Internet Engineering Task Force (IETF) J. Merkle
Request for Comments: 6954 secunet Security Networks
Category: Informational M. Lochter
ISSN: 2070-1721 BSI
July 2013
Internet Engineering Task Force (IETF) J. Merkle
Request for Comments: 6954 secunet Security Networks
Category: Informational M. Lochter
ISSN: 2070-1721 BSI
July 2013
Using the Elliptic Curve Cryptography (ECC) Brainpool Curves for the Internet Key Exchange Protocol Version 2 (IKEv2)
在Internet密钥交换协议版本2（IKEv2）中使用椭圆曲线加密（ECC）脑池曲线
Abstract
摘要
This document specifies use of the Elliptic Curve Cryptography (ECC) Brainpool elliptic curve groups for key exchange in the Internet Key Exchange Protocol version 2 (IKEv2).
本文档指定在Internet密钥交换协议版本2（IKEv2）中使用椭圆曲线加密（ECC）椭圆曲线组进行密钥交换。
Status of This Memo
关于下段备忘
This document is not an Internet Standards Track specification; it is published for informational purposes.
本文件不是互联网标准跟踪规范；它是为了提供信息而发布的。
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Not all documents approved by the IESG are a candidate for any level of Internet Standard; see Section 2 of RFC 5741.
本文件是互联网工程任务组（IETF）的产品。它代表了IETF社区的共识。它已经接受了公众审查，并已被互联网工程指导小组（IESG）批准出版。并非IESG批准的所有文件都适用于任何级别的互联网标准；见RFC 5741第2节。
Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc6954.
有关本文件当前状态、任何勘误表以及如何提供反馈的信息，请访问http://www.rfc-editor.org/info/rfc6954.
Copyright Notice
版权公告
Copyright (c) 2013 IETF Trust and the persons identified as the document authors. All rights reserved.
版权所有（c）2013 IETF信托基金和确定为文件作者的人员。版权所有。
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
本文件受BCP 78和IETF信托有关IETF文件的法律规定的约束(http://trustee.ietf.org/license-info)自本文件出版之日起生效。请仔细阅读这些文件，因为它们描述了您对本文件的权利和限制。从本文件中提取的代码组件必须包括信托法律条款第4.e节中所述的简化BSD许可证文本，并提供简化BSD许可证中所述的无担保。
Table of Contents
目录
1. Introduction ....................................................2
1.1. Requirements Language ......................................2
2. IKEv2 Key Exchange Using the ECC Brainpool Curves ...............3
2.1. Diffie-Hellman Group Transform IDs .........................3
2.2. Using the Twisted Brainpool Curves Internally ..............3
2.3. Key Exchange Payload and Shared Secret .....................3
3. Security Considerations .........................................4
4. IANA Considerations .............................................5
5. References ......................................................5
5.1. Normative References .......................................5
5.2. Informative References .....................................6
Appendix A. Test Vectors ...........................................8
A.1. 224-Bit Curve ...............................................8
A.2. 256-Bit Curve ...............................................9
A.3. 384-Bit Curve ...............................................9
A.4. 512-Bit Curve ..............................................10
1. Introduction ....................................................2
1.1. Requirements Language ......................................2
2. IKEv2 Key Exchange Using the ECC Brainpool Curves ...............3
2.1. Diffie-Hellman Group Transform IDs .........................3
2.2. Using the Twisted Brainpool Curves Internally ..............3
2.3. Key Exchange Payload and Shared Secret .....................3
3. Security Considerations .........................................4
4. IANA Considerations .............................................5
5. References ......................................................5
5.1. Normative References .......................................5
5.2. Informative References .....................................6
Appendix A. Test Vectors ...........................................8
A.1. 224-Bit Curve ...............................................8
A.2. 256-Bit Curve ...............................................9
A.3. 384-Bit Curve ...............................................9
A.4. 512-Bit Curve ..............................................10
[RFC5639] specified a new set of elliptic curve groups over finite prime fields for use in cryptographic applications. These groups, denoted as ECC Brainpool curves, were generated in a verifiably pseudo-random way and comply with the security requirements of relevant standards from ISO [ISO1] [ISO2], ANSI [ANSI1], NIST [FIPS], and the Standards for Efficient Cryptography Group [SEC2].
