Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can someone please explain what key sizes are required for the ECDSA algorithm? I tried a 128 bit EC Key for SHA1withECDSA and it throws an error. However with 256 bit key I could run the algorithm. Therefore want to know what key sizes are required for the different ECDSA algorithm with SHA1 and SHA2.

Also, how does the key size affect the signature here? Can you please explain? Thank you.

share|improve this question
Note that 128 bit EC keys are not cryptographically secure, nowadays 192 bit ECC should be the bare minimum. – Maarten Bodewes Nov 6 '13 at 20:18
up vote 2 down vote accepted

In principle it should be possible to use 128 bit EC domain parameters / keys with any hash:

For Alice to sign a message m, she follows these steps:

  1. Calculate $e = HASH(m)$, where $HASH$ is a cryptographic hash function, such as SHA-1.
  2. Let $z$ be the $L_n$ leftmost bits of $e$, where $L_n$ is the bit length of the group order $n$.

Source: Wikipedia

However, implementations may reject combinations that would result in a very strange mix of security levels. Normally, I would try and use EC key sizes that are equal or larger than the digest algorithm used. It may be that some implementations refuse to perform step 2, only using the full hash instead of cutting it down to a smaller size.

Note that SHA-224, SHA-512/224 and SHA-384 kindly supply hash output sizes that can be combined with 224 and 384 bit ECC. Please have a look at for more information about choosing matching sizes for algorithms.

share|improve this answer
ok, the SHA1 ECDSA seems to accept from key size 224 onwards.. – user907810 Nov 7 '13 at 8:27
What library or implementation are you using? Could it be that you are running in a "certified" mode such as FIPS mode? – Maarten Bodewes Nov 7 '13 at 8:30
I am using a third Party HSM. Btw, the thing about it working for keysizes 224 and above is not fully true. I tried to generate various keysizes(even 32 bit and 20 bit) and for all These Input key sizes, ECDSA SHA1 seems to this wrong behaviour? – user907810 Nov 7 '13 at 12:17
@user907810 HSM's commonly do FIPS certification. This means that they will probably not allow you to use key sizes below a certain cutoff point (i.e. key sizes that cannot be certified). As indicated in the answer, any hash method can in principle be used with any curve. It is however good practice to use primitives with a similar security level. SHA-2 has a security level of about half of the output size and ECDSA of about half of the key size, which means that 224 bit ECDSA keys match nicely with SHA-224. Note that SHA-1 should not be used anymore. – Maarten Bodewes Nov 7 '13 at 12:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.