Elliptic Curve Cryptography (ECC) is a powerful and highly efficient type of public-key cryptography. It's the engine behind much of the modern secure internet, used to protect everything from your banking information on HTTPS websites to your private data inside a VPN tunnel.
Although older methods of encryption, like RSA (see our explainer article here), remain in use, ECC has quickly become the modern standard due to its performance and efficiency gains achieved with smaller key sizes. But how does ECC work, and why is it the preferred option across the internet today?
How Does ECC Work?
As with other forms of public-key cryptography, ECC uses a pair of keys to establish secure connections between two unknown parties: a public key that can be shared with anyone, and a private key that stays secret.
ECC is the mathematical framework that generates those keys, using the properties of elliptic curves to obfuscate and encrypt private communications. Most commonly, ECC is used either during key exchanges between two devices or when authenticating signatures on digital certificates.
ECC for Key Exchanges
When ECC is used to create an encrypted connection between two parties, it uses the Elliptic Curve Diffie-Hellman (ECDH) protocol to exchange keys:
- First, the client and server agree on a named elliptic curve during the handshake process. If you'd like to learn more about what handshakes are and how they work, check out our article on TLS.
- Both parties generate a private key (a random integer) and use the elliptic curve math to derive a corresponding public key (a point on the elliptic curve). In ECDH exchanges, these keys are ephemeral and are discarded after each session, enabling perfect forward secrecy (PFS).
- The client and server exchange their public keys.
- Both parties use their own respective private keys with the other's public key to calculate an identical shared secret, also known as the "premaster secret."
- The shared secret is used to create the final symmetric keys for encrypting any data exchanged past the initial handshake.
This process operates based on a mathematical principle known as the "trapdoor function." Essentially, trapdoors are calculations that are easy to compute one way, but effectively impossible to reverse. This means it's simple for a device to start at the beginning of the curve and use its private key to find the final point. However, figuring out what path the computation took from start to finish, or what stops it made along the way, is the near-impossible part.
Even the most powerful supercomputer we have today would still take trillions of years to find the answer to that calculation, because every potential point on the curve is another math problem it needs to solve before it eventually figures out the private key.
This is the foundation of public-key cryptography, and while NIST (the National Institute of Standards and Technology) doesn't consider ECC to be resistant to being cracked by quantum computers (which you can read more about in their internal report on Post-Quantum Cryptography standards), the reality is, this is likely still far off in the future.
ECC for Digital Signatures
To verify that everyone in an online transaction is who they claim to be, and to prevent man-in-the-middle (MITM) attacks, ECC is also used to authenticate users through digital signatures and certificates.
The operation works as follows:
- After receiving a request from the client, the server sends its digital certificate containing its public key.
- ECC-based authentication methods use what's known as an Elliptic Curve Digital Signature Algorithm (ECDSA) public key to verify senders and recipients. This method proves that the information is being transmitted from where it claims to be, that the data hasn't been altered in any way, and that the integrity of the connection is secure.
- The client verifies the certificate's signature using the public key of a trusted Certificate Authority (CA). Certificate Authorities serve as a neutral, trusted witness for digital identities worldwide.
ECC is a fast and secure method for encrypting connections between clients and servers that remains computationally light to use, but extremely difficult to crack.
Conclusion
Although it may require a PhD in mathematics to fully comprehend the scope of how elliptic curves protect our data, simply knowing that ECC is in place to keep our valuable information encrypted is enough for most.
ECC enables fast, seamless, and secure transactions on the modern web. Whether it's the web we use over TLS 1.3 and HTTPS, the content of our messaging apps, or the data traveling over our VPN connections, ECC makes it possible for nearly any device with a chip to quickly and efficiently establish secure connections with others on the web.