Security Insights · Security fundamentals · 9 min read
Elliptic Curve Cryptography (ECC): What It Is and How It Works
Elliptic curve cryptography (ECC) explained: how it works, ECDH and ECDSA, the P-256 and P-384 curves, ECC vs RSA key sizes, and the quantum threat.
Open a secure website, sign in to an app or send an encrypted file, and an elliptic curve is often doing part of the work. TLS 1.3, the protocol behind HTTPS, lists key exchange on the P-256 elliptic curve as mandatory to implement.
This guide explains what elliptic curve cryptography is, how it compares with RSA, which curves the standards name, and what quantum computing means for it.
What is elliptic curve cryptography?
Elliptic curve cryptography (ECC) is a form of public-key cryptography built on the mathematics of points on an elliptic curve over a finite field. An ECC private key is a large secret number, and the matching public key is a point on the curve. ECC is used to agree on shared keys and to create digital signatures.
Elliptic curves over a finite field
The curves used in cryptography are defined by an equation such as y2 = x3 + ax + b, where x and y are whole numbers taken modulo a large prime p. The result is a scattered set of points, plus one extra point called the point at infinity. For the P-384 curve, p is a 384-bit prime.
Points can be added using a fixed rule, and the result is another point on the curve. Adding a point P to itself k times is written kP.
The discrete logarithm problem
ECC's security rests on the elliptic curve discrete logarithm problem: given a published starting point P and a result R = kP, find the number k. Computing R from k is fast. On a large, well-chosen curve, no known method on a classical computer can work back from R to k in practical time. In ECC, k is the private key and R is the public key.
How ECC encryption works: ECDH and ECDSA
ECC is rarely used to encrypt files or messages directly. What people call ECC encryption is usually ECC doing one of two jobs inside a larger system.
- ECDH (Elliptic Curve Diffie-Hellman): two parties each combine their own private key with the other's public key and arrive at the same shared secret without ever sending it. NIST specifies elliptic curve Diffie-Hellman key agreement in SP 800-56A. The shared secret is used to derive a symmetric key, such as an AES-256 key, which encrypts the data itself.
- ECDSA (Elliptic Curve Digital Signature Algorithm): the private key signs data, and anyone with the public key can check the signature to confirm who signed and that nothing has changed. FIPS 186-5, published by NIST in February 2023, approves ECDSA alongside RSA and EdDSA, a second elliptic curve signature algorithm.
This division of labor, with public-key methods for keys and signatures and a fast symmetric cipher for bulk data, is covered in our guide to symmetric vs asymmetric encryption.
Named curves: P-256, P-384 and Curve25519
Not every elliptic curve is safe, so systems use published, named curves with fixed parameters. NIST lists the curves recommended for US federal use in SP 800-186, published in February 2023. This guide focuses on three:
- P-256: a NIST curve over a 256-bit prime field, giving about 128 bits of security. TLS 1.3 requires support for key exchange on P-256.
- P-384: a NIST curve over a 384-bit prime field, giving about 192 bits of security. The NSA's CNSA 1.0 suite specified P-384 for ECDH and ECDSA (more on this below).
- Curve25519: a curve over the prime 2255 - 19, specified in RFC 7748 in January 2016. Curve25519 is used for key agreement under the name X25519, and its Edwards form, Edwards25519, is used for Ed25519 signatures. SP 800-186 rates Curve25519 at about 128 bits of security.
