brainpoolP224r1 is a short Weierstrass curve y² = x³ + ax + b over a 224-bit prime field with a 224-bit prime-order subgroup and cofactor 1; its estimated security level is 112 bits. Status: still secure, being phased out.
The Brainpool curves (RFC 5639) were generated in a verifiably pseudo-random way: the primes come from the digits of π and the curve coefficients from the digits of e, so anyone can recompute them (RFC 5639 Appendix A). brainpoolP224r1 is the 224-bit random curve; it has prime order (cofactor 1) and about 112 bits of security.
At 112 bits of security it meets the current NIST minimum only until 2030 (SP 800-57), and no TLS, JOSE or COSE registration covers it. NIST SP 800-186 lists the Brainpool curves for interoperability.
Names in standards
| Standard | Name |
|---|
| RFC 5639 | brainpoolP224r1 |
Domain parameters
224-bit prime field · about 112-bit security
- Field prime p
- 0xd7c134aa264366862a18302575d1d787b09f075797da89f57ec8c0ff
- Coefficient a
- 0x68a5e62ca9ce6c1c299803a6c1530b514e182ad8b0042a59cad29f43
- Coefficient b
- 0x2580f63ccfe44138870713b1a92369e33e2135d266dbb372386c400b
- Base point x
- 0xd9029ad2c7e5cf4340823b2a87dc68c9e4ce3174c1e6efdee12c07d
- Base point y
- 0x58aa56f772c0726f24c6b89e4ecdac24354b9e99caa3f6d3761402cd
- Order n of the base point
- 0xd7c134aa264366862a18302575d0fb98d116bc4b6ddebca3a5a7939f
- Cofactor h
- 0x1
← All curves