During the creation of a certificate request through the Windows Certificate Store, at the options for the private key, there are the following options for choosing a KSP:

ECDSA_brainpoolP512,Microsoft Software Key Storage Provider (KSP)

ECDSA,Microsoft Software Key Storage Provider (KSP)

What are their differences?

In addition: The windows certificate store, during the creation of a request, gives the following options for the private key:

ECDSA_nistP384,Microsoft Software Key Storage Provider (KSP)

ECDSA_secP384,Microsoft Software Key Storage Provider (KSP)

ECDSA_P384,Microsoft Software Key Storage Provider (KSP)

As far as the standards go, these are all the same curve. What are their differences in the KSP?

1 Answer 1


The difference is in curve algorithms/implementations. 2nd option defaults to NIST_P512 algorithm, while first uses Brainpool algorithm. NIST-based versions are often faster than brainpool.

  • There does not exist a Nist_P512 named curve. They chose 521 on purpose, because 2^521-1 happens to be a prime. Commented Apr 4, 2023 at 15:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .