As per section 5.3 of RFC 4492, I'm confused with the following table:

          Key Exchange Algorithm  Server Certificate Type
      ----------------------  -----------------------

      ECDH_ECDSA              Certificate MUST contain an
                              ECDH-capable public key.  It
                              MUST be signed with ECDSA.

      ECDHE_ECDSA             Certificate MUST contain an
                              ECDSA-capable public key.  It
                              MUST be signed with ECDSA.

      ECDH_RSA                Certificate MUST contain an
                              ECDH-capable public key.  It
                              MUST be signed with RSA.

      ECDHE_RSA               Certificate MUST contain an
                              RSA public key authorized for
                              use in digital signatures.  It
                              MUST be signed with RSA.

Specifically, I would like to know about the difference between

ECDH-capable public key


ECDSA-capable public key

What actually defines an EC*-capable public key and what are the differences between the two?

I am using XCA/OpenSSL and have configured a CA and signed server certificate to use a prime256v1/P-256 EC key. Then, I will have a client/server using the following cipher suites:




1 Answer 1


That wording is an abbreviation; the key is (or keys are) actually the same, the difference is whether the certificate allows use of the key for the relevant purpose. See section 2:

Note that there is no structural difference between ECDH and ECDSA keys. A certificate issuer may use X.509 v3 keyUsage and extendedKeyUsage extensions to restrict the use of an ECC public key to certain computations [15]. This document refers to an ECC key as ECDH-capable if its use in ECDH is permitted. ECDSA-capable is defined similarly.

[15] refers to rfc3280, which has been superseded by rfc5280. If the KeyUsage extension is present in the cert, it has the digitalSignature bit set to allow use of the subject key for ECDSA, and/or the keyAgreement bit set to allow use of the subject key for ECDH. If KeyUsage is not present, the key can be used for any purpose otherwise acceptable to the program(s) using the certificate.

In principle ExtendedKeyUsage can also be used, but I'm not aware of any EKU values defined -- and more to the point, implemented by common software -- for these specific usages. (There are lots of EKU values defined for other things, including distinguishing server SSL/TLS from client SSL/TLS.)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.