P-384 is a short Weierstrass curve y² = x³ + ax + b over a 384-bit prime field with a 384-bit prime-order subgroup and cofactor 1; its estimated security level is 192 bits. Status: recommended for new systems.
P-384 is y² = x³ − 3x + b over the prime 2^384 − 2^128 − 2^96 + 2^32 − 1, with a prime-order group and about 192 bits of security. It appears as secp384r1 in TLS (marked Recommended by IANA), as ES384 in JOSE and COSE, as ecdsa-sha2-nistp384 in SSH, and as DNSSEC algorithm 14 (RFC 6605).
NSA's Commercial National Security Algorithm Suite (CNSA 1.0) required P-384 for both ECDH and ECDSA, which made it the curve of choice for government and high-assurance PKI. CNSA 2.0 replaces it with the post-quantum ML-KEM-1024 and ML-DSA-87; the hybrid TLS group SecP384r1MLKEM1024 pairs P-384 with ML-KEM-1024 during the transition.
Raw ECDSA signatures on P-384 are 96 bytes. JOSE's ES384 and the TLS scheme ecdsa_secp384r1_sha384 pair the curve with SHA-384, so the hash matches the curve size.
Domain parameters
384-bit prime field · about 192-bit security
- Field prime p
- 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffff
- Coefficient a
- 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000fffffffc
- Coefficient b
- 0xb3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef
- Base point x
- 0xaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7
- Base point y
- 0x3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f
- Order n of the base point
- 0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973
- Cofactor h
- 0x1
- Seed
- 0xa335926aa319a27a1d00896a6773a4827acdac73