What is ECDSA?
ECDSA, the Elliptic Curve Digital Signature Algorithm, is the elliptic curve version of the older DSA signature scheme. A signer uses an elliptic curve private key to sign the hash of a message, and anyone with the matching public key can verify the signature. ECDSA was standardized in ANSI X9.62 and in NIST's FIPS 186 series, whose current edition, FIPS 186-5, is the reference for U.S. government use. It signs TLS certificates and handshakes, software, DNSSEC records, smart card and passkey logins, and cryptocurrency transactions.
How ECDSA signing works
- The signer hashes the message, for example with SHA-256 when using the P-256 curve.
- The signer picks a fresh secret random number, called the nonce or k, for this one signature.
- From the hash, the nonce and the private key, the algorithm computes two numbers, r and s. The pair (r, s) is the signature.
- The verifier hashes the message again and uses the signer's public key to confirm that r and s match that hash. Only the holder of the private key could have produced them.
The common curves are P-256 (also called secp256r1 or prime256v1) and P-384, the NIST curves used throughout TLS and government systems. Bitcoin and Ethereum use a different curve, secp256k1. On a certificate, ECDSA shows up as a signature algorithm such as ecdsa-with-SHA256 or ecdsa-with-SHA384, and in WebAuthn and passkeys as the algorithm identifier ES256.
Smaller keys and signatures
ECDSA's main advantage over RSA is size at the same security level. Both rows below give roughly 128-bit security:
| Algorithm | Public key | Signature |
|---|---|---|
| RSA-3072 | 384-byte modulus | 384 bytes |
| ECDSA on P-256 | 64 bytes (two 32-byte coordinates) | 64 bytes (r and s), slightly more once DER-encoded |
Smaller certificates and handshakes help phones, IoT devices and busy servers, and ECDSA signing is much faster than RSA signing at this strength. RSA still verifies faster, which matters little on modern hardware.
The nonce must never repeat
ECDSA's weak point is its per-signature nonce. If the same k is ever used for two signatures under one key, anyone who sees both signatures can solve for k and then for the private key with straightforward algebra. Even a slightly predictable or biased nonce can leak the key across enough signatures. Sony's PlayStation 3 is the best-known case: its code signing used the same value of k every time, and in 2010 researchers calculated Sony's private signing key from published signatures, after which anyone could sign software the console would run. In 2013 a flaw in Android's random number generator led to repeated nonces and stolen bitcoins from Android wallet apps.
The fixes are a properly seeded cryptographically secure random generator, or deterministic ECDSA as defined in RFC 6979, which derives k from the private key and the message hash with HMAC so that no fresh random number is needed at signing time. FIPS 186-5 approves deterministic ECDSA.
ECDSA vs. EdDSA vs. RSA vs. ECDH
- EdDSA, usually Ed25519, is a newer elliptic curve signature scheme that is deterministic by design, so the nonce mistake can't happen, and it is generally easier to implement safely.
- RSA signatures rely on factoring and need much larger keys for the same strength.
- ECDH and ECDHE use elliptic curves for key agreement, not signatures. A TLS 1.2 suite labeled ECDHE-ECDSA uses both: ECDHE sets up the session key and ECDSA authenticates the server.
- DSA, the original finite-field scheme, is no longer approved for creating new signatures.
Like RSA, ECDSA would fall to a large quantum computer running Shor's algorithm. ML-DSA is NIST's post-quantum replacement for signatures.
ECDSA on the CompTIA Security+ exam
ECDSA is taught with digital signatures and asymmetric algorithms under SY0-801 objective 1.3, the cryptographic solutions objective, and nonce reuse is a cryptographic vulnerability of the kind covered under objective 2.4. Wording such as "digital signatures on low-power devices with small keys" points to ECDSA, or to elliptic curve cryptography generally. "An attacker recovered the signing key because two signatures used the same random value" points to nonce reuse. Distractors include ECDHE, which exchanges keys rather than signing, AES, which is symmetric, and longer RSA keys, which add size rather than efficiency.