Public key length

Question

I was wondering if there was (and I hope there is) a standard for public key size for ECDH (Elliptic Curve Diffie-Hellman) and ECDSA (Elliptic Curve Digital Signature Algorithm) for every curve type over prime fields (192, 224, 256, 384 and 521).

Answer 1

An ECDSA or ECDH public key is a curve point -- so it has the size of its curve. If you prefer, for EC-based cryptographic algorithm, we do not really talk about standard sizes but of standard curves.

There is no problem in having many people sharing the same curve -- it does not make them share private keys or anything like that. On the other hand, creating a new curve is very complex and expensive, due to point counting and all that. So a few standard curves have been defined; the most well known and supported are those from FIPS 186-3, published by NIST. There are 15 such curves, out of which 5 use "prime fields", i.e. integers modulo a big prime -- with length, respectively, 192, 224, 256, 384 and 521 bits. If you decide to use the P-256 curve, then, by definition, your public key will be a point on that curve, represented as two values in the 256-bit field (the two values being the point coordinates X and Y).

Out of tradition, we may say that P-256 is a "256-bit curve" because the number of possible curve points happens to be a prime number between 2²⁵⁵ and 2²⁵⁶. So if you need, for some legal/marketing reasons, to express the size of your key as a number of bits, you say "256". Note that you cannot directly compare key sizes for distinct algorithms (a 1024-bit RSA key is not "stronger" than a 256-bit ECDSA key).