RFC 6090

Fundamental Elliptic Curve Cryptography Algorithms
Informational
February 2011
RFC Library > Crypto Primitives > RFC 6090
Abstract: Describes fundamental algorithms for Elliptic Curve Cryptography (ECC) including ECDH key agreement and ECDSA digital signatures. ECC underpins 5G SUCI concealment (ECIES), TLS key exchange, and certificate-based authentication throughout 3GPP.
Canonical source: https://www.rfc-editor.org/rfc/rfc6090  |  IETF Datatracker

1. Introduction

▶

Elliptic Curve Cryptography provides equivalent security to RSA with much smaller key sizes, making it ideal for constrained environments and mobile devices. A 256-bit ECC key provides roughly equivalent security to a 3072-bit RSA key.

In 3GPP 5G, ECC is used for SUPI concealment (SUCI) via ECIES (Elliptic Curve Integrated Encryption Scheme), TLS 1.3 key exchange (ECDHE), certificate authentication (ECDSA), and JWS token signing.

2. Key ECC Algorithms

▶
Algorithm Purpose 3GPP Usage
ECDH Key agreement TLS 1.3 key exchange, GBA
ECDHE Ephemeral key agreement TLS 1.3 (Perfect Forward Secrecy)
ECDSA Digital signatures Certificate signing, JWS tokens
ECIES Hybrid encryption 5G SUCI (SUPI concealment)

3. ECDH Key Agreement

▶

ECDHE (Ephemeral ECDH) generates fresh key pairs for each session, providing Perfect Forward Secrecy. If long-term keys are compromised, past session keys remain secure.

  Party A                                    Party B
|                                          |
|  Private key: a (random scalar)          |
|  Public key: A = a × G                   |
|                                          |
|  Private key: b (random scalar)          |
|  Public key: B = b × G                   |
|                                          |
|  Exchange public keys                    |
|  A ----------------------------------------> B
|  <---------------------------------------- B
|                                          |
|  Shared secret:                          |
|  S = a × B = a × (b × G)                |
|           = b × A = b × (a × G)         |
|           = a × b × G                    |
|                                          |
|  Both parties derive the same S          |
|  without revealing private keys          |
G = curve generator point (public parameter)
All operations are on the elliptic curve group

4. 3GPP Recommended Curves

▶
Curve Key Size Security Level Usage
P-256 (secp256r1) 256 bits 128-bit TLS, SUCI Profile A, certificates
P-384 (secp384r1) 384 bits 192-bit High-security TLS
X25519 256 bits 128-bit TLS 1.3 key exchange (preferred)
Curve25519 256 bits 128-bit SUCI Profile B

5. 5G SUCI Concealment (ECIES)

▶ 
  UE                                         SIDF (in UDM)
|                                            |
|  SUPI = IMSI (to be concealed)             |
|  HN public key (from USIM provisioning)    |
|                                            |
|  1. Generate ephemeral key pair (ek, EK)   |
|  2. ECDH: S = ek × HN_pub                 |
|  3. KDF: enc_key, mac_key = HKDF(S)       |
|  4. Encrypt MSIN: C = AES(enc_key, MSIN)  |
|  5. MAC: T = HMAC(mac_key, C)             |
|                                            |
|  SUCI = [MCC|MNC|EK|C|T]                  |
|  (concealed identity sent over air)        |
|------------------------------------------->|
|                                            |
|  SIDF decrypts:                            |
|  1. ECDH: S = hn_priv × EK                |
|  2. Derive keys, verify MAC, decrypt MSIN |
|  3. Reconstruct SUPI                       |
|                                            |
|  SUPI returned to AUSF                     |
|                                            |

6. Security Considerations

▶
  • Private keys must be generated from cryptographically secure random number generators
  • Validate public keys before use — invalid curve attacks can leak private keys
  • Use constant-time implementations to prevent side-channel timing attacks
  • P-256 requires careful implementation — X25519/Curve25519 are designed to be harder to misuse