Convert an elliptic-curve field size into security bits, the RSA modulus that matches it, and key and signature sizes.
The best known attack on a well-chosen curve is a generic square-root discrete-log search, so a 256-bit curve costs about 2^128 group operations to break. Point encodings follow SEC 1: a leading tag byte plus one or both affine coordinates padded to the field length. P-256 delivers RSA-3072 strength in a 65-byte public key and a 64-byte signature, which is why TLS 1.3, SSH and code signing all default to elliptic curves on constrained links.
ECC Security Level
security strength ≈ field size ÷ 2 (Pollard rho), so P-256 ≈ 128-bit and P-384 ≈ 192-bit; an uncompressed point is 2 × ⌈field ÷ 8⌉ + 1 bytes.
security strength ≈ field size ÷ 2 (Pollard rho), so P-256 ≈ 128-bit and P-384 ≈ 192-bit; an uncompressed point is 2 × ⌈field ÷ 8⌉ + 1 bytes. The best known attack on a well-chosen curve is a generic square-root discrete-log search, so a 256-bit curve costs about 2^128 group operations to break. Point encodings follow SEC 1: a leading tag byte plus one or both affine coordinates padded to the field length.
P-256 delivers RSA-3072 strength in a 65-byte public key and a 64-byte signature, which is why TLS 1.3, SSH and code signing all default to elliptic curves on constrained links.
This calculator takes 1 input: Curve field size. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Security levels are quoted at the standard rungs of 112, 128, 192 and 256 bits. P-521's raw ~260-bit work factor is rounded down to the 256-bit rung so it can be paired sensibly with AES-256 and SHA-512.