Skip to content
ecdsa.com
AcceptableShort Weierstrass

GC256B

GC256B is the 256-bit GOST curve known since 2006 as CryptoPro-A (id-GostR3410-2001-CryptoPro-A-ParamSet).

GC256B is a short Weierstrass curve y² = x³ + ax + b over a 256-bit prime field with a 256-bit prime-order subgroup and cofactor 1; its estimated security level is 128 bits. Status: secure, but regional or niche.

GC256B was defined for GOST R 34.10-2001 and published in RFC 4357 §11.4 as id-GostR3410-2001-CryptoPro-A-ParamSet; GOST R 34.10-2012 keeps it as paramSetB (RFC 9215). It is the prime-order curve y² = x³ − 3x + 166 over the prime 2^256 − 617.

The same parameters are registered for key exchange as CryptoPro-XchA, which is why the curve has two OIDs. DNSSEC algorithm 12 (RFC 5933, now deprecated) used it, and TLS lists it as group GC256B (RFC 9189, RFC 9367).

Names in standards

StandardName
IANA TLS (RFC 9189)GC256B
TC 26id-tc26-gost-3410-2012-256-paramSetB
RFC 4357id-GostR3410-2001-CryptoPro-A-ParamSet
RFC 4357id-GostR3410-2001-CryptoPro-XchA-ParamSet

Object identifiers

Domain parameters

256-bit prime field · about 128-bit security

Field prime p
0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd97
Coefficient a
0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffd94
Coefficient b
0xa6
Base point x
0x1
Base point y
0x8d91e471e0989cda27df505a453f2b7635294f2ddf23e3b122acc99c9e9f1e14
Order n of the base point
0xffffffffffffffffffffffffffffffff6c611070995ad10045841b09b761b893
Cofactor h
0x1

Used in

  • GOST R 34.10-2012 signatures
  • TLS 1.2 and 1.3 GOST cipher suites (RFC 9189, RFC 9367)
  • Russian government PKI

Identifiers in registries

TLS supported groups
GC256B 0x0023
TLS signature schemes
gostr34102012_256b 0x070A
DNSSEC algorithm numbers
ECC-GOST 12

Standards and references

All curves