Throwing Cryptography a Curve Ball

By Dr. Scott Vanstone

August 1, 2005

(Throwing Cryptography a Curve Ball :  Page 1 of 1 )

A quick look back through the history of cryptography makes one thing perfectly clear: Security is never absolute. New technologies, new threats, and new practical demands are constantly emerging, reshaping expectations—and sometimes even redefining what "security" means in the first place.

As a result of this ongoing evolution, cryptographic algorithms that once reigned supreme—DES, RSA and the like—have begun to show their limitations (and in the case of DES, have reached them). This has implications for manufacturers and security engineers building devices today, because the level of security they choose to build into their equipment will have a direct impact on the real-world lifecycle of that equipment. If security functionality can't stand up to the test of time, the longevity of the device itself is compromised.

Elliptic curve cryptography (ECC), once the young upstart of cryptographic algorithms, has now been shown to meet the most stringent long-term security requirements. The NSA has adopted ECC, and it has been recognized by accredited standards bodies such as the American National Standards Institute (ANSI) and the International Standards Organization (ISO).

But what is ECC, and what will it mean for the software industry?

Public-Key Cryptography

Throughout history, encryption has been used to protect the confidentiality of data. In the 1970s, the Data Encryption Standard (DES) was designed, and in a few years became a worldwide de facto standard. DES is an example of a 'symmetric-key' algorithm, so called because the two communicating parties need to share a secret key—this key is used to encrypt data as well as to decrypt it. DES can also be used to authenticate data, so that a recipient can be assured of the source of the data. Again, the two communicating parties need to share a secret key in order to be able to authenticate data sent to each other.

There are some difficulties inherent to deploying symmetric-key cryptography on a large scale.

 Page 1 of 1