Some cryptographic algorithms are as strong as the size of their key is, while other have some weaknesses that limit their strength (such as SHA-1). How strong is the ECDSA algorithm, and does that strength depend on anything (for example, the curve used and so forth)?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
First of all, I'm no expert in this area. Generally $n$ bit ECC seems to have a security level of about $n/2$, but I found some claims that it's lower for certain types of curves.
RFC4492 - Elliptic Curve Cryptography (ECC) Cipher Suites contains the following table:
It doesn't seem to distinguish between different curve types.
I found an RFC draft (not a real standard RFC) that claims the following security levels:
This is consistent with other other sources that put the security level of ECC at $n/2$. Binary curves seem to be a bit worse than prime curves.
The blog entry Not every elliptic curve is the same: trough on ECC security elaborates:
For some curves (like supersingular ones) there are specific attacks, which make them significantly weaker.