Skip to content
ecdsa.com
AcceptableShort Weierstrass

brainpoolP256t1

brainpoolP256t1 is the counterpart of brainpoolP256r1 with a = −3, isomorphic to it and chosen for faster arithmetic.

brainpoolP256t1 is a short Weierstrass curve y² = x³ + ax + b over a 256-bit prime field with a 256-bit prime-order subgroup and cofactor 1; its estimated security level is 128 bits. Status: secure, but regional or niche.

Each Brainpool 'r1' curve has a 't1' counterpart obtained through an isomorphism over GF(p) — the parameter Z of RFC 5639 §3 maps (x, y) to (Z²x, Z³y) — that turns a into −3, which allows faster point doubling. The two curves have isomorphic groups of the same prime order and the same security level (about 128 bits). See brainpoolP256r1.

TLS, JOSE and COSE register only the r1 curves; the t1 forms appear as X.509 OIDs (RFC 5639 §4.1) and in libraries such as OpenSSL and Bouncy Castle.

Names in standards

StandardName
RFC 5639brainpoolP256t1

Object identifiers

Domain parameters

256-bit prime field · about 128-bit security

Field prime p
0xa9fb57dba1eea9bc3e660a909d838d726e3bf623d52620282013481d1f6e5377
Coefficient a
0xa9fb57dba1eea9bc3e660a909d838d726e3bf623d52620282013481d1f6e5374
Coefficient b
0x662c61c430d84ea4fe66a7733d0b76b7bf93ebc4af2f49256ae58101fee92b04
Base point x
0xa3e8eb3cc1cfe7b7732213b23a656149afa142c47aafbc2b79a191562e1305f4
Base point y
0x2d996c823439c56d7f7b22e14644417e69bcb6de39d027001dabe8f35b25c9be
Order n of the base point
0xa9fb57dba1eea9bc3e660a909d838d718c397aa3b561a6f7901e0e82974856a7
Cofactor h
0x1

Standards and references

All curves