Elliptic Curve Cryptography (ECC)

Elliptic curve cryptography (ECC) is a family of public-key algorithms based on the math of elliptic curves over finite fields. It provides the same kind of security as RSA with far shorter keys, which means smaller certificates and faster handshakes.

Why it matters

A 256-bit ECC key is generally regarded as comparable in strength to a 3072-bit RSA key. Smaller keys save bandwidth during the handshake and CPU on busy servers, which helps mobile clients in particular. ECC shows up in TLS in two places: ECDSA signatures in certificates, and ECDHE key exchange using curves such as P-256 or X25519. Most modern browsers support both, though very old clients and some legacy appliances may not support ECDSA certificates.

Example

Generate an ECDSA P-256 private key and a certificate request with OpenSSL:

openssl ecparam -name prime256v1 -genkey -noout -out key.pem
openssl req -new -key key.pem -out example.csr

Public CAs accept ECDSA requests, and some servers can present both an RSA and an ECDSA certificate and pick the best one per client.

Common mistakes

• Choosing ECDSA without testing old devices, then breaking checkouts on legacy clients.
• Mixing up the key type and the curve. P-256 is a curve; ECDSA is the signature algorithm.
• Assuming "elliptic curve" is inherently quantum-proof. Quantum computers threaten both ECC and RSA.

Related

• RSA
• Public key
• Certificate signing request
• Diffie-Hellman key exchange

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.