Skip to content
ecdsa.com
AcceptableShort Weierstrass

brainpoolP320r1

brainpoolP320r1 is the 320-bit Brainpool curve of RFC 5639, with parameters derived verifiably from the digits of π and e.

brainpoolP320r1 is a short Weierstrass curve y² = x³ + ax + b over a 320-bit prime field with a 320-bit prime-order subgroup and cofactor 1; its estimated security level is 160 bits. Status: secure, but regional or niche.

The Brainpool curves (RFC 5639) were generated in a verifiably pseudo-random way: the primes come from the digits of π and the curve coefficients from the digits of e, so anyone can recompute them (RFC 5639 Appendix A). brainpoolP320r1 is the 320-bit random curve; it has prime order (cofactor 1) and about 160 bits of security.

COSE registers ESB320 — ECDSA with brainpoolP320r1 and SHA-384 (RFC 9864) — and the curve identifier 257 for ISO/IEC 18013-5 mobile driving licences. NIST SP 800-186 allows the Brainpool curves for interoperability.

Names in standards

StandardName
RFC 5639brainpoolP320r1

Object identifiers

Domain parameters

320-bit prime field · about 160-bit security

Field prime p
0xd35e472036bc4fb7e13c785ed201e065f98fcfa6f6f40def4f92b9ec7893ec28fcd412b1f1b32e27
Coefficient a
0x3ee30b568fbab0f883ccebd46d3f3bb8a2a73513f5eb79da66190eb085ffa9f492f375a97d860eb4
Coefficient b
0x520883949dfdbc42d3ad198640688a6fe13f41349554b49acc31dccd884539816f5eb4ac8fb1f1a6
Base point x
0x43bd7e9afb53d8b85289bcc48ee5bfe6f20137d10a087eb6e7871e2a10a599c710af8d0d39e20611
Base point y
0x14fdd05545ec1cc8ab4093247f77275e0743ffed117182eaa9c77877aaac6ac7d35245d1692e8ee1
Order n of the base point
0xd35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c59311
Cofactor h
0x1

Used in

  • COSE (ESB320, ISO/IEC 18013-5 mDL)
  • German government applications

Identifiers in registries

COSE algorithms
ESB320 -266
COSE elliptic curves
brainpoolP320r1 257

Standards and references

All curves