Found a few issue threads, notably for Chrome (Chromium issue #478225), and the browser does appear to have dropped support for the secp521r1 curve (can test your browser using SSLLabs). There were other issue threads for other software packages that also claim that the curve will not be supported as of certain releases earlier this year.

I do not recall reading about any cryptographic issues or deprecation of this curve, so wondering why this change occurred. I did not see any conclusion on that issue thread pertaining to Chrome.


The main culprit is NSA Suite B -- or, rather, people who read that document as something that it is not. NSA Suite B says that NSA uses curves P-256 and P-384. Some people have chosen to interpret that as "don't use any other curve". P-521 (aka "secp521r1") is not one of these curves, hence its removal.

There is nothing wrong with P-521, except that it is, in practice, useless. Arguably, P-384 is also useless, because the more efficient P-256 curve already provides security that cannot be broken through accumulation of computing power (see this answer for a discussion on that subject). Yet people and even NSA uses P-384, which goes a long way to show that the choice of what elliptic curve to use in a given cryptographic protocol is not fully a matter of pure rational logic and security assessment. People who are in the position to decide whether a given curve is acceptable or not will make choices based on their perception of how their choices will be perceived by other people who themselves are not necessarily the most logical of thinkers (or not at least perceived to be such).

  • Thank you for the response. I just wondered about it after looking into the available curves in my OpenSSL installation, curious why this curve saw a revocation of prior support. Answered the question, and I agree that there is no good reason to use P-384 or P-521 vs. P-256 given what is realistic to break as an isolated curve apart from the others. – AJAr Sep 24 '15 at 7:15
  • FIPS 140-2 calls out P-256 and P-384. However, the assertion that P-384 is "useless" is no longer valid see weakdh.org/imperfect-forward-secrecy-ccs15.pdf for details. It is highly recommend at this point to switch from prime256v1 to secp384r1. – hackajar Nov 19 '15 at 23:28
  • Switching from 256 to 384 bit ECC doesn't cost much, so why not use it? It's still faster than non-EC cryptography used today. – Smit Johnth Jan 1 '16 at 2:04
  • 1
    @hackajar that paper only seems to recommend using elliptic curves, but I can't find any mention of which curves they would recommend? – Stefan L Aug 29 '17 at 8:23
  • 2
    Support for x25519 seems to be fairly good today if you want to avoid using those from NSA Suite B. – Christopher Schultz Jan 9 '18 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.