AsymmetricRecommended
Elliptic Curve Diffie-Hellman
Key agreement over elliptic curves
How it works
ECDH is Diffie-Hellman performed with points on an elliptic curve instead of numbers modulo a prime. Because the elliptic curve discrete log problem is harder per bit, much smaller keys give the same strength as large finite-field groups. Ephemeral ECDH (ECDHE) is the standard key exchange in TLS 1.3.
Sizes: 256-bit curves (P-256, X25519) give about 128-bit security; P-384 about 192-bit
Status: Current default for key agreement; being paired with ML-KEM in hybrid post-quantum deployments.
Strengths
- Small keys and fast computation compared with finite-field DH or RSA at equal strength.
- Ephemeral use provides perfect forward secrecy.
- X25519 is designed to be easy to implement safely.
Weaknesses and known attacks
- Needs authentication (certificates, signatures) to stop man-in-the-middle attacks.
- Implementations that do not validate received points can leak the private key (invalid-curve attacks).
- Vulnerable to Shor's algorithm on a large quantum computer.
Use it for
- TLS 1.3, SSH, IPsec and messaging key agreement
Don't use it for
- Encrypting data directly
- Long-term confidentiality without a post-quantum hybrid
Exam tip
ECC gives equivalent security with much smaller keys than RSA, which is why it suits mobile and IoT. The E at the end of ECDHE means ephemeral, which means forward secrecy.