ECDSA P-256

An elliptic-curve signature algorithm over NIST P-256, quantum-vulnerable but not retroactively attackable.

Quantum-vulnerable

ECDSA over NIST P-256 (secp256r1) is the most common elliptic-curve signature algorithm in TLS certificates. It offers roughly 128 bits of classical security with much smaller keys and signatures than RSA.

Like all classical public-key cryptography, it is broken by Shor's algorithm.

Why it is graded gently

We report quantum-vulnerable certificate signatures, but we weight them far below key exchange, and the reasoning is worth stating plainly.

A signature attack requires the attacker to have a quantum computer during the certificate's validity window. Certificates are short-lived and getting shorter. There is no way to record a signature now and forge it later.

A key exchange attack does not have that constraint. The traffic is captured today and decrypted whenever the capability arrives. That asymmetry is why our grading methodology puts 60% of the score on key exchange.

The same curve in two roles

P-256 appears both as a signature curve (ECDSA) and as a key-exchange group (ECDH over secp256r1). These are graded differently for the same reason as above: the ECDH use is retroactively attackable, the ECDSA use is not.

A host can perfectly reasonably keep an ECDSA P-256 certificate while moving its key exchange to a hybrid group. That combination is not inconsistent — it is the correct order of operations.

What replaces it

NIST standardised ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for signatures. The constraint is not the algorithms but the ecosystem: public certificate authorities do not yet issue post-quantum certificates at scale, and every client that must validate them needs support first.

This is a good argument for crypto-agility — being able to change algorithm without re-architecting — rather than for waiting.

Related

AlgorithmRSA-2048Still the most common certificate key size on the web. What NIST's transition timeline means for RSA-2048, and why key exchange matters more than signatures.FrameworkNIST IR 8547NIST's draft roadmap for retiring quantum-vulnerable cryptography: RSA and elliptic curve deprecated after 2030, disallowed after 2035.TermCrypto-agilityThe ability to change cryptographic algorithms without re-architecting, and why it matters more than any single algorithm choice.

Last reviewed 2026-07-21.