NIST Curves

When two computers want to communicate securely with each other, they need to exchange keys without anyone else being able to eavesdrop. To do this, they use mathematics — and the most common basis for this is elliptic curves. These are not curves in the everyday geometric sense, but sets of points that obey a particular equation and have special computational properties. In the late 1990s, the US agency NIST (National Institute of Standards and Technology, the official American standards body for technology and security) defined a selection of such curves and published them as a standard. These curves have since been known as NIST curves. The best-known ones bear names like P-256, P-384, and P-521 — the number indicates how many bits long the keys are.

Role in modern encryption

NIST curves are embedded in a large share of encrypted connections on the internet. When someone visits a website via HTTPS today, a session key is negotiated with the server in the background. This almost always happens via a method called elliptic curve cryptography — and the curve behind it is in many cases P-256. This applies to browsers, operating systems, VPN software, and many hardware chips.

The decisive advantage over older methods like RSA is efficiency. A P-256 curve offers similar security to a 3072-bit RSA key — but is significantly shorter and requires less computing power. This makes NIST curves particularly attractive for devices with limited power and memory, such as smart cards or IoT sensors.

How the curves work mathematically

An elliptic curve is defined by an equation of the form y² = x³ + ax + b, where a and b are fixed numbers. On this curve, points can be “added” in a special way: a line is drawn through two points, and the third intersection point with the curve is mirrored across the x-axis. The result is again a point on the curve. This operation can be repeated — in other words, a point is “multiplied” by a whole number.

The security-relevant core is this: it is easy to add a point to itself n times. But reconstructing n from the result is computationally so demanding that even the fastest computers in the world would need longer than the age of the universe to do so. The entire security rests on this so-called discrete logarithm problem. Choosing P-256 means fixing which specific starting point and which curve parameters are used — that is the standard NIST has prescribed.

The curve parameters — that is, the specific numbers a and b as well as a fixed starting point — were determined by NIST without the calculation method behind them being fully disclosed. This is precisely the origin of a debate that remains unresolved to this day.

Backdoor suspicions and the Snowden documents

In 2013, whistleblower Edward Snowden published secret documents from the US intelligence agency NSA. They suggested that the NSA had deliberately contributed to a NIST standard for random number generators in order to build in a hidden backdoor. This standard also used elliptic curves. As a result, the choice of NIST curves also came under suspicion: had the parameters been chosen in such a way that the NSA could decrypt connections that appear secure to everyone else?

This has still not been proven for P-256 and its siblings to this day. Nevertheless, the debate has had consequences. Many developers and organizations have since switched to alternative curves, above all to Curve25519, which was designed by mathematician Daniel J. Bernstein and published with fully disclosed parameters. Curve25519 is now widespread in applications such as Signal, WhatsApp, and modern versions of TLS. NIST curves have nonetheless not disappeared — they remain mandated in many government and industry standards, for instance at agencies that must comply with US certifications.