[RFC5639]指定了一组新的有限素数域上的椭圆曲线组，用于加密应用程序。这些组表示为ECC脑池曲线，以可验证的伪随机方式生成，并符合ISO[ISO1][ISO2]、ANSI[ANSI1]、NIST[FIPS]和高效密码组[SEC2]相关标准的安全要求。
While the ASN.1 object identifiers defined in RFC 5639 allow usage of the ECC Brainpool curves in certificates and certificate revocation lists, their utilization for key exchange in IKEv2 [RFC5996] requires the definition and assignment of additional Diffie-Hellman Group Transform IDs in the respective IANA registry. This document specifies transform IDs for four curves from RFC 5639, as well as the encoding of the key exchange payload and derivation of the shared secret when using one of these curves.
虽然RFC 5639中定义的ASN.1对象标识符允许在证书和证书撤销列表中使用ECC脑池曲线，但在IKEv2[RFC5996]中使用它们进行密钥交换需要在各自的IANA注册表中定义和分配额外的Diffie-Hellman组转换ID。本文档指定RFC 5639中四条曲线的变换ID，以及使用其中一条曲线时密钥交换有效载荷的编码和共享秘密的推导。
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].
本文件中的关键词“必须”、“不得”、“必需”、“应”、“不应”、“应”、“不应”、“建议”、“可”和“可选”应按照[RFC2119]中所述进行解释。
In order to use the ECC Brainpool curves for key exchange within IKEv2, the Diffie-Hellman Group Transform IDs (Transform Type 4) listed in the following table have been registered with IANA [IANA-IKE2]. The parameters associated with these curves are defined in RFC 5639 [RFC5639].
为了在IKEv2内使用ECC脑池曲线进行密钥交换，下表中列出的Diffie-Hellman组转换ID（转换类型4）已向IANA[IANA-IKE2]注册。RFC 5639[RFC5639]中定义了与这些曲线相关的参数。
+-----------------+--------------+
| Curve | Transform ID |
+-----------------+--------------+
| brainpoolP224r1 | 27 |
| brainpoolP256r1 | 28 |
| brainpoolP384r1 | 29 |
| brainpoolP512r1 | 30 |
+-----------------+--------------+
+-----------------+--------------+
| Curve | Transform ID |
+-----------------+--------------+
| brainpoolP224r1 | 27 |
| brainpoolP256r1 | 28 |
| brainpoolP384r1 | 29 |
| brainpoolP512r1 | 30 |
+-----------------+--------------+
Table 1
表1
Test vectors for the groups defined by the ECC Brainpool curves are provided in Appendix A.
附录A中提供了ECC脑池曲线定义的组的测试向量。
In [RFC5639], for each random curve, a "twisted curve" (defined by a quadratic twist; see [HMV]) is defined that offers the same level of security but potentially allows more efficient arithmetic due to the curve parameter A = -3. The transform IDs listed in Table 1 also allow using the twisted curve corresponding to the specified random curve: points (x,y) of any of the listed curves can be efficiently transformed to the corresponding point (x',y') on the twisted curve of the same bit length -- and vice versa -- by setting (x',y') = (x*Z^2, y*Z^3) with the coefficient Z specified for that curve [RFC5639].
在[RFC5639]中，对于每条随机曲线，定义了一条“扭曲曲线”（由二次扭曲定义；参见[HMV]），该曲线提供了相同级别的安全性，但由于曲线参数a=-3，可能允许更有效的算法。表1中列出的变换ID还允许使用与指定的随机曲线相对应的扭曲曲线：通过设置（x'，y'）=（x*Z^2，y*Z^3），可以有效地将列出的任何曲线的点（x，y'）变换为相同位长的扭曲曲线上的对应点（x'，y'），反之亦然使用该曲线指定的系数Z[RFC5639]。
For the encoding of the key exchange payload and the derivation of the shared secret, the methods specified in [RFC5903] are adopted.
