Press Releases Certicom Crypto Challenge Sets New Security Benchmark for ECC Demonstrates Ongoing International Commitment to Elliptic Curve Cryptography Research and Development HAYWARD, Calif., September 28, 1999 - Certicom, a leading provider of next-generation encryption technology, today announced that a team of international researchers has been awarded first prize in the latest round of the Certicom ECC Challenge after successfully recovering a 97-bit ECC private key. Today's results confirm Certicom, ANSI X9, and NIST's ongoing recommendation that strong security is achieved only when implementing a minimum of a 163-bit ECC key. Today's announced results were achieved using approximately 740 computers from countries around the world including France, Australia, Canada, the United States, Britain, Finland and Austria. The machines together ran over 130,000 billion elliptic curve operations. The amount of computation was roughly 16,000 MIPS-years, which is approximately twice as much as used in the RSA 512-bit factorization recently announced by RSA Data Security, Inc., thereby confirming that a 97-bit ECC key is harder to defeat than a 512-bit RSA factorization. "Today's news confirms that ECC keys are superior in performance and strength to alternatives, such as RSA and Diffie-Hellman," said Scott Vanstone, founder and chief cryptographer, Certicom. "The ECC Challenge is one of many examples highlighting the strong, international commitment to the advancement and success of elliptic curve cryptography." Certicom's ECC Challenge, launched November 6, 1997, is the first and only of its kind developed to increase the industry's understanding and appreciation for the difficulty of the elliptic curve discrete logarithm problem, and to encourage and stimulate further research in the security analysis of elliptic curve cryptosystems. This challenge has confirmed security strength comparisons of ECC with RSA and DSA, as defined by key sizes. Robert Harley of INRIA and a team of researchers at British Telecom Labs solved the last round of the ECC Challenge in 53 days, using 1,288 machines located in 16 countries. Since the launch of the ECC Challenge, Certicom executives have been expecting the 97-bit challenge to be solved. It was originally included simply as an exercise, and no Certicom customers have actually implemented 97-bit ECC. This contrasts with 512-bit RSA, which still today can be found in a variety of commercial products. More information on the Certicom ECC Challenge can be found at the following URL: http://www.certicom.com/chal/index.htm. More information on the research team who completed the 97-bit challenge can be found online at: http://pauillac.inria.fr/~harley/ecdl6/. ECC Technology Developed for a broad range of computing platforms and maximum interoperability, Certicom's ECC technology enables strong, high performance security for every piece of the computing infrastructure, including the new generation of small form-factor products such as handheld computers, pagers, cell phones and smart cards. These products are the new Internet appliances for electronic commerce, demanding strong, highly efficient security. Certicom's ECC implementation is optimized to provide more efficient, high-strength security at smaller key sizes than traditional cryptographic systems. ECC minimizes power and bandwidth requirements, and addresses today's demand for compact, full strength security for all electronic communications and commerce applications. About Certicom Certicom is a leading provider of next-generation encryption technology used to build strong, fast, and efficient security solutions. Major computing and communications companies, such as 3Com/Palm Computing, BellSouth Wireless Data, Hewlett-Packard, Motorola, Pitney Bowes and VeriFone, incorporate Certicom's technology into electronic commerce software, wireless messaging applications, and smart cards. With its acquisitions of Consensus Development Corp. and Uptronics Incorporated, Certicom is now a leading source for a complete range of OEM security products and services, including cryptographic toolkits, custom implementations, and security integration services and consulting. Certicom's worldwide sales and marketing operations are based in Hayward, Calif., with cryptographic research and product development in Toronto, Canada. Certicom shares are traded on the Toronto Stock Exchange under the symbol "CIC." For more information, visit Certicom's Web site at http://www.certicom.com. # # # Certicom is a registered trademark of Certicom Corp. All other companies and products listed herein are trademarks or registered trademarks of their respective holders. For further information: David Krane Director of Corporate Marketing Certicom Corp. (510) 780-5420 dkrane@certicom.com

Copyright © Certicom Corp., 1997-2000. All rights reserved. Information subject to change. http://www.certicom.com