I want to identify the proportion of certificates that use unrecommend ECDSA key length for TLS certificates based on some data I collected.

By looking at a standard like NIST for example, I find this in this website:

enter image description here

My data shows use of ecdsa-with-SHA256.

My question is: Which if the following key algorithms the ECDSA is based on? Since ECDSA stands for (Elliptic Curve Digital Signature Algorithm) my understanding is that it is based on Elliptic Curve. So since we are in 2018/2019, I assume the recommended length is 224 bits?

  • 1
    $\begingroup$ The recommended key size for ECDSA changes according to usage, see Table 2-1 at NIST 800-57 $\endgroup$
    – kelalaka
    Commented Dec 16, 2018 at 15:35
  • $\begingroup$ @kelalaka thanks for the additional reference. But in my post, I should look for Elliptic-Curve bits if the key is ECDSA? $\endgroup$ Commented Dec 16, 2018 at 20:24
  • $\begingroup$ Yes, you should, of course. $\endgroup$
    – Maarten Bodewes
    Commented Dec 17, 2018 at 0:13
  • $\begingroup$ Note RFC8422 in Aug 2018 'destandardized' for TLS all SECG/X9/NIST curves other than P-256 P-384 P-521 aka secp{256,384,521}r1 and added Xdh/Ed{25519,448}. And RFC8446 (TLS1.3) the same month restricted ECDSA signatures using those P curves to the (near)matching SHA-2 hashes (Ed{25519,448} already specified matching hashes in RFC8032). $\endgroup$ Commented Feb 23 at 0:52

1 Answer 1


You are already well on your way if you've found https://keylength.com. It references the documents that the recommendations are based on, so if you need a more clear reason to go for a specific key size then you could simply dig deeper. And yes, you need to look at Elliptic Curve sizes for ECDSA.

Using different key sizes for different purposes is spot on. Kelalaka pointed to an interesting document NIST Special Publication 800-57 Part 3 Revision 1: Recommendation for Key Management Part 3: Application-Specific Key Management Guidance in the comments.

For application for non-repudiation I would go for P-384 or P-521 though, not P-256 or P-384 as indicated in that document. These are signatures that should be made to last. I also think the recommendation to choose an RSA 2048 bit key - a key that has significantly less security than the EC P-256 counterpart in that document - is dangerous practice.

Maybe after 2030 we should worry about quantum computers. You'd better store it at a notary or another third party who can additionally sign the document with post-quantum crypto once (and if) PQC becomes a requirement. If you cannot choose a quantum-safe cryptographic algorithm then choosing RSA - at keysizes of 4096 or over - may give you more breathing room than Elliptic Curve Cryptography.

For real time authentication - the other major use case of ECDSA - you could go for P-256 or a similarly sized curve. However, if your systems can handle it, you might as well use a larger key size - if just to give you some leeway.

Beware: in the end the protocol and implementation security are endlessly more likely to be an issue than key size. Too often the key size debate is only important to the sales department and management - mainly because it is really the only thing they kind-of understand.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.