对于密钥交换有效载荷的编码和共享秘密的推导，采用了[RFC5903]中规定的方法。
In an Elliptic Curve Group over GF[P] (ECP) key exchange in IKEv2, the Diffie-Hellman public value passed in a key establishment (KE) payload consists of two components, x and y, corresponding to the coordinates of an elliptic curve point. Each component MUST be computed from the corresponding coordinate using the FieldElement-to-OctetString conversion method specified in [SEC1] and MUST have a bit
在IKEv2中GF[P]（ECP）密钥交换上的椭圆曲线组中，密钥建立（KE）有效载荷中传递的Diffie-Hellman公共值由两个分量组成，x和y对应于椭圆曲线点的坐标。必须使用[SEC1]中指定的FieldElement到OctetString转换方法从相应坐标计算每个组件，并且必须有一个位
length as indicated in Table 2. This length is enforced by the FieldElement-to-OctetString conversion method, if necessary, by prepending the value with zeros.
长度如表2所示。此长度由FieldElement到OctetString的转换方法强制执行，如有必要，可在值前面加上零。
Note: The FieldElement-to-OctetString conversion method specified in [SEC1] is equivalent to applying the conversion between integers and octet strings (as described in Section 6 of [RFC6090]) after representing the field element as an integer in the interval [0, p-1].
注：[SEC1]中规定的FieldElement到八位字符串的转换方法相当于将field元素表示为区间[0，p-1]中的整数后，应用整数和八位字符串之间的转换（如[RFC6090]第6节所述）。
+---------------------+-----------------------+---------------------+
| Curves | Bit length of each | Bit length of key |
| | component (x or y) | exchange payload |
+---------------------+-----------------------+---------------------+
| brainpoolP224r1 | 224 | 448 |
| brainpoolP256r1 | 256 | 512 |
| brainpoolP384r1 | 384 | 768 |
| brainpoolP512r1 | 512 | 1024 |
+---------------------+-----------------------+---------------------+
+---------------------+-----------------------+---------------------+
| Curves | Bit length of each | Bit length of key |
| | component (x or y) | exchange payload |
+---------------------+-----------------------+---------------------+
| brainpoolP224r1 | 224 | 448 |
| brainpoolP256r1 | 256 | 512 |
| brainpoolP384r1 | 384 | 768 |
| brainpoolP512r1 | 512 | 1024 |
+---------------------+-----------------------+---------------------+
Table 2
表2
From these components, the key exchange payload MUST be computed as the concatenation of the x- and y-coordinates. Hence, the key exchange payload has the bit length indicated in Table 2.
根据这些组件，密钥交换有效负载必须计算为x坐标和y坐标的串联。因此，密钥交换有效载荷具有表2中所示的比特长度。
The Diffie-Hellman shared secret value consists only of the x value. In particular, the shared secret value MUST be computed from the x-coordinate of the Diffie-Hellman common value using the FieldElement-to-OctetString conversion method specified in [SEC1] and MUST have bit length as indicated in Table 2.
Diffie-Hellman共享秘密值仅由x值组成。特别是，必须使用[SEC1]中指定的FieldElement到OctetString转换方法，从Diffie-Hellman公共值的x坐标计算共享秘密值，并且必须具有表2中所示的位长度。
The security considerations of [RFC5996] apply accordingly.
[RFC5996]中的安全注意事项相应适用。
In order to thwart certain active attacks, the validity of the other peer's public Diffie-Hellman value (x,y) recovered from the received key exchange payload needs to be verified. In particular, it MUST be verified that the x- and y-coordinates of the public value satisfy the curve equation. For additional information, we refer the reader to [RFC6989].
