Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Wireshark'ed Firefox 3 request. Their names are nowhere documented.

Elliptic curve: secp256r1 (0x0017)
Elliptic curve: secp384r1 (0x0018)
Elliptic curve: secp521r1 (0x0019)

What are the supported curves for other browsers? Does someone want to extend this list?

You can view your supported curves here (search for "Elliptic curves").

share|improve this question
    
I recommend using an RSA certificate together with ECDH on P256 for key exchange. That way a single certificate works in all browsers, but you get most of the benefit of ECC. The security level required for authentication is lower than what's required for confidentiality, since you only need to protect against current but not future attacks. – CodesInChaos Mar 1 '13 at 16:14
1  
RSA is not an option for slow devices like soho routers and smaller. For this case it also doesn't matter that there is no ECC CA. And your answer is a little bit offtopic here. – Smit Johnth Mar 1 '13 at 19:58
    
Chromium 45 announces the same 3 curves. – lapo Oct 8 '15 at 9:15
    
Does not www.howsmyssl.com tell you when you browse to it? – Stone True Nov 21 '15 at 16:14
    
@StoneTrue no, but still thanks for the link. – Smit Johnth Nov 22 '15 at 4:51

When software (browsers, Web servers...) supports elliptic curves at all, you can more or less expect support for the two curves given in NSA suite B, i.e. the P-256 and P-384 curves which are specified in FIPS 186-3. These are the same curves as the "secp256r1" and "secp384r1" which you list. The 15 standard NIST curves (from FIPS 186-3) are actually a subset of the curves specified by Certicom in SEC 2.

Some software implementations go further and support other curves. For instance, OpenSSL supports all 15 NIST curves (code was contributed by Sun and is believed not to infringe on any patent -- which explains why OpenSSL does not implement acceleration of Koblitz curves through the Frobenius endomorphism). But if you want to maximize interoperability with existing browsers and servers, stick to P-256 and P-384 (I think these are the only two which will work with Internet Explorer, for instance).

share|improve this answer
    
IE8 doesn't support ECC at all. Should we make a list of browsers which support ECC? – Smit Johnth Mar 1 '13 at 15:35
    
Such a list would be useful, but would have to be maintained. The situation is made more complex because the OS version may matter; I suspect IE 8.0 could support ECC if used on a recent enough OS, e.g. Windows 7. Also, processing of X.509 certificates and usage of elliptic curves as part of an ECHDE cipher suite are usually distinct software elements, which need not support the exact same set of curves. – Tom Leek Mar 1 '13 at 15:47
    
It should only matter on IE, which uses OS built-in crypto, the rest should use built-in. The reason for this list is which curves may be used for certificate generation. So if someone can extend these data - please do it! – Smit Johnth Mar 1 '13 at 16:04

Like it was said by @Tom Leek secp256r1 is P-256, secp384r1 is P-384 and secp521r1 is P-521. They are all part of the NSA suite B.

A Wikipedia article has a list of all implementation of curves. So the most common clients are:

OpenSSL/LibreSSL

  • offers support for 28 curves
  • including P-256, P-384 and P-521
  • they do not support Curve25519 and (Ed448-)Goldilocks which are the new standardized ones by the IETF.

As Chrome/Chromium uses BoringSSL - a fork of OpenSSL - it should support the same.

Firefox (NSS)

Firefox uses NSS (Network Security Services) for HTTPS connections. NSS supports:

  • 25 curves (compared to OpenSSL 3 brainpool curves are missing)
  • including P-256, P-384 and P-521
  • they do not support Curve25519 and (Ed448-)Goldilocks too

However...

...this is only the theoretical part and many implementation may only take effect on the server side. Practically you can analyse the traffic with Wireshark - like you did - and look at the curves it offers.

  • You're correct: Firefox supports P-256, P-384 and P-521.
  • And I tested it with Chromium and got: P-256, P-384.

Update: 2016-07-03

Note that you can also see on SSLLabs which browsers support which elliptical curves. And there you can e.g. also see that Chrome 50 supports X25519.

share|improve this answer
    
Related: security.stackexchange.com/questions/104993/… – rugk Nov 8 '15 at 21:37
1  
did you meant P-521? – Smit Johnth Nov 20 '15 at 22:22
    
@SmitJohnth Yes, you're right. I corrected it. Thanks. – rugk Nov 21 '15 at 10:07
1  
P-521, a cosmic joke for us lysdexics. – Nate Diamond Dec 31 '15 at 16:18

Firefox (and also palemoon and waterfox) claim to support secp256r1, secp384r1 and secp521r1, but when connecting to a webserver with a secp384r1 certificate signed by a secp521r1 CA, I get an error: (Error code: sec_error_bad_signature).

IE and Chrome connect successfully to this server o they seem to have implemented EC correctly.

share|improve this answer
1  
this looks like a new question - is it? – schroeder Feb 13 at 18:35
    
This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post - you can always comment on your own posts, and once you have sufficient reputation you will be able to comment on any post. - From Review – Xander Feb 13 at 18:46
    
It is partly an answer. The original question was: "What elliptic curves are supported by browsers?". My answer above was that theoretically all modern browsers support the 3 curves mentioned above, but practically Mozilla-like browsers end with an error. – ah12 Feb 13 at 19:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.