Elliptic Curve Key Strength Calculator
Elliptic-curve cryptography reaches high security with small keys because the elliptic-curve discrete logarithm has no known sub-exponential attack. This calculator turns an ECC field size into its symmetric-equivalent security (about half the field size) and the comparable RSA modulus size, using the NIST SP 800-57 comparable-strength table. Enter a curve field size to see the security level and how it stacks up against RSA.
ECC strength formula
security bits = field size / 2
(best attack: Pollard rho on the ECDLP, about 2^(n/2) work)
equivalent RSA from NIST SP 800-57 anchors:
112 : 2,048, 128 : 3,072, 192 : 7,680, 256 : 15,360
The elliptic-curve discrete logarithm problem is attacked by Pollard's rho method at a cost near the square root of the group order, so an n-bit curve gives about n/2 bits of security. The matching RSA size comes from the NIST comparable-strength table, interpolated between anchor points.
Worked example
A 256-bit curve (such as P-256) gives 256 / 2 = 128-bit security, meeting the NIST minimum, and matches a 3,072-bit RSA modulus. A 384-bit curve gives 192-bit security (RSA-7680), and a 521-bit curve gives about 260-bit security, comfortably above the 256-bit RSA-15360 level.
ECC key strength: frequently asked questions
How strong is an elliptic-curve key?
An elliptic-curve key over an n-bit field gives about n/2 bits of security, because the best known attack (Pollard's rho on the elliptic-curve discrete logarithm problem) takes roughly 2^(n/2) work. So a 256-bit curve offers about 128-bit security.
What field sizes map to which security levels?
Per NIST SP 800-57, a 256-bit curve gives 128-bit security, a 384-bit curve gives 192-bit, and a 521-bit curve gives 256-bit. A 224-bit curve gives 112-bit security, the current minimum. The common NIST curves P-256, P-384 and P-521 follow this mapping.
Why are ECC keys so much smaller than RSA keys?
RSA is attacked by sub-exponential factoring, so its keys must grow quickly for added strength. The elliptic-curve discrete logarithm has no known sub-exponential attack, so ECC reaches the same security with far smaller keys: a 256-bit curve roughly matches a 3,072-bit RSA modulus.
What is the equivalent RSA size shown here?
This calculator maps the ECC security level to the comparable RSA modulus size from the same NIST SP 800-57 table: 128-bit security corresponds to RSA-3072, 192-bit to RSA-7680 and 256-bit to RSA-15360. It interpolates for in-between security levels.
Sources and references
- NIST Computer Security Resource Center: SP 800-57 Part 1, comparable-strength table.
- NIST Computer Security Resource Center: FIPS 186-5, digital signature standard (elliptic curves).
- Method: ECC security = field size / 2; RSA equivalence interpolated from SP 800-57 anchors.
Reviewed by the CalculatorHub team, edited by James Graham, 19 June 2026. See our methodology.