secp256k1

[NIIBE Yutaka]

On 2014-01-09 at 20:22 +0100, Werner Koch wrote:
> On Thu,  9 Jan 2014 13:59, gniibe at fsij.org said:
> > Can I add secp256k1 curve?  OID is 1.3.132.0.10.
> 
> AFAIK, the Koblitz curves are still patented.  I maybe wrong, though.
> 
> In general binary curves are considered potetial weak or at least very
> fragile.  Thus the suggestion for new applications is not to use them.
> 
> However, if you really like to experiment with them, you may add this
> curve.

I had also thought that it were one of Koblitz curves, as defined:

   http://www.springerreference.com/docs/html/chapterdbid/317770.html 

That is, Anomalous Binary Curves.

But, the curve, secp256k1, is the curve over primary field.  In the
document of SEC 2: Recommended Elliptic Curve Domain Parameters, it
says (page 4):

    Parameters associated with a Koblitz curve admit especially
    efficient implementation.  The name Koblitz curve is best-known
    when used to describe binary anomalous curves over F 2^m which have
    a, b \in {0, 1} [9].  Here it is generalized to refer also to curves
    over p which possess an efficiently computable endomorphism
    [7].

The reference here is:
[7] R. Gallant. Faster elliptic curve cryptography using efficient
endomorphisms. Presentation at ECC '99, 1999.

It's http://cacr.uwaterloo.ca/conferences/1999/ecc99/gallant.ps

This optimization technique is now called Gallant, Lambert and
Vanstone method (or GLV method in short).

Gallant, Lambert and Vanstone: Faster Point Multiplication on Elliptic
Curves with Efficient Endomorphisms:
   http://www.iacr.org/archive/crypto2001/21390189.pdf

I don't know this technique is patented or not.

At the start, I don't have an idea to implement this technique, but, I
am going to just define the curve by adding its domain parameter.
--