AsymmetricRecommended
Elliptic Curve Digital Signature Algorithm
Digital signatures
How it works
ECDSA signs a hash of the message using an elliptic curve private key and a fresh secret random value (the nonce, k) for each signature. Anyone with the public key can verify the signature. It is widely used in TLS certificates, code signing and cryptocurrencies.
Sizes: Common curves P-256 and P-384
Status: Sound with a correctly generated per-signature nonce; vulnerable to future quantum computers.
Strengths
- Small keys and signatures compared with RSA
- FIPS-approved (FIPS 186-5)
Weaknesses and known attacks
- Reusing or leaking the per-signature nonce reveals the private key; this is how the Sony PlayStation 3 signing key was recovered in 2010.
- Even slightly biased nonces can leak the key over many signatures. RFC 6979 defines deterministic nonce generation to avoid this.
- Vulnerable to Shor's algorithm on a large quantum computer.
Use it for
- TLS certificates, code signing, software updates
Don't use it for
- Encryption (it only signs)
- Implementations with a weak random number generator
Exam tip
ECDSA's famous failure is nonce reuse leaking the private key. EdDSA avoids it by deriving the nonce deterministically.