为了阻止某些主动攻击，需要验证从接收到的密钥交换有效负载恢复的另一对等方的公共Diffie-Hellman值（x，y）的有效性。特别是，必须验证公共值的x和y坐标满足曲线方程。有关更多信息，请参阅[RFC6989]。
The confidentiality, authenticity, and integrity of a secure communication based on IKEv2 are limited by the weakest cryptographic primitive applied. In order to achieve a maximum security level when
基于IKEv2的安全通信的机密性、真实性和完整性受到应用的最脆弱的加密原语的限制。为了在以下情况下达到最大安全级别：
using one of the elliptic curves from Table 1 for key exchange, the following should be chosen according to the recommendations of [NIST800-57] and [RFC5639]:
使用表1中的一条椭圆曲线进行密钥交换，应根据[NIST800-57]和[RFC5639]的建议选择以下各项：
o key derivation function
o 密钥导出函数
o algorithms and key lengths of symmetric encryption and message authentication
o 对称加密和消息认证的算法和密钥长度
o algorithm, bit length, and hash function used for signature generation
o 用于生成签名的算法、位长度和哈希函数
Furthermore, the private Diffie-Hellman keys should be selected with the same bit length as the order of the group generated by the base point G and with approximately maximum entropy.
此外，私有Diffie-Hellman密钥的选择应具有与基点G生成的组的顺序相同的比特长度，并且具有近似最大熵。
Implementations of elliptic curve cryptography for IKEv2 could be susceptible to side-channel attacks. Particular care should be taken for implementations that internally use the corresponding twisted curve to take advantage of an efficient arithmetic for the special parameters (A = -3): although the twisted curve itself offers the same level of security as the corresponding random curve (through mathematical equivalence), an arithmetic based on small curve parameters could be harder to protect against side-channel attacks. General guidance on resistance of elliptic curve cryptography implementations against side-channel attacks is given in [BSI1] and [HMV].
IKEv2的椭圆曲线加密实现可能容易受到旁道攻击。对于在内部使用相应扭曲曲线以利用特殊参数（A=-3）的有效算法的实现，应特别注意：尽管扭曲曲线本身提供了与相应随机曲线相同的安全级别（通过数学等效），基于小曲线参数的算法可能更难抵御侧通道攻击。[BSI1]和[HMV]中给出了关于椭圆曲线密码实现抵抗旁道攻击的一般指南。
IANA has updated its "Transform Type 4 - Diffie-Hellman Group Transform IDs" registry in [IANA-IKE2] to include the groups listed in Table 1.
IANA已更新了其在[IANA-IKE2]中的“Transform Type 4-Diffie-Hellman Group Transform ID”注册表，以包括表1中列出的组。
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2119]Bradner，S.，“RFC中用于表示需求水平的关键词”，BCP 14，RFC 2119，1997年3月。
[RFC5996] Kaufman, C., Hoffman, P., Nir, Y., and P. Eronen, "Internet Key Exchange Protocol Version 2 (IKEv2)", RFC 5996, September 2010.
[RFC5996]Kaufman，C.，Hoffman，P.，Nir，Y.，和P.Eronen，“互联网密钥交换协议版本2（IKEv2）”，RFC 59962010年9月。
[RFC5639] Lochter, M. and J. Merkle, "Elliptic Curve Cryptography (ECC) Brainpool Standard Curves and Curve Generation", RFC 5639, March 2010.
[RFC5639]Lochter，M.和J.Merkle，“椭圆曲线加密（ECC）大脑池标准曲线和曲线生成”，RFC 56392010年3月。
[RFC6989] Sheffer, Y. and S. Fluhrer, "Additional Diffie-Hellman Tests for the Internet Key Exchange Protocol Version 2 (IKEv2)", RFC 6989, July 2013.
[RFC6989]Sheffer，Y.和S.Fluhrer，“互联网密钥交换协议版本2（IKEv2）的附加Diffie-Hellman测试”，RFC 69892013年7月。
[IANA-IKE2] Internet Assigned Numbers Authority, "Internet Key Exchange Version 2 (IKEv2) Parameters", <http://www.iana.org/assignments/ikev2-parameters>.
[IANA-IKE2]互联网分配号码管理局，“互联网密钥交换版本2（IKEv2）参数”<http://www.iana.org/assignments/ikev2-parameters>.
[SEC1] Certicom Research, "Elliptic Curve Cryptography", Standards for Efficient Cryptography (SEC) 1, September 2000.
