Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was wondering if there was (and I hope there is) a standard for public key size for ECDH (Elliptic Curve Diffie-Hellman) and ECDSA (Elliptic Curve Digital Signature Algorithm) for every curve type over prime fields (192, 224, 256, 384 and 521).

share|improve this question

An ECDSA or ECDH public key is a curve point -- so it has the size of its curve. If you prefer, for EC-based cryptographic algorithm, we do not really talk about standard sizes but of standard curves.

There is no problem in having many people sharing the same curve -- it does not make them share private keys or anything like that. On the other hand, creating a new curve is very complex and expensive, due to point counting and all that. So a few standard curves have been defined; the most well known and supported are those from FIPS 186-3, published by NIST. There are 15 such curves, out of which 5 use "prime fields", i.e. integers modulo a big prime -- with length, respectively, 192, 224, 256, 384 and 521 bits. If you decide to use the P-256 curve, then, by definition, your public key will be a point on that curve, represented as two values in the 256-bit field (the two values being the point coordinates X and Y).

Out of tradition, we may say that P-256 is a "256-bit curve" because the number of possible curve points happens to be a prime number between 2255 and 2256. So if you need, for some legal/marketing reasons, to express the size of your key as a number of bits, you say "256". Note that you cannot directly compare key sizes for distinct algorithms (a 1024-bit RSA key is not "stronger" than a 256-bit ECDSA key).

share|improve this answer
I'm aware of what they are. Let's say that we're using ECDH and that the shared secret has been computed. You want to send a public key to the other party and you are expecting his public key. What would be the expected size of these keys depending on the curve that generated them? – ALOToverflow Jul 12 '11 at 15:41
need more explanation about ECDSA with example – user7946 Feb 23 '12 at 6:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.