Page 429 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

secure cryptographic systems.

The mathematical concepts behind elliptic curve

cryptography are quite complex and well beyond the scope of this
book. However, you should be generally familiar with the elliptic

curve algorithm and its potential applications when preparing for
the CISSP exam. If you are interested in learning the detailed
mathematics behind elliptic curve cryptosystems, an excellent
tutorial exists at https://www.certicom.com/content/certicom/en/
ecc-tutorial.html.

Any elliptic curve can be defined by the following equation:

2
3
y = x + ax + b
In this equation, x, y, a, and b are all real numbers. Each elliptic curve
has a corresponding elliptic curve group made up of the points on the

elliptic curve along with the point O, located at infinity. Two points
within the same elliptic curve group (P and Q) can be added together
with an elliptic curve addition algorithm. This operation is expressed,
quite simply, as follows:

P + Q

This problem can be extended to involve multiplication by assuming
that Q is a multiple of P, meaning the following:

Q = xP

Computer scientists and mathematicians believe that it is extremely
hard to find x, even if P and Q are already known. This difficult
problem, known as the elliptic curve discrete logarithm problem,
forms the basis of elliptic curve cryptography. It is widely believed that
this problem is harder to solve than both the prime factorization

problem that the RSA cryptosystem is based on and the standard
discrete logarithm problem utilized by Diffie–Hellman and El Gamal.
This is illustrated by the data shown in the table in the sidebar
“Importance of Key Length,” which noted that a 1,024-bit RSA key is