Elliptic Curve Cryptography (ECC)
A public-key cryptographic system that bases its security on the mathematical hardness of the Elliptic Curve Discrete Logarithm Problem (ECDLP), providing equivalent security to RSA with significantly smaller key sizes.
Post-quantum migration: NIST has standardized ML-KEM (Kyber) for key encapsulation and ML-DSA (Dilithium) for signatures as replacements for ECDH and ECDSA. TLS 1.3 is beginning to adopt hybrid key exchange (e.g., X25519+Kyber) that is secure against both classical and quantum attacks during the migration period.
graph LR
Center["Elliptic Curve Cryptography (ECC)"]:::main
Pre_cryptography["cryptography"]:::pre --> Center
click Pre_cryptography "/terms/cryptography"
Pre_asymmetric_encryption["asymmetric-encryption"]:::pre --> Center
click Pre_asymmetric_encryption "/terms/asymmetric-encryption"
Rel_private_key["private-key"]:::related -.-> Center
click Rel_private_key "/terms/private-key"
Rel_public_key["public-key"]:::related -.-> Center
click Rel_public_key "/terms/public-key"
Rel_public_key_cryptography["public-key-cryptography"]:::related -.-> Center
click Rel_public_key_cryptography "/terms/public-key-cryptography"
classDef main fill:#7c3aed,stroke:#8b5cf6,stroke-width:2px,color:white,font-weight:bold,rx:5,ry:5;
classDef pre fill:#0f172a,stroke:#3b82f6,color:#94a3b8,rx:5,ry:5;
classDef child fill:#0f172a,stroke:#10b981,color:#94a3b8,rx:5,ry:5;
classDef related fill:#0f172a,stroke:#8b5cf6,stroke-dasharray: 5 5,color:#94a3b8,rx:5,ry:5;
linkStyle default stroke:#4b5563,stroke-width:2px;
🧠 Knowledge Check
🧒 Explain Like I'm 5
Imagine a magic multiplication that's easy in one direction but impossible to reverse. You can multiply a special point on a curve by a secret number (your [private key](/en/terms/private-key)) to get a public point (your [public key](/en/terms/public-key)) very quickly. But if someone only knows the public point and the original point, working backwards to find your secret number would take longer than the age of the universe — even with a supercomputer. This one-way math is what makes ECC so powerful: small secret numbers, huge security.
🤓 Expert Deep Dive
The Elliptic Curve Group Structure
An elliptic curve over a finite field F_p is defined by: y² ≡ x³ + ax + b (mod p), with 4a³ + 27b² ≢ 0 (non-singular). The set of all points on this curve, plus a point at infinity O, form an abelian group under a geometric 'point addition' operation. Scalar multiplication: Q = k·G means adding G to itself k times. The secp256k1 parameters: a=0, b=7, p = 2²⁵⁶ - 2³² - 977, order n ≈ 1.16 × 10⁷⁷.
Key Size Equivalence Table (NIST SP 800-57)
| ECC Key Size | RSA Equivalent | Security Level |
|---|---|---|
| 192-bit | 1536-bit | 96-bit |
| 256-bit | 3072-bit | 128-bit |
| 384-bit | 7680-bit | 192-bit |
| 521-bit | 15360-bit | 256-bit |
Curve25519 Advantages
Designed by Daniel J. Bernstein (djb), Curve25519 uses the Montgomery curve y² = x³ + 486662x² + x. It is designed for constant-time implementation (no branching on secret data), making it inherently resistant to timing side-channel attacks. ECDH over Curve25519 (X25519) is mandated in TLS 1.3 as one of the supported key exchange groups.
The Dual_EC_DRBG Backdoor (Historical)
In 2013, Snowden documents revealed that NIST's Dual_EC_DRBG random number generator (which used ECC constants) was allegedly backdoored by the NSA. NIST withdrew the standard. This controversy underscored the importance of using transparent, independently verified curve parameters (like Bernstein's Curve25519) over proprietary ones.
❓ Frequently Asked Questions
Why is ECC more efficient than RSA?
ECC achieves the same security level as RSA with much smaller key sizes (256-bit ECC ≈ 3072-bit RSA). Smaller keys mean faster signature generation/verification, less bandwidth for certificate transmission, and lower computational overhead — critical for constrained devices like hardware wallets and IoT sensors.
What is the difference between ECC and ECDSA?
ECC is the mathematical framework (the geometry of elliptic curves over finite fields). ECDSA is a specific digital signature algorithm that uses ECC mathematics. Similarly, ECDH is a key agreement protocol built on ECC. ECC is the foundation; ECDSA and ECDH are applications built on top of it.
Why do Bitcoin and Ethereum use secp256k1 instead of the more common P-256 (NIST) curve?
Satoshi Nakamoto chose secp256k1 — a less common curve at the time — partly because P-256 was designed with NSA-selected constants of unclear provenance. secp256k1 parameters are derived transparently from the simple equation y² = x³ + 7, with no arbitrary constants that could hide a backdoor.