ECC Tutorial and ECC Toolkit

On this page you will find two standalone, complementary resources on elliptic-curve cryptography (ECC) accompanying Chapter 8 of the CrypTool Book:

ECC Tutorial — an interactive web application with all the chapter's examples as live-executable SageMath and JavaScript programs.
ECC Toolkit — a collection of 17 standalone SageMath scripts to run directly in a terminal.

About the ECC Tutorial

The ECC Tutorial is a self-contained, interactive web application on elliptic-curve cryptography (ECC).

All 7 chapters and 29 figures cover the same range of topics as Chapter 8 of the CTB — including the topics added since the original 2011 version, such as Curve25519/Ed25519, Lenstra's ECM factorization, and PQXDH as an example of post-quantum hybrid key agreement. The difference isn't in the material, but in the form: Instead of individual, fixed worked examples in book form, the Tutorial presents every topic as a fully editable, live-computed figure across seven chapters that build on one another — from the fundamentals up to the protocols which use ECC.

Computation is done either by your own local SageMath install or directly as JavaScript in the browser (with no server call at all). No account, no cloud service — no SageMath output ever leaves your machine.

Download ECC Tutorial

Installation instructions

Extract the ZIP archive "ecc-tutorial.zip" to a directory of your choice.
Open a terminal (command-line window) in that directory.
Start the server in the terminal: python3 server.py
Open the specified address in your browser: http://localhost:8765/

See the file "readme-usage-webapp.txt" in the zip archive.

Ensure that the section "Instructions and SageMath Version" on the starting page confirms that a local SageMath installation was found.

Then read Chapter 1, or navigate to any section using the table of contents (ToC) on the home page. Each figure has its own controls (sliders, numeric input fields, buttons). When you adjust them, the result is calculated immediately.

Content of the ECC Tutorial

The tutorial comprises 29 interactive figures, sorted by chapter: 17 are computed by your local SageMath installation SageMath, and 12 run directly in the browser JavaScript.

Chapter 1 — Introduction and overview

1.1 The document's chapter structure JavaScript

Chapter 2 — Motivation for the use of elliptic curves in cryptography

2.1 Diffie-Hellman key exchange (1) JavaScript
2.2 Number of possible keys SageMath
2.3 Calculation of primitive roots SageMath
2.4 Diffie-Hellman key exchange (2) SageMath
2.5 Diffie-Hellman key exchange (3) SageMath
2.6 DLP brute-force search SageMath
2.7 Running time comparison of exponential, sub-exponential and polynomial-time algorithms JavaScript

Chapter 3 — Elliptic curves in cryptography

3.1 Elliptic curves defined by $y^2=x^3+ax+b$ JavaScript
3.2 Elliptic curves over the real numbers SageMath
3.3 Elliptic curves over finite fields SageMath
3.4 Point addition JavaScript
3.5 Point doubling JavaScript
3.6 Point at infinity JavaScript
3.7 Point addition for elliptic curves over the rational numbers SageMath
3.8 Point addition for elliptic curves over finite fields SageMath
3.9 Double-and-add algorithm JavaScript
3.10 Comparison of the three methods of scalar multiplication JavaScript
3.11 Solving the ECDLP: baby-step giant-step and Pollard's rho SageMath

Chapter 4 — Cryptographic protocols in ECC

4.1 Elliptic Curve Diffie-Hellman (ECDH) SageMath
4.2 Man-in-the-middle attack on unauthenticated ECDH, and authenticated ECDH SageMath
4.3 ECIES: hybrid public-key encryption SageMath
4.4 ECDSA: Signing and Verifying SageMath
4.5 EdDSA: deterministic signing on Edwards25519 JavaScript

Chapter 5 — Domain parameter generation for ECC systems

5.1 Standardized curve parameters SageMath
5.2 Twisted Edwards point addition (no exceptional cases) JavaScript

Chapter 6 — Conclusion and further topics

6.1 Recommended key lengths JavaScript
6.2 Factoring integers with elliptic curves (Lenstra's ECM) SageMath
6.3 PQXDH: post-quantum-extended key agreement SageMath

Chapter 7 — References and Further Software

No interactive programs.

The ECC Toolkit

The ECC Toolkit is a self-contained collection of 17 SageMath scripts on ECC. Each script is a single, self-contained example — fixed example values, printable text output instead of JSON, no server, no browser. Runnable directly via sage scriptname.py in a terminal, or via load("scriptname.py") in an interactive SageMath session, so every computed value stays available to keep experimenting with afterward. These SageMath programs are exactly the same ones used in the ECC Tutorial.

Download ECC Toolkit

SageMath programs in the ECC Toolkit

17 standalone SageMath scripts, sorted by chapter:

Chapter 2 — Motivation for the use of elliptic curves in cryptography

fig2_2_dh_number_of_keys.py — how many distinct keys $g^i \bmod p$ exist: the order of g
fig2_3_primitive_root.py — finding a primitive root mod p
fig2_4_dh_random_secrets.py — classic DH exchange, p/g fixed, secrets random
fig2_5_dh_chosen_secrets.py — the same exchange, every value chosen freely
fig2_6_dlp_brute_force.py — solving the DLP by brute force — and why it doesn't scale

Chapter 3 — Elliptic curves in cryptography

fig3_2_curve_over_reals.py — non-singularity check plus sample points, E over $\mathbb{R}$
fig3_3_curve_over_finite_field.py — every point of E over $\mathbb{F}_p$ , plus $\#E(\mathbb{F}_p)$
fig3_7_point_addition_rationals.py — point addition over $\mathbb{Q}$ , full λ/xR/yR formulas
fig3_8_point_addition_finite_field.py — the same addition, over $\mathbb{F}_p$ instead
fig3_11_solving_ecdlp.py — baby-step giant-step and Pollard's rho, cross-checked against each other

Chapter 4 — Cryptographic protocols in ECC

fig4_1_ecdh.py — ECDH on a real (toy-size or 256-bit) random curve
fig4_2_mitm_and_authenticated_ecdh.py — MITM attack on unauthenticated ECDH, then the same attack caught by ECDSA-authenticated points
fig4_3_ecies.py — ECIES hybrid encryption: ECDH + KDF + encrypt-then-MAC
fig4_4_ecdsa_and_nonce_reuse.py — ECDSA signing/verifying, then the nonce-reuse attack that recovers the private key

Chapter 5 — Domain parameter generation for ECC systems

fig5_1_standardized_curves.py — verifying the real, published parameters of P-256, P-384, Curve25519, and secp256k1

Chapter 6 — Conclusion and further topics

fig6_2_ecm_factorization.py — Lenstra's ECM: factoring integers with elliptic curves
fig6_3_pqxdh.py — PQXDH: Signal's post-quantum-extended X3DH key agreement

Remark:

Not included in the toolkit are the ECC Tutorial's 12 JavaScript programs. They have no SageMath counterpart and run in the ECC Tutorial without any server/Sage call.