Defined in NIST SP 800-186 §3.2.1.4 and SEC 2 §2.5.1 (secp384r1) over p = 2³⁸⁴ − 2¹²⁸ − 2⁹⁶ + 2³² − 1 with a = −3 and cofactor 1. Identifiers: OID 1.3.132.0.34, TLS group secp384r1 (24), TLS 1.3 signature scheme ecdsa_secp384r1_sha384 (0x0503), JOSE crv P-384 with ES384 (ECDSA with SHA-384), COSE −35.
Sizes: 48-byte private keys, 97-byte uncompressed or 49-byte compressed public keys, 96-byte raw signatures and about 102–104 bytes in DER. On one core of an Apple M4 Max, OpenSSL 3.6.5 signs about 9,700 and verifies about 4,500 messages per second, roughly nine times slower than its optimized P-256 code.
Where it appears: CNSA 1.0 mandated P-384 for ECDH and ECDSA in national security systems; Let's Encrypt's ECDSA root ISRG Root X2 and its ECDSA intermediates are P-384, signing P-256 or P-384 subscriber keys. For new 128-bit designs P-256 is the usual choice; NIST IR 8547 (draft) treats both alike, disallowing ECDSA at all strengths after 2035, and CNSA 2.0 replaces P-384 with ML-KEM-1024 and ML-DSA-87.