When implementing EC signing/verification in Javascript, the only options available via the WebCrypto API are:

Curves: P-256, P-384, or P-521

Hashes: SHA-1, SHA-256, SHA-384, or SHA-512

If I was not constrained by these choices, I'd choose Ed25519. Would ECDSA with P-256 and SHA-256 provide an equivalent level of security (assuming I trust the NIST curves)?

How should I reason about the WebCrypto choices available to me?


1 Answer 1


Don't use SHA-1.

There's unlikely to be a substantive difference between the other choices, as far as you're concerned, except performance:

  • SHA-256 is might be cheaper on 32-bit CPUs; SHA-384 and SHA-512 are cheaper on 64-bit CPUs.
  • NIST P-256 is likely to be cheaper than NIST P-384 which is likely to be cheaper than NIST P-521.

All of these choices provide at least a 128-bit security level.

ECDSA is generally dangerous, of course, because implementations tend to require an entropy source when making signatures, with a catastrophic failure mode, unless you can positively confirm that your implementation uses RFC 6979 deterministic signatures.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.