Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When you are using a named curve like P-256 in openSSL, is there any standard key size for ECDH private key keys?

If you look at the ec_key.c file in the openSSL source this is what you see:

BN_rand_range(priv_key, order)

Here a cryptographically strong random number is generated which is smaller than the order.

share|improve this question
up vote 2 down vote accepted

Yes, P-256 generates 256 bit private keys (give or take a single bit).

The confusion here is that this key is 256 bit effective (giving ~128 bit security) even if it starts with zero bits. So the private key is 256 bit even if the representation as a large integer can be smaller than the requested size. This simply means that the full key space is being used. So there is a relatively big chance (about 1/256) that the big endian encoding of the integer is one byte smaller. Most libraries however require an integer to octet string primitive to be used (I2OS or I2OSP). This represents the private key in a static number of bits, e.g. 256 for the above.

The same is true for RSA by the way. Always expect numbers to start with a random number of zero bits, unless this is explicitly not possible. And be warned against signed/unsigned representations, of course.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.