Reasoning about WebCrypto ECDSA choices: P-256/384/521, SHA-1/256/384/512?

Question

When implementing EC signing/verification in Javascript, the only options available via the WebCrypto API are:

Curves: P-256, P-384, or P-521

Hashes: SHA-1, SHA-256, SHA-384, or SHA-512

If I was not constrained by these choices, I'd choose Ed25519. Would ECDSA with P-256 and SHA-256 provide an equivalent level of security (assuming I trust the NIST curves)?

How should I reason about the WebCrypto choices available to me?

Answer 1

Don't use SHA-1.

There's unlikely to be a substantive difference between the other choices, as far as you're concerned, except performance:

• SHA-256 is might be cheaper on 32-bit CPUs; SHA-384 and SHA-512 are cheaper on 64-bit CPUs.
• NIST P-256 is likely to be cheaper than NIST P-384 which is likely to be cheaper than NIST P-521.

All of these choices provide at least a 128-bit security level.

ECDSA is generally dangerous, of course, because implementations tend to require an entropy source when making signatures, with a catastrophic failure mode, unless you can positively confirm that your implementation uses RFC 6979 deterministic signatures.