Is elliptic curve cryptography better than RSA?

For most new systems, yes — equivalent security with far smaller keys, faster operations and lower bandwidth. RSA remains common because of enormous existing deployment and simpler implementation.

What curve does Bitcoin use?

secp256k1, defined by y² = x³ + 7 over a 256-bit prime field. Ethereum uses the same curve.

Can quantum computers break ECC?

Yes — Shor's algorithm solves the elliptic curve discrete logarithm just as it factors integers. ECC is actually more vulnerable than RSA per bit, which is why post-quantum migration matters for both.

What's the difference between ECC and ECDSA?

ECC is the underlying mathematics. ECDSA is one specific algorithm built on it for signatures. ECDH, for key exchange, is another.

Why do people distrust some NIST curves?

Curves like P-256 use unexplained constants, prompting speculation after the Dual_EC_DRBG backdoor revelations. Alternatives such as Curve25519 use transparently derived parameters.

Elliptic Curve Cryptography Explained

1. What is an elliptic curve?

Despite the name, an elliptic curve isn't an ellipse. It's the set of points satisfying a deceptively simple equation:

y² = x³ + ax + b

Plotted over the real numbers it makes a smooth, symmetric curve — often a single sweeping arc, sometimes with a separate closed loop. The shape matters less than one remarkable property: you can "add" two points on the curve and always land on another point of the curve. That closure turns a piece of geometry into an algebraic system you can compute with.

Adding two points: draw a line through P and Q, find where it hits the curve again, then reflect that point across the x-axis.

2. Point addition: the strange arithmetic

"Adding" two points has nothing to do with adding coordinates. It's a geometric rule:

Draw a straight line through points P and Q.
That line will cross the curve at exactly one more point.
Reflect that third point across the x-axis. That reflection is P + Q.

To add a point to itself (called doubling), use the tangent line at that point instead. Repeat the doubling and you can reach enormous multiples very quickly — 2P, 4P, 8P, and so on.

In real cryptography we don't use smooth curves over the real numbers. We use curves over a finite field — the points become a scattered cloud of integer coordinates mod a prime — but the same addition rule applies algebraically. Here's an example on y² = x³ + 2x + 2 (mod 17):

P = (5, 1)
2P = (6, 3)
3P = (10, 6)
4P = (3, 1)

Nothing about that sequence looks predictable — and that unpredictability is precisely the point.

3. The trapdoor — why it's one-way

Pick a starting point G (the generator) and a secret number k. Computing k × G — adding G to itself k times — is fast, even for astronomically large k, because you can double your way there in a few hundred steps.

Easy: given k and G, compute K = k × G
Hard: given K and G, recover k

That reverse problem is the elliptic curve discrete logarithm problem (ECDLP), and no efficient classical algorithm is known for a well-chosen curve. Your private key is k; your public key is the point K. You can publish K freely and nobody can walk backwards to k.

A large prime is not enough

It is tempting to read “ECDLP is hard” as a property of any curve over a big prime field p. It is not. Hardness is conditional, and a curve that fails any of the conditions below can be broken quickly — in some cases in polynomial time.

The group order needs a large prime factor. What matters is not p but #E(𝔽_p), the number of points on the curve. If that count factors into many small primes, the Pohlig–Hellman algorithm splits the problem into one small discrete log per prime factor and reassembles the answer with the Chinese Remainder Theorem. The real security level is set by the largest prime factor n — roughly √n operations via Pollard's rho — not by the size of p.
The cofactor should be small. Write #E(𝔽_p) = h · n with n prime. Standard curves keep h at 1, 2, 4 or 8. A large cofactor leaves small subgroups that protocols can be tricked into using.
Anomalous curves are broken outright. If #E(𝔽_p) = p exactly, Smart's attack lifts the problem into the p-adics and solves the ECDLP in polynomial time. The curve looks perfectly ordinary until you count its points.
The embedding degree must be large. If n divides p^k − 1 for some small k, the MOV and Frey–Rück attacks use a pairing to transport the problem into the multiplicative group of 𝔽_p^k, where index calculus makes discrete logs far easier. Supersingular curves have k ≤ 6 and are avoided for exactly this reason.

This is why nobody invents their own curve. secp256k1, the curve Bitcoin uses, has prime order with cofactor h = 1 and a large embedding degree — every condition above checked in advance, by people who spent careers learning what to check.

4. ECC vs RSA: why smaller keys win

RSA's security depends on factoring being hard, and factoring algorithms have improved steadily — so RSA keys must keep growing. Attacks on the elliptic curve discrete log have improved far less, so ECC keys stay small.

Security level	RSA key size	ECC key size
112-bit	2048 bits	224 bits
128-bit	3072 bits	256 bits
192-bit	7680 bits	384 bits
256-bit	15360 bits	521 bits

Smaller keys mean less bandwidth, less storage, less battery and faster handshakes — which is why ECC dominates mobile, IoT and modern TLS.

Add points on a real curve yourself

The "Forge on the Curve" boss walks you through doubling and adding points on y² = x³ + 2x + 2 (mod 17).

Try the curve boss →

5. ECDSA and how Bitcoin signs

ECDSA — the Elliptic Curve Digital Signature Algorithm — is how you prove you hold a private key without ever revealing it. Bitcoin and Ethereum both use the curve secp256k1.

Your Bitcoin address is derived from your public key point K. When you spend coins, your wallet produces a signature using the private key k. Every node on the network verifies that signature against K — confirming you authorised the transaction, without any node ever learning your key.

One critical caveat: every signature needs a fresh random number (the nonce). Reuse it, and anyone can compute your private key with simple algebra. That exact bug drained real wallets in 2013 when an Android RNG flaw produced repeated nonces.

6. Frequently asked questions

Is elliptic curve cryptography better than RSA?: For most new systems, yes — equivalent security with far smaller keys, faster operations and lower bandwidth. RSA remains common because of enormous existing deployment and simpler implementation.
What curve does Bitcoin use?: secp256k1, defined by y² = x³ + 7 over a 256-bit prime field. Ethereum uses the same curve.
Can quantum computers break ECC?: Yes — Shor's algorithm solves the elliptic curve discrete log just as it factors integers. ECC is actually more vulnerable than RSA per bit, which is why post-quantum migration matters for both.
What's the difference between ECC and ECDSA?: ECC is the underlying mathematics. ECDSA is one specific algorithm built on it (for signatures). ECDH, for key exchange, is another.
Why do people distrust some NIST curves?: Curves like P-256 use unexplained constants, prompting speculation after the Dual_EC_DRBG backdoor revelations. Alternatives such as Curve25519 use transparently derived parameters — "nothing up my sleeve" numbers.

Keep going

How RSA works

The other pillar of public-key cryptography, with a worked example you can follow by hand.

Read the guide →

Post-quantum

What replaces both RSA and ECC when quantum computers arrive.