3
$\begingroup$

Can someone please explain what key sizes are required for the ECDSA algorithm? I tried a 128 bit EC Key for SHA1withECDSA and it throws an error. However with 256 bit key I could run the algorithm. Therefore want to know what key sizes are required for the different ECDSA algorithm with SHA1 and SHA2.

Also, how does the key size affect the signature here? Can you please explain? Thank you.

$\endgroup$
1
  • 1
    $\begingroup$ Note that 128 bit EC keys are not cryptographically secure, nowadays 192 bit ECC should be the bare minimum. $\endgroup$ Nov 6, 2013 at 20:18

1 Answer 1

3
$\begingroup$

In principle it should be possible to use 128 bit EC domain parameters / keys with any hash:

For Alice to sign a message m, she follows these steps:

  1. Calculate $e = HASH(m)$, where $HASH$ is a cryptographic hash function, such as SHA-1.
  2. Let $z$ be the $L_n$ leftmost bits of $e$, where $L_n$ is the bit length of the group order $n$.

Source: Wikipedia

However, implementations may reject combinations that would result in a very strange mix of security levels. Normally, I would try and use EC key sizes that are equal or larger than the digest algorithm used. It may be that some implementations refuse to perform step 2, only using the full hash instead of cutting it down to a smaller size.

Note that SHA-224, SHA-512/224 and SHA-384 kindly supply hash output sizes that can be combined with 224 and 384 bit ECC. Please have a look at keylength.com for more information about choosing matching sizes for algorithms.

$\endgroup$
4
  • $\begingroup$ ok, the SHA1 ECDSA seems to accept from key size 224 onwards.. $\endgroup$
    – user907810
    Nov 7, 2013 at 8:27
  • $\begingroup$ What library or implementation are you using? Could it be that you are running in a "certified" mode such as FIPS mode? $\endgroup$ Nov 7, 2013 at 8:30
  • $\begingroup$ I am using a third Party HSM. Btw, the thing about it working for keysizes 224 and above is not fully true. I tried to generate various keysizes(even 32 bit and 20 bit) and for all These Input key sizes, ECDSA SHA1 seems to work..is this wrong behaviour? $\endgroup$
    – user907810
    Nov 7, 2013 at 12:17
  • $\begingroup$ @user907810 HSM's commonly do FIPS certification. This means that they will probably not allow you to use key sizes below a certain cutoff point (i.e. key sizes that cannot be certified). As indicated in the answer, any hash method can in principle be used with any curve. It is however good practice to use primitives with a similar security level. SHA-2 has a security level of about half of the output size and ECDSA of about half of the key size, which means that 224 bit ECDSA keys match nicely with SHA-224. Note that SHA-1 should not be used anymore. $\endgroup$ Nov 7, 2013 at 12:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.