Elliptic curve cryptography (ECC)

Public-key cryptography on elliptic curves: ECDSA, EdDSA and ECDH, short keys, approved curves, and why wallets and smartcards rely on it.

Public-key cryptography built on the mathematics of elliptic curves. It does the same jobs as RSA - signing, key agreement - with far shorter keys: a 256-bit elliptic curve key is generally taken to be comparable in strength to a 3072-bit RSA key.

The family names you meet in practice are ECDSA and EdDSA for signatures and ECDH for key agreement, on named curves such as NIST P-256 and P-384 or Ed25519. Which curves and parameters are acceptable is not a matter of taste: certification schemes and Common Criteria evaluations lean on the published list of agreed cryptographic mechanisms, and a QSCD is evaluated against those choices. That list was SOG-IS's until 2024 and is now maintained by the European Cybersecurity Certification Group, edited by ANSSI - so a document that still cites SOG-IS is pointing at the right list under its old owner.

Short keys are why ECC took over the places where space and time are scarce. An HSM signs faster with it, a smartcard can hold it, and a wallet credential in SD-JWT or mdoc form stays small enough to travel through a QR code or over NFC - those formats settled on EC signatures for exactly that reason. What ECC does not give you is protection against a quantum computer: shorter keys do not help there, which is the whole point of post-quantum cryptography.