; and message authentication (as well
as the algorithm, bit length, and hash function used for signature
generation) should be chosen according to the recommendations of
[NIST800-57] and [RFC5639]. Furthermore, the private Diffie-Hellman
keys should be selected with the same bit length as the order of the
group generated by the base point G and with approximately maximum
Implementations of elliptic curve cryptography for TLS may be
susceptible to side-channel attacks. Particular care should be taken
for implementations that internally transform curve points to points
on the corresponding "twisted curve", using the map (x',y') = (x*Z^2,
y*Z^3) with the coefficient Z specified for that curve in [RFC5639],
in order to take advantage of an efficient arithmetic based on the
twisted curve's special parameters (A = -3). Although the twisted
curve itself offers the same level of security as the corresponding
random curve (through mathematical equivalence), an arithmetic based
on small curve parameters may be harder to protect against side-
channel attacks. General guidance on resistance of elliptic curve
cryptography implementations against side-channel-attacks is given in
[BSI1] and [HMV].
5.1. Normative References
[IANA-TLS] Internet Assigned Numbers Authority, "Transport Layer
Security (TLS) Parameters",
[RFC4492] Blake-Wilson, S., Bolyard, N., Gupta, V., Hawk, C., and
B. Moeller, "Elliptic Curve Cryptography (ECC) Cipher
Suites for Transport Layer Security (TLS)", RFC 4492,
[RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer
Security (TLS) Protocol Version 1.2", RFC 5246,
[RFC5639] Lochter, M. and J. Merkle, "Elliptic Curve Cryptography
(ECC) Brainpool Standard Curves and Curve Generation",
RFC 5639, March 2010.
[RFC6347] Rescorla, E. and N. Modadugu, "Datagram Transport Layer
Security Version 1.2", RFC 6347, January 2012.
5.2. Informative References
[ANSI1] American National Standards Institute, "Public Key
Cryptography For The Financial Services Industry: The
Elliptic Curve Digital Signature Algorithm (ECDSA)",
ANSI X9.62, 2005.
[BSI1] Bundesamt fuer Sicherheit in der Informationstechnik,
"Minimum Requirements for Evaluating Side-Channel
Attack Resistance of Elliptic Curve Implementations",
[FIPS] National Institute of Standards and Technology,
"Digital Signature Standard (DSS)", FIPS PUB 186-2,
[HMV] Hankerson, D., Menezes, A., and S. Vanstone, "Guide to
Elliptic Curve Cryptography", Springer Verlag, 2004.
[ISO1] International Organization for Standardization,
"Information Technology - Security Techniques - Digital
Signatures with Appendix - Part 3: Discrete Logarithm
Based Mechanisms", ISO/IEC 14888-3, 2006.
[ISO2] International Organization for Standardization,
"Information Technology - Security Techniques -
Cryptographic Techniques Based on Elliptic Curves -
Part 2: Digital signatures", ISO/IEC 15946-2, 2002.
[NIST800-57] National Institute of Standards and Technology,
"Recommendation for Key Management - Part 1: General
(Revised)", NIST Special Publication 800-57,
[RFC3279] Bassham, L., Polk, W., and R. Housley, "Algorithms and
Identifiers for the Internet X.509 Public Key
Infrastructure Certificate and Certificate Revocation
List (CRL) Profile", RFC 3279, April 2002.
[RFC5480] Turner, S., Brown, D., Yiu, K., Housley, R., and T.
Polk, "Elliptic Curve Cryptography Subject Public Key
Information", RFC 5480, March 2009.
[SEC1] Certicom Research, "Elliptic Curve Cryptography",
Standards for Efficient Cryptography (SEC) 1,
[SEC2] Certicom Research, "Recommended Elliptic Curve Domain
Parameters", Standards for Efficient Cryptography
(SEC) 2, September 2000.
Appendix A. Test Vectors
This section provides some test vectors for example Diffie-Hellman
key exchanges using each of the curves defined in Table 1. The
following notation is used in the subsequent sections:
d_A: the secret key of party A
x_qA: the x-coordinate of the public key of party A
y_qA: the y-coordinate of the public key of party A
d_B: the secret key of party B
x_qB: the x-coordinate of the public key of party B
y_qB: the y-coordinate of the public key of party B
x_Z: the x-coordinate of the shared secret that results from
completion of the Diffie-Hellman computation, i.e., the hex
representation of the pre-master secret
y_Z: the y-coordinate of the shared secret that results from
completion of the Diffie-Hellman computation
The field elements x_qA, y_qA, x_qB, y_qB, x_Z, and y_Z are
represented as hexadecimal values using the FieldElement-to-
OctetString conversion method specified in [SEC1].