Skip to content
Calcrivo

ECC Security Level Calculator

Convert an elliptic-curve field size into security bits, the RSA modulus that matches it, and key and signature sizes.

Inputs

Security Strength

128bits

Equivalent RSA Modulus

3,072bits

Uncompressed Public Key

65bytes

Compressed Public Key

33bytes

Raw ECDSA Signature

64bytes

Assessment

Modern baseline — 128-bit strength

Step by step

  1. Values used

    Curve field size = P-256 / secp256r1

  2. ECC Security Level

    security strength ≈ field size ÷ 2 (Pollard rho), so P-256 ≈ 128-bit and P-384 ≈ 192-bit; an uncompressed point is 2 × ⌈field ÷ 8⌉ + 1 bytes.

  3. Security Strength

    = 128 bits

  4. Equivalent RSA Modulus

    = 3,072 bits

  5. Uncompressed Public Key

    = 65 bytes

  6. Compressed Public Key

    = 33 bytes

  7. Raw ECDSA Signature

    = 64 bytes

  8. Assessment

    = Modern baseline — 128-bit strength

How it works

The best known attack on a well-chosen curve is a generic square-root discrete-log search, so a 256-bit curve costs about 2^128 group operations to break. Point encodings follow SEC 1: a leading tag byte plus one or both affine coordinates padded to the field length. P-256 delivers RSA-3072 strength in a 65-byte public key and a 64-byte signature, which is why TLS 1.3, SSH and code signing all default to elliptic curves on constrained links.

Formula

ECC Security Level

security strength ≈ field size ÷ 2 (Pollard rho), so P-256 ≈ 128-bit and P-384 ≈ 192-bit; an uncompressed point is 2 × ⌈field ÷ 8⌉ + 1 bytes.

field size
Bit length of the curve's prime field
security bits
Equivalent symmetric strength
0x04 byte
The leading tag on an uncompressed point

Frequently Asked Questions

How is ECC Security Level calculated?

security strength ≈ field size ÷ 2 (Pollard rho), so P-256 ≈ 128-bit and P-384 ≈ 192-bit; an uncompressed point is 2 × ⌈field ÷ 8⌉ + 1 bytes. The best known attack on a well-chosen curve is a generic square-root discrete-log search, so a 256-bit curve costs about 2^128 group operations to break. Point encodings follow SEC 1: a leading tag byte plus one or both affine coordinates padded to the field length.

Why does ECC Security Level matter?

P-256 delivers RSA-3072 strength in a 65-byte public key and a 64-byte signature, which is why TLS 1.3, SSH and code signing all default to elliptic curves on constrained links.

What values do I need to enter?

This calculator takes 1 input: Curve field size. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why does P-521 give 256-bit security rather than 260?

Security levels are quoted at the standard rungs of 112, 128, 192 and 256 bits. P-521's raw ~260-bit work factor is rounded down to the 256-bit rung so it can be paired sensibly with AES-256 and SHA-512.

You might also need

Related Calculators

RSA Key Size CalculatorDigital Signature Size CalculatorPost-Quantum Key Size Calculator