P-521 is a short Weierstrass curve y² = x³ + ax + b over a 521-bit prime field with a 521-bit prime-order subgroup and cofactor 1; its estimated security level is 256 bits. Status: recommended for new systems.
P-521 is y² = x³ − 3x + b over the field of the Mersenne prime 2^521 − 1, which turns modular reduction into a shift and an addition. Its group order is a 521-bit prime, for about 256 bits of security.
The unusual size trips up implementations: coordinates and private keys take 66 bytes, a raw ECDSA signature is 132 bytes, and JOSE's ES512 means P-521 with SHA-512 even though both names suggest 512 bits (RFC 7518 §3.4). Code that pads or truncates to 64 bytes produces keys and signatures other libraries reject.
It is registered for TLS (secp521r1, not marked Recommended by IANA), JOSE, COSE (ES512, ESP512) and SSH (ecdsa-sha2-nistp521), but deployments mostly choose P-256 or P-384, which are faster.
Domain parameters
521-bit prime field · about 256-bit security
- Field prime p
- 0x1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
- Coefficient a
- 0x1fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc
- Coefficient b
- 0x51953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00
- Base point x
- 0xc6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66
- Base point y
- 0x11839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650
- Order n of the base point
- 0x1fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409
- Cofactor h
- 0x1
- Seed
- 0xd09e8800291cb85396cc6717393284aaa0da64ba