安全与隐私fangpenlin.com
椭圆曲线密码学详解
Elliptic Curve Cryptography Explained
2019 — 2021，它一次次回到首页
黑点是上首页（≥ 50 分）的那次投稿，空心点是没冲上去的投稿，点越大分数越高。
导读
这篇博文系统讲解椭圆曲线密码学（ECC），重点放在有限域上的椭圆曲线、点加法/点倍加等群运算，以及如何基于这些运算构造密钥交换。文章试图用具体例子把抽象数学讲清楚，适合作为理解现代公钥密码原理的入门读物。
为什么经久不衰：它把 ECC 背后的有限域和群运算落到可跟随的例子中，多年后仍是理解椭圆曲线密码学原理的可靠入口。
HN 评论精选
用群论语言把 ECC 概括为“在椭圆曲线群里做 DH 协商，再用共享点做对称加密”。
总结一下：选择一条椭圆曲线和一个大素数；该曲线模这个素数后的有理点构成一个群；私钥是一个大整数 N；在这个群里执行 Diffie-Hellman-Merkle-Williamson（DHMW）；于是双方共享曲线上的一个点；再用这个共享点作为密钥进行对称加密。DHMW 的过程是：A 和 B 约定曲线上的点 P；各自选一个大数作为秘密钥；为简单（或混淆）起见，设 X 的秘密钥就是 X；双方计算 AP 和 BP 作为公钥并交换；A 收到 BP 后计算 A(BP)，B 同理；现在他们共享点 (AB)P。如果你熟悉群的语言并在该语境下理解 DHMW，那么 ECDHMW 以及这一版本的 EC 公钥密码学都是显然的。TL;DR：ECC 不过是用椭圆曲线群里的 DHMW 协商出一个密钥，再用它做对称加密。
ColinWright查看英文原文
So, to summarise: * Choose an Elliptic Curve (EC) and a large prime; * The rational points on the EC modulo the prime give you a group; * Your private key is a large integer N; * Perform Diffie-Hellman-Merkle-Williamson (DHMW) in the group; * You now have a shared point in the EC; * Use a symmetric cipher using the shared point as the key. Performing DHMW goes as follows: * A and B agree on a point P in the EC; * A and B each choose a large number as their secret key; * For simplicity, or confusion, we'll say that X's secret key is X; * They compute AP and BP as their public keys and exchange them; * When A receives BP they compute A(BP), B does likewise; * Now they share a point: (AB)P. If you have the language of groups, and understand DHMW in that context, ECDHMW is trivial, as is (this version of) EC PK-Cryptography. TL;DR : ECC is simply Symmetric Cryptography using a key that's been agreed by using DHMW in an Elliptic Curve group.
赞赏文章认真处理有限域，但期待一种完全从有限域出发、不依赖实数域直觉的讲解方式。
我最喜欢这篇文章的一点是，它并非浮光掠影地提到有限域上的椭圆曲线。但我很希望看到一种完全忽略实数域行为、转而从有限域视角引出动机的椭圆曲线入门。这里有些元素我觉得特别有意思，尤其是那些没有有理点的椭圆曲线在有限域中仍然有点，以及如何理解“点在同一条线上”意味着什么，并从这个视角推导点加法和点倍加。我对 EC 数学熟悉到可以含糊带过这些问题，但仍然会卡住。
andrewla查看英文原文
The thing I like best about this article is that it touches on elliptic curves over finite fields in more than a cursory way. But I would love to see an introduction to elliptic curves that completely ignores the behavior in the real numbers, and instead focuses on driving the motivations from the finite field perspective. There are elements that seem particularly interesting to me around this, especially since even elliptic curves with no rational points on them still have points in finite fields, and how to think about what it means for points to be on a line, and derive things like point addition and point doubling from that perspective. I'm familiar enough with EC math to hand wave around these issues, but it's still something that I struggle with.
