Simple question, what are the limitations of ECC, both in terms of application and how secure it is?

I heard that the NSA were able to read emails a few years back due to a backdoor they had discovered on a particular NIST elliptic curve. Is this something we can continue to expect, and what other potential drawbacks exist?

  • 2
    $\begingroup$ "I heard that the NSA were able to read emails a few years back due to a backdoor they had discovered on a particular NIST elliptic curve." - If you're referring to DUAL_EC_DRBG, that wasn't a curve but a random number generator based on elliptic curves (that works with all elliptic curves) $\endgroup$
    – SEJPM
    Jan 16, 2016 at 15:49
  • $\begingroup$ The main part of your question, about backdoors, seems to be answered by these two questions. $\endgroup$
    – otus
    Jan 16, 2016 at 15:55

1 Answer 1


This is a rather open ended question, but I'll try to answer:


  • most ECDSA implementations require a secure random generator - if the same random value is reused (for different plaintext) then the private key parameter can simply be calculated;
  • ECDSA requires a hash function and cannot be (easily?) used for signatures with message recovery (then again, the signatures are generally much smaller than e.g. RSA in the first place);
  • ECC doesn't provide a direct method of encryption, instead EC-IES is commonly used - which means that that a key pair generation has to be performed and that the public key must be send along with the ciphertext;
  • ECC is much more efficient than RSA for signature generation and decryption, but it's still much slower than symmetric algorithms;
  • ECC requires some agreement on which type of curve and curve parameters to use;
  • support for ECC - especially more modern curves - is lacking from many libraries.


  • the fact that the calculations can be performed on relatively small integers (compared to e.g. DH/DSA or RSA) makes the algorithm rather efficient but it may also help quantum crypto-analysis;
  • many curves - such as the most used curves by NIST over prime fields - require additional verification of the public key to be performed;
  • RSA is much easier to understand than ECC (and a better understanding aids the security of protocols and implementations);
  • RSA is still much better researched, e.g. with regards to side channel attacks.
  • $\begingroup$ Minor correction to limitation 1: we know how to generate ECDSA signatures securely without a random number generator, for example, see RFC 6979 for one such way $\endgroup$
    – poncho
    Jan 16, 2016 at 18:08
  • 1
    $\begingroup$ @poncho Yeah, it's known but not much used, I've changed the wording. There is a bit of an issue with answering questions like these; how much of lesser known protocols and algorithms should be considered? It's hard to include everything and if you do include special constructs then the user will find out that most libraries do not provide the functionality required... $\endgroup$
    – Maarten Bodewes
    Jan 16, 2016 at 18:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.