P-224 is a short Weierstrass curve y² = x³ + ax + b over a 224-bit prime field with a 224-bit prime-order subgroup and cofactor 1; its estimated security level is 112 bits. Status: still secure, being phased out.
P-224 is y² = x³ − 3x + b over the prime 2^224 − 2^96 + 1, specified in NIST SP 800-186 and in SEC 2 as secp224r1. Unlike the other NIST primes, this p is congruent to 1 mod 4, so decompressing a point needs the general Tonelli–Shanks square root instead of a single exponentiation.
Its 112-bit security level meets NIST's current minimum; NIST SP 800-57 Part 1 accepts 112-bit strength for protecting new data only through 2030. TLS deprecated the curve in RFC 8422 (code point 21), so it is rarely negotiated today.
Names in standards
| Standard | Name |
|---|
| NIST FIPS 186-5 / SP 800-186 | P-224 |
| SEC 2 | secp224r1 |
Domain parameters
224-bit prime field · about 112-bit security
- Field prime p
- 0xffffffffffffffffffffffffffffffff000000000000000000000001
- Coefficient a
- 0xfffffffffffffffffffffffffffffffefffffffffffffffffffffffe
- Coefficient b
- 0xb4050a850c04b3abf54132565044b0b7d7bfd8ba270b39432355ffb4
- Base point x
- 0xb70e0cbd6bb4bf7f321390b94a03c1d356c21122343280d6115c1d21
- Base point y
- 0xbd376388b5f723fb4c22dfe6cd4375a05a07476444d5819985007e34
- Order n of the base point
- 0xffffffffffffffffffffffffffff16a2e0b8f03e13dd29455c5c2a3d
- Cofactor h
- 0x1
- Seed
- 0xbd71344799d5c7fcdc45b59fa3b9ab8f6a948bc5
Used in
- Legacy TLS 1.2 (secp224r1)
- Smart cards
- Embedded devices
Identifiers in registries
← All curves