{"id":2813,"date":"2016-10-21T01:53:42","date_gmt":"2016-10-21T09:53:42","guid":{"rendered":"https:\/\/cheapsslsecurity.com\/blog\/?p=2813"},"modified":"2022-03-21T21:49:43","modified_gmt":"2022-03-22T05:49:43","slug":"ecc-encryption-and-ssl","status":"publish","type":"post","link":"https:\/\/cheapsslsecurity.com\/blog\/ecc-encryption-and-ssl\/","title":{"rendered":"ECC Encryption and SSL Certificate"},"content":{"rendered":"

Understanding Elliptic Curve Cryptography and how it relates to SSL\/TLS<\/h2>\n

You may notice that a couple of the Symantec<\/strong> products we offer, namely the Symantec Secure Site Pro line, advertise something called \u201cECC<\/strong>\u201d or Elliptic Curve Cryptography. This is a mathematical method that can be applied to SSL\/TLS Encryption<\/strong>.<\/p>\n

ECC<\/strong> is actually not new, it\u2019s been around for about a decade at this point, but given the fact it\u2019s yet to be widely adopted it remains a mystery to many people.<\/p>\n

\"ECC
\nECC<\/strong> is incredibly complex, which is why we\u2019ll avoid getting too granular in our discussion of it at this point (that can be saved for future posts), instead we\u2019re going to give you the main points about ECC in case you\u2019re interested in purchasing an SSL Certificate that makes use of it.<\/p>\n

What Exactly is ECC?<\/h3>\n

There are a broad range of applications for Elliptic Curve Cryptography<\/strong>, when it comes to its applications to SSL it can be used to create encryption keys, to provide digital signatures, and more.<\/p>\n

With any SSL Certificate<\/strong> there are quite a few cryptographic functions taking place. Every SSL Certificate has a key pair and a hash, and they all involve authentication and key exchange, ECC can be used for any of these functions.<\/p>\n

So what does that all mean? Well, it means ECC<\/strong> can be the backbone of your SSL Certificate in a number of ways. And while a layman likely wouldn\u2019t know the difference between an SSL Certificate that uses ECC and one that uses more traditional methods, there is a significant difference in performance. And frankly, as the need for greater security grows and the current methods strain to grow with it, that performance gap will only continue to grow, but we\u2019ll talk more about that later.<\/p>\n

Other methods that are currently used with SSL<\/strong> include RSA<\/strong> and DSA<\/strong>, you may have seen these advertised in various SSL Certificate details as well. RSA is named after its creators: Rivest, Shamir and Adleman. DSA is an acronym for Digital Security Algorithm (it was developed by the United States government). Of the two, RSA is the more widely used algorithm.<\/p>\n

We won\u2019t spend too much time on the differences between these two except to say they make calculations differently. In fact, all three make calculations differently. We\u2019ll spare you the mathematical details, but suffice it to say those differences have some pretty large ramifications on the long-term viability of each.<\/p>\n

Powerful Performance<\/h3>\n

Every day computers become more and more powerful. As you read this, in labs around the world, scientists are tinkering with quantum computers that will one day make the lightning fast performance of the computers we use currently seem absolutely pedestrian. That is to say, the processing power of computers continues to increase every day.<\/p>\n

In order to stay ahead of those advancements, encryption technology needs to continue advancing as well. Right now, we measure encryption strength in \u201cbits of security\u201d or just bits. This refers to how much work a computer would need to do to break said encryption. You probably see things like 2048-bit key and 256-bit encryption strength thrown around all the time.<\/p>\n

In order to break encryption, a computer literally needs to guess, which means trying millions of combinations of bits. The time this takes depends on the computer\u2019s processing power.<\/p>\n

To give you a sense of scale, given our current industry standards, it would likely take an organization like the NSA,<\/strong>\u00a0which has massive amounts of computing resources \u2013 over a decade to break encryption. But, as we mentioned earlier, as computer processing power continues to increase, the time it would potentially take to break encryption continues to shorten.<\/p>\n

So how does this tie in to ECC, RSA and DSA?<\/h3>\n

Well, how many \u201cbits of security\u201d<\/strong> these methods provide depends on a range of factors. And it\u2019s not actually a 1:1 type of situation. For instance, a 2048-bit RSA key doesn\u2019t actually provide 2048 \u201cbits of security,\u201d rather it provides only 112.<\/p>\n

Here\u2019s where ECC<\/strong> shines. If you double the size of an RSA key to 4096, you\u2019re not doubling the number of \u201cbits of security.\u201d In fact, you\u2019re actually only going to see about a 20% gain. That means a more cumbersome key, which is going to hurt performance and not increase the level of security that substantially.<\/p>\n

ECC on the other hand can achieve equivalent \u201cbits of security\u201d using much smaller keys. And when we say much smaller, we\u2019re talking like 90% smaller. This in turn means better performance. It also means better scalability. As industry standards increase, RSA and DSA keys will become larger and more unwieldy and ECC will start becoming more widely adopted.<\/p>\n

Already, large sites \u2013 let\u2019s call them mega-sites \u2013 like Facebook and Cloudflare are using ECC because of the massive performance benefits.<\/p>\n

Granted, for a smaller site, you may not notice much of a difference. But again, it\u2019s all about scalability.<\/p>\n

Adopting ECC<\/h3>\n

As we mentioned, ECC is currently only in use by a small number of sites. For your average company or organization, the performance difference is negligible. The SSL Handshake still takes place in a matter of milliseconds even with RSA and DSA keys. Given the way humans perceive time, a performance difference that deals in milliseconds \u2013 even if it is up to 100% better \u2013 isn\u2019t even noticeable.<\/p>\n

And to that end, recent data from Mozilla\u2019s TLS Observatory says over 90% of SSL Certificates in use today use RSA keys, while just 4% use ECC. RSA has pretty much been king since SSL was invented.<\/p>\n

Because of this, server and client software has been slow to support ECC and many CAs don\u2019t even provide it as an option (as we said at the beginning of this article, even within our sizeable product log, only a few high-end Symantec Certificates offer it).<\/p>\n

But, as the processing power of computers continues to advance and forces industry standards to call for more secure keys and encryption strength, ECC is going to see substantial growth in terms of its popularity. RSA and DSA will soon be pushed beyond their reasonable limits and ECC is their logical successor.<\/p>\n

So why wait for the industry to tell you to use ECC<\/strong>? Invest in it now and stay ahead of the curve. After all, ECC<\/strong> is the future. It\u2019s just a matter of when you want to embrace it.<\/p>\n

Important Resources<\/h3>\n