[SEC1]Certicom Research，“椭圆曲线密码术”，高效密码标准（SEC）1，2000年9月。
[RFC5903] Fu, D. and J. Solinas, "Elliptic Curve Groups modulo a Prime (ECP Groups) for IKE and IKEv2", RFC 5903, June 2010.
[RFC5903]Fu，D.和J.Solinas，“IKE和IKEv2的模素数的椭圆曲线群（ECP群）”，RFC 5903，2010年6月。
[RFC6090] McGrew, D., Igoe, K., and M. Salter, "Fundamental Elliptic Curve Cryptography Algorithms", RFC 6090, February 2011.
[RFC6090]McGrew，D.，Igoe，K.，和M.Salter，“基本椭圆曲线密码算法”，RFC 60902011年2月。
[ANSI1] American National Standards Institute, "Public Key Cryptography For The Financial Services Industry: The Elliptic Curve Digital Signature Algorithm (ECDSA)", ANSI X9.62, 2005.
[ANSI1]美国国家标准协会，“金融服务业的公钥加密：椭圆曲线数字签名算法（ECDSA）”，ANSI X9.622005。
[BSI1] Bundesamt fuer Sicherheit in der Informationstechnik, "Minimum Requirements for Evaluating Side-Channel Attack Resistance of Elliptic Curve Implementations", July 2011.
[BSI1]信息技术领域的Bundesamt fuer-Sicherheit，“评估椭圆曲线实现的侧信道抗攻击能力的最低要求”，2011年7月。
[FIPS] National Institute of Standards and Technology, "Digital Signature Standard (DSS)", FIPS PUB 186-2, December 1998.
[FIPS]国家标准与技术研究所，“数字签名标准（DSS）”，FIPS PUB 186-2，1998年12月。
[HMV] Hankerson, D., Menezes, A., and S. Vanstone, "Guide to Elliptic Curve Cryptography", Springer-Verlag, 2004.
[HMV]Hankerson，D.，Menezes，A.，和S.Vanstone，“椭圆曲线密码术指南”，Springer Verlag，2004年。
[ISO1] International Organization for Standardization, "Information Technology -- Security Techniques -- Digital Signatures with Appendix - Part 3: Discrete Logarithm Based Mechanisms", ISO/IEC 14888-3, 2006.
[ISO1]国际标准化组织，“信息技术——安全技术——带附录的数字签名——第3部分：基于离散对数的机制”，ISO/IEC 14888-3，2006年。
[ISO2] International Organization for Standardization, "Information Technology -- Security Techniques -- Cryptographic Techniques Based on Elliptic Curves - Part 2: Digital signatures", ISO/IEC 15946-2, 2002.
[ISO2]国际标准化组织，“信息技术——安全技术——基于椭圆曲线的密码技术——第2部分：数字签名”，ISO/IEC 15946-22002。
[NIST800-57] National Institute of Standards and Technology, "Recommendation for Key Management -- Part 1: General (Revised)", NIST Special Publication 800-57, March 2007.
[NIST 800-57]国家标准与技术研究所，“关键管理建议——第1部分：总则（修订）”，NIST特别出版物800-57，2007年3月。
[SEC2] Certicom Research, "Recommended Elliptic Curve Domain Parameters", Standards for Efficient Cryptography (SEC) 2, September 2000.
[SEC2]Certicom Research，“推荐的椭圆曲线域参数”，高效密码标准（SEC）2，2000年9月。
This section provides some test vectors, for example, Diffie-Hellman key exchanges using each of the curves defined in Section 2. The following notation is used in the subsequent subsections:
本节提供一些测试向量，例如，Diffie-Hellman密钥交换使用第2节中定义的每条曲线。以下符号用于后续小节：
d_A: the secret key of party A
d_A:甲方的秘密钥匙
x_qA: the x-coordinate of the public key of party A
x_qA：甲方公钥的x坐标
y_qA: the y-coordinate of the public key of party A
y_qA：甲方公钥的y坐标
d_B: the secret key of party B
d_B：乙方的秘密钥匙
x_qB: the x-coordinate of the public key of party B
x_qB：乙方公钥的x坐标
y_qB: the y-coordinate of the public key of party B
y_qB：乙方公钥的y坐标
x_Z: the x-coordinate of the shared secret that results from completion of the Diffie-Hellman computation
x_Z：Diffie-Hellman计算完成后产生的共享秘密的x坐标
y_Z: the y-coordinate of the shared secret that results from completion of the Diffie-Hellman computation
y_Z：Diffie-Hellman计算完成后产生的共享秘密的y坐标
The field elements x_qA, y_qA, x_qB, y_qB, x_Z, and y_Z are represented as hexadecimal values using the FieldElement-to-OctetString conversion method specified in [SEC1].
