PricingLoginStart free
Cryptology Academy · Lesson

Standard Curves: P-256, Curve25519, secp256k1

Compare NIST curves, Bernstein's Curve25519, and Bitcoin's secp256k1.

Lesson 3 of 413 steps

Standard Curves: P-256, Curve25519, secp256k1 is a free Cryptology Academy lesson on CoddyKit. This is lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, and your progress syncs across the web and the CoddyKit app. The Cryptology Academy course includes 4 lessons in total.

Welcome

Different elliptic curves are used for different purposes. In this lesson we compare the three most important: NIST P-256, Bernstein's Curve25519, and Bitcoin's secp256k1.

NIST P-256 (secp256r1)

NIST P-256 was standardized in 1999. It uses a Weierstrass curve with a=-3 (fast point doubling). 128-bit security. Required for US government (FIPS). Dominant in TLS, JWT, code signing.

P-256 Controversy

P-256's curve parameters were chosen with an unexplained seed value. The process mirrors Dual_EC_DRBG (which had an NSA backdoor). No backdoor has been proven, but many distrust NIST curves.

Curve25519 (X25519 / Ed25519)

Bernstein designed Curve25519 in 2005 with fully transparent, verifiable parameter selection. Montgomery form: y²=x³+486662x²+x mod (2^255-19). All parameters are justified by efficiency, not arbitrary.

Curve25519 Properties

128-bit security. Cofactor 8 (handled by X25519 implementation). Naturally constant-time on most platforms. No edge-case points. IETF adopted in RFC 7748 and RFC 8032. WireGuard, Signal, SSH use it exclusively.

Ed25519: Edwards Form

Ed25519 is the signature algorithm on a twisted Edwards form of Curve25519. Deterministic (no random nonce needed). Constant-time by design. 64-byte signatures, 32-byte keys. Fastest verification of any signature scheme.

secp256k1: Bitcoin's Curve

secp256k1 is a Koblitz curve: y²=x³+7 (a=0, b=7) over a 256-bit prime. Satoshi Nakamoto chose it for Bitcoin in 2008. Also used by Ethereum. Koblitz curves have some efficiency advantages over NIST curves.

secp256k1 vs P-256

Both are 256-bit curves with ~128-bit security. secp256k1: a=0 enables efficient endomorphism for fast scalar multiplication. P-256: a=-3 enables fast doubling. secp256k1 is faster for signing; P-256 for verification.

Curve448

Curve448 (X448) provides 224-bit security — comparable to RSA-8192. Uses Goldilocks prime 2^448-2^224-1. For applications requiring long-term security beyond P-256. Signal uses it as a backup alongside X25519.

Choosing the Right Curve

TLS/general purpose: P-256 (FIPS) or X25519 (performance+trust). SSH: Ed25519 (most modern clients). Bitcoin/Ethereum: secp256k1 (no choice). High security (20+ year): P-384 or X448.

Curve Parameter Verification

For P-256: NIST FIPS 186-5 lists all parameters with generation seed. For Curve25519: Bernstein's paper explains every constant choice. Transparency of parameter selection is a key security criterion.

Quick Check

Which curve is used by Bitcoin and was chosen by Satoshi Nakamoto?
Answer it in the interactive lesson

Recap

Standard curves compared. Next we analyze ECC vs RSA trade-offs across security level, performance, and key size.
Free to start

Learn Cryptology Academy with an AI tutor — free

Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.

Courses
67
Lessons
261
Start learning freeView the full course

Frequently Asked Questions

Is the “Standard Curves: P-256, Curve25519, secp256k1” lesson free?

Yes — the full text of “Standard Curves: P-256, Curve25519, secp256k1” is free to read here on the web. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO. The Cryptology Academy course includes 4 lessons in total.

What will I learn in “Standard Curves: P-256, Curve25519, secp256k1”?

Compare NIST curves, Bernstein's Curve25519, and Bitcoin's secp256k1. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cryptology Academy?

No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 3 of 4.

How long does the “Standard Curves: P-256, Curve25519, secp256k1” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cryptology Academy lesson?

Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Elliptic Curve Group Law
  2. Scalar Multiplication & the ECDLP
  3. Standard Curves: P-256, Curve25519, secp256k1
  4. ECC vs RSA: Security & Performance Trade-offs
← Back to Cryptology Academy