Skip to content
ecdsa.com
AcceptableShort Weierstrass

brainpoolP512r1

brainpoolP512r1 is the 512-bit Brainpool curve of RFC 5639, with parameters derived verifiably from the digits of π and e.

brainpoolP512r1 is a short Weierstrass curve y² = x³ + ax + b over a 512-bit prime field with a 512-bit prime-order subgroup and cofactor 1; its estimated security level is 256 bits. Status: secure, but regional or niche.

The Brainpool curves (RFC 5639) were generated in a verifiably pseudo-random way: the primes come from the digits of π and the curve coefficients from the digits of e, so anyone can recompute them (RFC 5639 Appendix A). brainpoolP512r1 is the 512-bit random curve; it has prime order (cofactor 1) and about 256 bits of security.

TLS supports it through RFC 7027 (TLS 1.2) and RFC 8734 (TLS 1.3, group brainpoolP512r1tls13 and signature scheme ecdsa_brainpoolP512r1tls13_sha512); COSE registers ESB512. German government PKI and electronic identity documents use the Brainpool curves, and NIST SP 800-186 allows them for interoperability.

Names in standards

StandardName
RFC 5639brainpoolP512r1
IANA TLS 1.3brainpoolP512r1tls13

Object identifiers

Domain parameters

512-bit prime field · about 256-bit security

Field prime p
0xaadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca703308717d4d9b009bc66842aecda12ae6a380e62881ff2f2d82c68528aa6056583a48f3
Coefficient a
0x7830a3318b603b89e2327145ac234cc594cbdd8d3df91610a83441caea9863bc2ded5d5aa8253aa10a2ef1c98b9ac8b57f1117a72bf2c7b9e7c1ac4d77fc94ca
Coefficient b
0x3df91610a83441caea9863bc2ded5d5aa8253aa10a2ef1c98b9ac8b57f1117a72bf2c7b9e7c1ac4d77fc94cadc083e67984050b75ebae5dd2809bd638016f723
Base point x
0x81aee4bdd82ed9645a21322e9c4c6a9385ed9f70b5d916c1b43b62eef4d0098eff3b1f78e2d0d48d50d1687b93b97d5f7c6d5047406a5e688b352209bcb9f822
Base point y
0x7dde385d566332ecc0eabfa9cf7822fdf209f70024a57b1aa000c55b881f8111b2dcde494a5f485e5bca4bd88a2763aed1ca2b2fa8f0540678cd1e0f3ad80892
Order n of the base point
0xaadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca90069
Cofactor h
0x1

Used in

  • TLS 1.2 (RFC 7027)
  • TLS 1.3 (RFC 8734)
  • German eID and ePassports
  • X.509 (BSI TR-03116)

Identifiers in registries

TLS supported groups
brainpoolP512r1 0x001CbrainpoolP512r1tls13 0x0021
TLS signature schemes
ecdsa_brainpoolP512r1tls13_sha512 0x081C
COSE algorithms
ESB512 -268
COSE elliptic curves
brainpoolP512r1 259

Standards and references

All curves