# What is the recommended minimum key length for ECDSA signature

I want to identify the proportion of certificates that use unrecommend ECDSA key length for TLS certificates based on some data I collected.

By looking at a standard like NIST for example, I find this in this website:

My data shows use of ecdsa-with-SHA256.

My question is: Which if the following key algorithms the ECDSA is based on? Since ECDSA stands for (Elliptic Curve Digital Signature Algorithm) my understanding is that it is based on Elliptic Curve. So since we are in 2018/2019, I assume the recommended length is 224 bits?

• The recommended key size for ECDSA changes according to usage, see Table 2-1 at NIST 800-57 Dec 16, 2018 at 15:35
• @kelalaka thanks for the additional reference. But in my post, I should look for Elliptic-Curve bits if the key is ECDSA? Dec 16, 2018 at 20:24
• Yes, you should, of course. Dec 17, 2018 at 0:13

## 1 Answer

You are already well on your way if you've found keylength.com. It references the documents that the recommendations are based on, so if you need a more clear reason to go for a specific key size then you could simply dig deeper. Yes, you need to look at Elliptic Curve sizes for ECDSA.

Using different key sizes for different purposes is spot on. Kelalaka pointed to an interesting document NIST Special Publication 800-57 Part 3 Revision 1: Recommendation for Key Management Part 3: Application-Specific Key Management Guidance.

For application for non-repudiation I would go for P-384 or P-521 though, not P-256 or P-384 as indicated in that document. These are signatures that should be made to last. I also think the recommendation to choose an RSA 2048 bit key - a key that has significantly less security than the EC P-256 counterpart in that document - is dangerous practice.

Maybe after 2030 we should worry about quantum computers. You'd better store it at a notary or another third party who can additionally sign the document with post-quantum crypto once (and if) that starts to become a requirement. If you cannot choose for a quantum-safe algorithm then choosing e.g. RSA-4096 may give you more breathing room than Elliptic Curves.

For real time authentication - the other major use case of ECDSA - you could go for P-256 or a similarly sized curve. However, if your systems can handle it, you might as well use a larger key size - if just to give you some leeway.

Beware: in the end the protocol and implementation security are endlessly more likely to be an issue than key size. Too often the key size debate is only important to the sales department and management - mainly because it is really the only thing they kind-of understand.