Skip to content
ecdsa.com

Elliptic curve

The set of points satisfying a cubic equation such as y² = x³ + ax + b over a finite field, with a point-addition law that forms the group used by ECDSA, EdDSA and ECDH.
Also written aselliptic curveECnamed curve

A named curve fixes the domain parameters: the field prime p, the equation's coefficients, a base point G, the prime order n of G and the cofactor h (the curve has h·n points). Security is about half the bit length of n, because the best generic attack (Pollard's rho) takes about √n steps, so a 256-bit curve gives about 128-bit security.

Curves come in three forms with different formulas: short Weierstrass (P-256, P-384, P-521, secp256k1, Brainpool), Montgomery (Curve25519 and Curve448, used for X25519 and X448) and twisted Edwards (Edwards25519 and Edwards448, used for EdDSA); NIST SP 800-186 §2.1 defines all three.

Identifiers you meet: X.509 named-curve OIDs 1.2.840.10045.3.1.7 (P-256), 1.3.132.0.34 (P-384), 1.3.132.0.35 (P-521) and 1.3.132.0.10 (secp256k1); JOSE crv values P-256, P-384, P-521, secp256k1, Ed25519, X25519; TLS supported groups secp256r1 (23), secp384r1 (24), secp521r1 (25), x25519 (29), x448 (30). RFC 5480 requires named curves in PKIX, and many libraries reject certificates with explicit curve parameters.

In practice the ecosystem decides: P-256 for WebPKI, WebAuthn and hardware keys, Ed25519 and X25519 for SSH and modern protocols, secp256k1 for blockchains. The curve playground shows the same arithmetic on small curves you can draw.

Standards and references

All terms