What is elliptic curve cryptography?

Elliptic curve cryptography builds key pairs from points on an elliptic curve over a finite field. It gives about the strength of 3072-bit RSA with 256-bit keys, and Bitcoin signs with the secp256k1 curve.

Also called ECC or elliptic curves.

How the curve makes keys

An elliptic curve is the set of points that satisfy an equation of the form y^2 = x^3 + ax + b over a finite field. Adding points on the curve is quick. Working backwards is very hard: given a starting point and a multiple of it, finding the multiplier takes an enormous number of steps. The private key is that multiplier, and the public key is the resulting point.

Why it is small and fast

  • SEC 2 rates secp256k1 at 128 bits of strength, the same level as 3072-bit RSA.
  • Its field size is 256 bits, so keys and signatures are much shorter than RSA keys of the same strength.
  • Each operation works on numbers of that size, which makes the arithmetic much lighter than modular arithmetic on 3072-bit numbers.

Why quantum computers threaten it

Shor’s algorithm applies to the discrete logarithm problem on elliptic curves, so a quantum computer running it would recover the private key from a visible public point. NIST says that signatures based on discrete logarithms over elliptic curves would be at risk if large-scale quantum computers are ever realized.

In Redacted

Bunker mode builds its notes, proofs and signatures with no elliptic curves and no lattices. Its proofs are STARKs, whose only cryptographic building block is the hash.

Bunker mode →

Related terms

ECDSAECDSA is the elliptic-curve signature scheme behind most Bitcoin and Ethereum wallets. It proves that the holder of a private key approved a message without revealing the key, and its security rests on the secp256k1 curve.Shor’s algorithmShor’s algorithm is a quantum method, described by Peter Shor in 1994, that factors large numbers and computes discrete logarithms in polynomial time. A large enough quantum computer running it would break RSA and elliptic-curve signatures such as ECDSA.Public-key cryptographyPublic-key cryptography gives each person a private key that stays secret and a public key that anyone can see. A signature made with the private key can be checked with the public key, so no secret has to be shared in advance.Post-quantum cryptographyPost-quantum cryptography is ordinary cryptography designed to stay secure when large quantum computers exist. It replaces the key exchanges and signatures that Shor’s algorithm breaks, such as RSA and elliptic curves, with schemes built on lattices, hash functions or error-correcting codes.Exposed public keyA public key is exposed once it is visible on the chain, which usually happens the first time its address spends. Until then most addresses show only a hash of the key, which gives a key-breaking attacker nothing to start from.Finite fieldA finite field is a set with a fixed number of elements, where addition, subtraction, multiplication and division by a nonzero element always stay inside the set. STARKs do their arithmetic in one.

Sources: SEC 2: Recommended Elliptic Curve Domain Parameters, Standards for Efficient Cryptography, version 2.0, 2010 · Secp256k1, Bitcoin Wiki · FIPS 204, Module-Lattice-Based Digital Signature Standard, NIST, 2024

Updated November 1, 2026. All terms