ECC vs RSA
NIST SP 800-57 Part 1 compares algorithms by security strength, measured in bits. A strength of 128 bits means breaking the key takes roughly as much work as trying every possible 128-bit key. Here is how ECC and RSA line up.
| ECC | RSA | |
|---|---|---|
| Hard problem it relies on | Elliptic curve discrete logarithm | Factoring a large number that is the product of two primes |
| Key size for 128-bit security | 256 bits (for example P-256) | 3,072 bits |
| Key size for 192-bit security | 384 bits (for example P-384) | 7,680 bits |
| Speed and size | Short keys and signatures, and much faster key generation | Long keys and signatures; fast to verify, but slow key generation |
| Common uses | Key agreement (ECDH, X25519), signatures (ECDSA, EdDSA), TLS 1.3 key exchange | Digital signatures and certificates; key transport in TLS 1.2 and earlier |
| Large quantum computer | Vulnerable to Shor's algorithm | Vulnerable to Shor's algorithm |
At 256-bit strength the gap is wider still: ECC keys of 512 bits or more against RSA keys of 15,360 bits. NIST SP 800-175B notes that ECDSA's shorter keys need less storage and bandwidth than RSA.
Is ECC secure against quantum computers?
Against classical computers, yes: ECC on approved curves of 256 bits or more meets NIST's current requirements. Against a large quantum computer, no. NIST states that ECDSA, EdDSA and elliptic curve Diffie-Hellman, like RSA, are vulnerable to Shor's algorithm on a cryptanalytically relevant quantum computer. Such a machine could work out a private key from its public key.
NIST says the migration is starting before such a machine has been built, because data recorded today could be decrypted later (harvest now, decrypt later). In August 2024, NIST published its first post-quantum standards: FIPS 203 (ML-KEM) for key establishment, FIPS 204 (ML-DSA) for digital signatures and FIPS 205 (SLH-DSA) as a hash-based backup. Under its transition plan, NIST IR 8547 (final, October 2026), NIST will deprecate quantum-vulnerable public-key algorithms, including ECDSA and ECDH, after 2030 and disallow them under NIST standards after 2035.
The US National Security Agency (NSA) is making the same move for National Security Systems. Its original Commercial National Security Algorithm Suite, CNSA 1.0, specified ECDH and ECDSA on P-384. CNSA 2.0, announced in September 2022, replaces them with ML-KEM-1024 and ML-DSA-87 and keeps AES-256.
Do you need to stop using ECC now?
Not yet. ECC on approved curves remains approved under NIST standards, with deprecation scheduled after 2030. The practical step is planning: knowing where ECC is used in your systems and starting with data that must stay confidential for many years, which NIST says warrants the earliest transition.
Where DekkoCORE fits
DekkoCORE gives each user a key pair that uses ECC-384. Files and messages are encrypted with AES-256 keys on the user's device before they're uploaded. Post-quantum cryptography is on DekkoSecure's roadmap, and the DekkoSecure security page sets out how the platform protects data.
Common questions
Frequently Asked Questions
What is ECC in cryptography?
ECC stands for elliptic curve cryptography, a form of public-key cryptography based on points on an elliptic curve over a finite field. ECC key pairs are used for key agreement (ECDH) and digital signatures (ECDSA and EdDSA). ECC reaches a given security strength with much smaller keys than RSA.
Does ECC encrypt data directly?
ECC is usually not used to encrypt files or messages on its own. ECC establishes or protects a shared secret, and a symmetric cipher such as AES encrypts the data itself. In TLS 1.3, for example, an elliptic curve key exchange can set up the keys for AES or ChaCha20 encryption.
Is a 256-bit ECC key as strong as a 3072-bit RSA key?
Yes. NIST SP 800-57 Part 1 rates a 256-bit ECC key and a 3,072-bit RSA key at the same security strength of 128 bits, comparable to AES-128. A 384-bit ECC key matches a 7,680-bit RSA key at 192 bits.
What is the difference between P-256 and P-384?
P-256 and P-384 are NIST elliptic curves over 256-bit and 384-bit prime fields, giving about 128 and 192 bits of security. P-384 is the curve the NSA's CNSA 1.0 suite specified for ECDH and ECDSA.
Will quantum computers break elliptic curve cryptography?
A large quantum computer running Shor's algorithm could recover ECC private keys from public keys. NIST plans to deprecate quantum-vulnerable algorithms such as ECDSA and ECDH after 2030 and disallow them after 2035. The replacements are ML-KEM (FIPS 203) and ML-DSA (FIPS 204), published in August 2024.