What is elliptic curve cryptography? How a 256-bit key matches 3,072-bit RSA — and secures this page
Elliptic curve cryptography (ECC) is public-key cryptography based on adding points on a curve: multiplying a known point by a secret number is fast, but recovering the number from the result is practically impossible. A 256-bit ECC key offers security comparable to 3,072-bit RSA, which is why it underpins HTTPS, digital signatures, passkeys and messaging encryption
The three lines
- Principle — adding a point to itself n times is easy; finding n from the result is not
- Advantage — 256-bit keys match 3,072-bit RSA; faster and lighter for phones
- Issues — the NIST seed question was answered October 16; quantum is next
Key questions
- How does elliptic curve cryptography work
- **Q = nG is easy to compute; recovering n from G and Q is practically impossible.** | Element | Role | |---|---| | Curve | Fixed equation, e.g. y² = x³ + ax + b | | Base point G | Public starting point | | Private key n | Secret integer | | Public key Q | G added to itself n times | | Hard problem | Elliptic curve discrete logarithm |
- ECC vs RSA key size
- **Same security with far shorter keys**, per NIST guidance. | Security bits | RSA | ECC | |---|---|---| | 128 | 3072 | 256 | | 192 | 7680 | 384 | | 256 | 15360 | 512+ |
- Where is P-256 used
- **HTTPS key exchange and certificates, code signing, security keys and passkeys.** | Use | Example | |---|---| | Key exchange | ECDHE in TLS | | Signatures | ECDSA certificates, code signing | | Authentication | Passkeys, FIDO keys | | Standard | NIST FIPS 186 |
- Can quantum computers break elliptic curve cryptography
- **A large enough quantum computer running Shor's algorithm could.** None exists yet. | Item | Detail | |---|---| | Threat | Shor's algorithm | | Today | No such machine | | Response | NIST post-quantum standards (finalized 2024) |
When the padlock appears in your address bar, your browser and the server have almost certainly just agreed on a secret using elliptic curves. Elliptic curve cryptography (ECC) is public-key cryptography built on the arithmetic of points on a curve. Proposed independently by Neal Koblitz and Victor Miller in 1985, it now underpins HTTPS, digital signatures, messaging and passkeys.
Anthropic's October 16, 2026 announcement that Claude had traced the origin of the seeds behind P-256 and other NIST curves put ECC back in the news. This explainer covers how it works, why short keys suffice, and what to actually worry about.
1. The principle — easy forward, infeasible backward
An elliptic curve is the set of points satisfying an equation like y² = x³ + ax + b — no ellipse involved. A line through two points on the curve meets it at a third; reflecting that point across the x-axis defines the "sum." Cryptography performs this arithmetic not over real numbers but modulo a large prime.
| Step | What happens | Public? |
|---|---|---|
| 1. Pick a curve | Coefficients a, b and prime p | Yes |
| 2. Base point G | A fixed point on the curve | Yes |
| 3. Private key n | A huge secret integer | No |
| 4. Public key Q | G added to itself n times, Q = nG | Yes |
| 5. Security | Finding n from G and Q: the elliptic curve discrete log problem | — |
Step 4 is fast: repeated doubling gets there in a few hundred operations even for enormous n. Going backward with the best known methods on a 256-bit curve takes around 2¹²⁸ operations — out of reach for every computer on Earth combined. That asymmetry is what public-key cryptography needs.
2. How it compares with RSA
| Security (bits) | RSA key | ECC key | Typical curve |
|---|---|---|---|
| 112 | 2048 | 224 | P-224 |
| 128 | 3072 | 256 | P-256, Curve25519 |
| 192 | 7680 | 384 | P-384 |
| 256 | 15360 | 512+ | P-521 |
Per NIST SP 800-57.
ECC reaches the same strength with keys roughly a tenth as long — faster computation, smaller storage and bandwidth, less battery. That's why phones, secure chips and IoT devices favor it.
| RSA | ECC | |
|---|---|---|
| Hard problem | Factoring large numbers | Elliptic curve discrete log |
| Introduced | 1977 | Proposed 1985; widespread from the 2000s |
| Key generation | Slow | Fast |
| Signature size | Large | Small |
| Classic pitfall | Padding errors | Reusing or leaking the per-signature nonce exposes the private key |
That last row matters. ECDSA needs a fresh random value for every signature; reuse it once and the private key can be computed. Sony's PlayStation 3 signing key fell this way in 2010.
3. Where it's used — and the NIST curve controversy
| Use | Scheme | Example |
|---|---|---|
| Web key exchange | ECDHE | HTTPS (TLS 1.3) |
| Certificates, code signing | ECDSA | Web certificates, app signing |
| Login | Passkeys, FIDO keys | Passwordless sign-in |
| Messaging | X25519 | End-to-end encryption |
| Cryptocurrency | secp256k1 | Bitcoin signatures |
The NIST curves (P-192 to P-521) became US standards in 2000. Because the NSA supplied their seeds unexplained, the 2013 Dual_EC revelations left lingering doubt about P-256. That helped curves with transparent parameter choices, such as Daniel Bernstein's Curve25519, gain ground.
On October 16 Anthropic reported the seeds were ordinary lrand48 output seeded by 1997–98 clock times, calling it "not a cryptographic break, new attack, or weakness" and evidence against deliberate weakening. Services using P-256 need do nothing. Bitcoin's secp256k1, defined by small fixed constants, was never part of this question.
4. The next challenge — quantum, plus FAQ
The real threat to ECC is not a backdoor but quantum computing. A sufficiently large quantum computer running Shor's algorithm would break both RSA and ECC. None exists, but "harvest now, decrypt later" — storing ciphertext today to crack later — has pushed migration to start.
| Question | Answer |
|---|---|
| Is ECC safe today? | Properly implemented, yes against known classical attacks |
| Should I replace P-256? | Not because of the seed question, per Anthropic and Valsorda |
| Post-quantum options? | NIST finalized ML-KEM and ML-DSA among others in 2024 |
| Transition approach | Hybrid ECC plus post-quantum is the near-term norm |
- Quantum timing: no settled estimate for when ECC-breaking machines arrive.
- Remaining puzzles: the B-163 seed and the base points of P-256 and three other NIST curves are still unexplained.
Sources
- NIST — FIPS 186-5 Digital Signature Standard
- NIST — SP 800-57 Part 1 Rev. 5, Recommendation for Key Management
- Cloudflare — A (Relatively Easy To Understand) Primer on Elliptic Curve Cryptography
- Anthropic — Claude reveals ECDSA curve origins (2026-10-16)
- CoinDesk — Claude cracks a 25-year NSA number mystery (2026-10-17)