字段元素x_-qA、y_-qA、x_-qB、y_-qB、x_-Z和y_-Z使用[SEC1]中指定的字段元素到八进制字符串的转换方法表示为十六进制值。
Curve brainpoolP224r1
曲线图P224R1
dA = 39F155483CEE191FBECFE9C81D8AB1A03CDA6790E7184ACE44BCA161
dA = 39F155483CEE191FBECFE9C81D8AB1A03CDA6790E7184ACE44BCA161
x_qA = A9C21A569759DA95E0387041184261440327AFE33141CA04B82DC92E
x_qA = A9C21A569759DA95E0387041184261440327AFE33141CA04B82DC92E
y_qA = 98A0F75FBBF61D8E58AE5511B2BCDBE8E549B31E37069A2825F590C1
y_qA = 98A0F75FBBF61D8E58AE5511B2BCDBE8E549B31E37069A2825F590C1
dB = 6060552303899E2140715816C45B57D9B42204FB6A5BF5BEAC10DB00
dB = 6060552303899E2140715816C45B57D9B42204FB6A5BF5BEAC10DB00
x_qB = 034A56C550FF88056144E6DD56070F54B0135976B5BF77827313F36B
x_qB = 034A56C550FF88056144E6DD56070F54B0135976B5BF77827313F36B
y_qB = 75165AD99347DC86CAAB1CBB579E198EAF88DC35F927B358AA683681
y_qB = 75165AD99347DC86CAAB1CBB579E198EAF88DC35F927B358AA683681
x_Z = 1A4BFE705445120C8E3E026699054104510D119757B74D5FE2462C66
x_Z = 1A4BFE705445120C8E3E026699054104510D119757B74D5FE2462C66
y_Z = BB6802AC01F8B7E91B1A1ACFB9830A95C079CEC48E52805DFD7D2AFE
y_Z = BB6802AC01F8B7E91B1A1ACFB9830A95C079CEC48E52805DFD7D2AFE
Curve brainpoolP256r1
曲线图P256R1
dA =
81DB1EE100150FF2EA338D708271BE38300CB54241D79950F77B063039804F1D
dA =
81DB1EE100150FF2EA338D708271BE38300CB54241D79950F77B063039804F1D
x_qA =
44106E913F92BC02A1705D9953A8414DB95E1AAA49E81D9E85F929A8E3100BE5
x_qA =
44106E913F92BC02A1705D9953A8414DB95E1AAA49E81D9E85F929A8E3100BE5
y_qA =
8AB4846F11CACCB73CE49CBDD120F5A900A69FD32C272223F789EF10EB089BDC
y_qA =
8AB4846F11CACCB73CE49CBDD120F5A900A69FD32C272223F789EF10EB089BDC
dB =
55E40BC41E37E3E2AD25C3C6654511FFA8474A91A0032087593852D3E7D76BD3
dB =
55E40BC41E37E3E2AD25C3C6654511FFA8474A91A0032087593852D3E7D76BD3
x_qB =
8D2D688C6CF93E1160AD04CC4429117DC2C41825E1E9FCA0ADDD34E6F1B39F7B
x_qB =
8D2D688C6CF93E1160AD04CC4429117DC2C41825E1E9FCA0ADDD34E6F1B39F7B
y_qB =
990C57520812BE512641E47034832106BC7D3E8DD0E4C7F1136D7006547CEC6A
y_qB =
990C57520812BE512641E47034832106BC7D3E8DD0E4C7F1136D7006547CEC6A
x_Z =
89AFC39D41D3B327814B80940B042590F96556EC91E6AE7939BCE31F3A18BF2B
x_Z =
89AFC39D41D3B327814B80940B042590F96556EC91E6AE7939BCE31F3A18BF2B
y_Z =
49C27868F4ECA2179BFD7D59B1E3BF34C1DBDE61AE12931648F43E59632504DE
y_Z =
49C27868F4ECA2179BFD7D59B1E3BF34C1DBDE61AE12931648F43E59632504DE