补充素域与扩域的区别，并建议先接受扩域概念、之后再深入，因为它是理解 AES、GCM 和 ECC 的关键数学。
我完全不懂 ECC。但提一点：有限域有两类：素域（如本文讨论的模 19 域）和扩域（素数^n，如 19^2 或 361；更常见的是 2^x 域，如 2、4、8、16、32、64……256……65536，因为 2^x 域与二进制数对应紧密）。素域可以很快学会，可能 30 分钟学习和例子就够真正理解；不管是 2、5 还是 19 域，都很酷也很简单。从素域跨到扩域，若要严格掌握，需要几小时专门学习（忙碌成年人可能分散在一周到一个月）。很多博客、教材和参考资料会含糊带过扩域，因为它真的很难。我的建议是“相信教材”，扩域是可行的；你可以先“相信数学”，理解应用后再学细节。“扩域像素域，但更棘手”；在所有重要的方面它几乎都像素域，只是更难理解。我确实建议某个阶段跨过去真正理解扩域；一旦到了那里，你终于理解 CRC32、AES、GCM 模式和 ECC 背后的底层数学。
dragontamer查看英文原文
I don't know ECC at all. But a note: Finite fields are of two types: "Prime Fields" (such as the mod 19 field discussed in this blogpost), and "Extension Fields" (which would be prime^n, such as 19^2 or 361. Or more commonly, the 2^x fields, such as 2, 4, 8, 16, 32, 64... 256... 65536 ... because the 2^x fields correspond very closely with binary numbers). Prime fields can be taught very quickly: maybe 30 minutes of study and examples is all you really need to really get what is going on. Be it a 2, 5, or 19 field, its really cool and simple. The "leap" from prime fields into extension fields takes a few hours of dedicated study (which probably will be done over a week to a month if you're a busy adult like me) if you plan to do it rigorously. A lot of blogposts, textbooks, and other reference material will handwave the extension field because its... really hard math. My best advice is "believe in the textbooks", extension fields are possible. And this is one of those situations where you can just "believe in the math" and learn the details of extension fields AFTER you understand the applications of them. "Extension Fields are like prime fields but way more tricky". They behave like a prime field in almost every way that's important, but its just way harder to understand. -------- I do recommend making the leap at some point, and truly understanding the extension fields. Once you get there, you finally understand the underlying math behind CRC32, AES, GCM mode, and ECC. Its a very worthwhile endeavor, but you really need to dedicate yourself to quiet study for some time to really get the concepts.
推荐一篇利用群律实现快速标量乘法的进阶教程，并附带安全实现注意事项。
对“Warp Speed”感兴趣的人，我写了一篇教程，讲如何利用群律实现快速标量乘法：https://loup-vaillant.fr/tutorials/fast-scalarmult 。额外还有关于安全实现的备注。
loup-vaillant查看英文原文
For those interested in "Warp Speed", I've written a tutorial about how to exploit group laws to implement fast scalar multiplication: https://loup-vaillant.fr/tutorials/fast-scalarmult As a bonus, there are remarks about secure implementations as well.
历次讨论
同类还值得读
非法素数
Illegal prime
维基百科条目，介绍“非法素数”：某些素数之所以被称为“非法”，是因为它们经特定编码后，恰好对应一段被法律禁止传播的数据——最著名的是 DVD 解密程序 DeCSS 的代码，有人把…
安全与隐私上首页 5 次 · 2010–2021en.wikipedia.org编辑精选关于 /dev/urandom 的常见误区
Myths about /dev/urandom
（Thomas Hühn 撰写，2014 年首发并持续更新）逐条反驳关于 /dev/urandom 的常见误解：它与 /dev/random 使用的是同一个 CSPRNG，一旦完…
安全与隐私上首页 5 次 · 2014–20202uo.de编辑精选AES 高级加密标准火柴人图解
A Stick Figure Guide to the Advanced Encryption Standard (AES)
一篇用火柴人漫画形式讲解 AES（高级加密标准）算法的经典科普文章。
安全与隐私上首页 5 次 · 2009–2022moserware.com编辑精选指纹是用户名，不是密码
Fingerprints are Usernames, not Passwords
作者（eCryptfs 维护者、Ubuntu 安全工程师）认为指纹等生物特征是公开、不可更改的标识，应视作用户名而非密码，不能当作秘密凭据用于认证。
安全与隐私上首页 4 次 · 2013–2017blog.dustinkirkland.comHTTPS 连接的最初几毫秒（2009）
The First Few Milliseconds of an HTTPS Connection (2009)
逐毫秒拆解一次 HTTPS 连接建立时发生了什么，重点讲 TLS 握手、证书验证、RSA 签名与密钥协商等机制，面向不熟悉该领域的读者。
安全与隐私上首页 4 次 · 2009–2020moserware.com编辑精选