Curve brainpoolP384r1
曲线p384r1
dA = 1E20F5E048A5886F1F157C74E91BDE2B98C8B52D58E5003D57053FC4B0BD6
5D6F15EB5D1EE1610DF870795143627D042
dA = 1E20F5E048A5886F1F157C74E91BDE2B98C8B52D58E5003D57053FC4B0BD6
5D6F15EB5D1EE1610DF870795143627D042
x_qA = 68B665DD91C195800650CDD363C625F4E742E8134667B767B1B47679358
8F885AB698C852D4A6E77A252D6380FCAF068
x_qA = 68B665DD91C195800650CDD363C625F4E742E8134667B767B1B47679358
8F885AB698C852D4A6E77A252D6380FCAF068
y_qA = 55BC91A39C9EC01DEE36017B7D673A931236D2F1F5C83942D049E3FA206
07493E0D038FF2FD30C2AB67D15C85F7FAA59
y_qA = 55BC91A39C9EC01DEE36017B7D673A931236D2F1F5C83942D049E3FA206
07493E0D038FF2FD30C2AB67D15C85F7FAA59
dB = 032640BC6003C59260F7250C3DB58CE647F98E1260ACCE4ACDA3DD869F74E
01F8BA5E0324309DB6A9831497ABAC96670
dB = 032640BC6003C59260F7250C3DB58CE647F98E1260ACCE4ACDA3DD869F74E
01F8BA5E0324309DB6A9831497ABAC96670
x_qB = 4D44326F269A597A5B58BBA565DA5556ED7FD9A8A9EB76C25F46DB69D19
DC8CE6AD18E404B15738B2086DF37E71D1EB4
x_qB = 4D44326F269A597A5B58BBA565DA5556ED7FD9A8A9EB76C25F46DB69D19
DC8CE6AD18E404B15738B2086DF37E71D1EB4
y_qB = 62D692136DE56CBE93BF5FA3188EF58BC8A3A0EC6C1E151A21038A42E91
85329B5B275903D192F8D4E1F32FE9CC78C48
y_qB = 62D692136DE56CBE93BF5FA3188EF58BC8A3A0EC6C1E151A21038A42E91
85329B5B275903D192F8D4E1F32FE9CC78C48
x_Z = 0BD9D3A7EA0B3D519D09D8E48D0785FB744A6B355E6304BC51C229FBBCE2
39BBADF6403715C35D4FB2A5444F575D4F42
x_Z = 0BD9D3A7EA0B3D519D09D8E48D0785FB744A6B355E6304BC51C229FBBCE2
39BBADF6403715C35D4FB2A5444F575D4F42
y_Z = 0DF213417EBE4D8E40A5F76F66C56470C489A3478D146DECF6DF0D94BAE9
E598157290F8756066975F1DB34B2324B7BD
y_Z = 0DF213417EBE4D8E40A5F76F66C56470C489A3478D146DECF6DF0D94BAE9
E598157290F8756066975F1DB34B2324B7BD
Curve brainpoolP512r1
曲线p512r1
dA = 16302FF0DBBB5A8D733DAB7141C1B45ACBC8715939677F6A56850A38BD87B D59B09E80279609FF333EB9D4C061231FB26F92EEB04982A5F1D1764CAD5766542 2
dA=16302FF0DBBB5A8D733DAB7141C1B45ACBC8715939677F6A56850A38BD87B D59B09E80279609FF333EB9D4C061231FB26F92EEB04982A5F1D1764CAD5766542
x_qA = 0A420517E406AAC0ACDCE90FCD71487718D3B953EFD7FBEC5F7F27E28C6 149999397E91E029E06457DB2D3E640668B392C2A7E737A7F0BF04436D11640FD0 9FD
x_qA=0A420517E406AAC0ACDCE90FCD71487718D3B953EFD7FBEC5F7F27E28C6 14999397E91E029E06457DB2D3E640668B392A7E737A7F0BF04436D11640FD0 9FD
y_qA = 72E6882E8DB28AAD36237CD25D580DB23783961C8DC52DFA2EC138AD472 A0FCEF3887CF62B623B2A87DE5C588301EA3E5FC269B373B60724F5E82A6AD147F DE7
y_qA=72E6882E8DB28AAD36237CD25D580DB23783961C8DC52DFA2EC138AD472 A0FCEF3887CF62B623B2A87DE5C58801EA3E5FC269B373B60724F5E82A6AD147F DE7
dB = 230E18E1BCC88A362FA54E4EA3902009292F7F8033624FD471B5D8ACE49D1 2CFABBC19963DAB8E2F1EBA00BFFB29E4D72D13F2224562F405CB80503666B2542 9
dB=230E18E1BCC88A362FA54E4EA39020092F7F8033624FD471B5D8ACE49D1 2CFABBC19963DAB8E2F1EBA00BFFB29E4D72D13F2224562F405CB80503666B2542 9
x_qB = 9D45F66DE5D67E2E6DB6E93A59CE0BB48106097FF78A081DE781CDB31FC E8CCBAAEA8DD4320C4119F1E9CD437A2EAB3731FA9668AB268D871DEDA55A54731 99F
x_qB=9D45F66DE5D67E2E6DB6E93A59CE0BB48106097FF78A081DE781CDB31FC E8CCBAEA8DD4320C4119F1E9CD437A2EAB37331FA9668AB268D871DEDA55A54731 99F
y_qB = 2FDC313095BCDD5FB3A91636F07A959C8E86B5636A1E930E8396049CB48 1961D365CC11453A06C719835475B12CB52FC3C383BCE35E27EF194512B7187628 5FA
y_qB=2FDC313095BCDD5FB3A91636F07A959C8E86B56366A1E930E8396049CB48 1961D365CC1453A06C719835475B12CB52FC3C383BCE35E27EF194512B7187628 5FA
x_Z = A7927098655F1F9976FA50A9D566865DC530331846381C87256BAF322624 4B76D36403C024D7BBF0AA0803EAFF405D3D24F11A9B5C0BEF679FE1454B21C4CD 1F
x_Z=A7927098655F1F9976FA50A9D566865DC530331846381C87256BAF322624 4B76D36403C024DBF0AA0803EAFF405D3D24F11A9B5C0679FE1454B21C4CD 1F
y_Z = 7DB71C3DEF63212841C463E881BDCF055523BD368240E6C3143BD8DEF8B3 B3223B95E0F53082FF5E412F4222537A43DF1C6D25729DDB51620A832BE6A26680 A2
y_Z=7DB71C3DEF63212841C463E881BDCF05523BD368240E6C3143BD8DEF8B3223B95E0F53082FF5E412F4222537A43DF1C6D25729DDB51620A832BE6A26680 A2
Authors' Addresses
作者地址
Johannes Merkle secunet Security Networks Mergenthaler Allee 77 65760 Eschborn Germany
Johannes Merkle Secune安全网络Mergenthaler Allee 77 65760 Eschborn Germany
Phone: +49 201 5454 3091
EMail: johannes.merkle@secunet.com
Phone: +49 201 5454 3091
EMail: johannes.merkle@secunet.com
Manfred Lochter Bundesamt fuer Sicherheit in der Informationstechnik (BSI) Postfach 200363 53133 Bonn Germany
德国波恩信息技术学院（BSI）Postfach 200363 53133的Manfred Lochter Bundesamt fuer Sicherheit
Phone: +49 228 9582 5643
EMail: manfred.lochter@bsi.bund.de
Phone: +49 228 9582 5643
EMail: manfred.lochter@bsi.bund.de