TL;DR
The Elliptic Curve Digital Signature Algorithm (ECDSA) is a cryptographic method that uses complex elliptic curve mathematics to generate digital signatures that are extremely difficult to reverse-engineer. Standardized by American National Standards Institute (ANSI), The Institute of Electrical and Electronics Engineers (IEEE), and National Institute of Standards and Technology (NIST) between 1999 and 2000, ECDSA is mandatory in Bitcoin environments and offers benefits like reduced risk and faster load times. However, poor implementation — as demonstrated by Sony's 2010 breach — can expose systems to attack, making careful deployment essential.
How does a signature algorithm work?
Let's begin with a bit of background on signature algorithms and the protections they offer.
When you visit a site that begins with https://, your browser does two important things:
- Connect: The two systems use an encrypted channel to exchange information.
- Verify: The browser uses cryptography to ensure that the site isn't a fake put up by a bad actor.
Signature algorithms make this process possible. Both browsers and servers have two keys (public and private) made up of mathematically related numbers. A private key creates a digital signature, and a public key can check its validity.
Since the mid-1990s, websites have used relatively simple mathematical principles in key generation. Hackers love this idea, as cracking the code is somewhat easy.
What is ECDSA?
Complexity sits at the core of the ECDSA key-creation process.
How does the elliptic curve math work?
It's mathematically simple to compute a key in one direction with ECDSA, but it's very difficult to reverse the process. We won't dig too deep into the math, but know that it begins with a curve represented by (y2 = x3 + ax + b). A number on that curve is multiplied by another, and that produces yet another point on the curve. Even if you know one number, finding the other is challenging.
Breaking the ECDSA curve means solving something called the elliptic curve discrete logarithm problem, and that's notoriously hard to do. Hackers keep trying, but it's a very tough math challenge to overcome.
- American National Standards Institute (ANSI) accepted ECDSA as a standard in 1999.
- The Institute of Electrical and Electronics Engineers (IEEE) and National Institute of Standards and Technology (NIST) accepted it as a standard in 2000.
Some sites have implemented this form of digital signature in the intervening years, but it's far from the dominant method.
What are the advantages and disadvantages of ECDSA?
Digital signatures are a critical part of internet protections. But should you use ECDSA algorithms or another version?
| Category | Description |
| Lowered risk | It's mathematically challenging to crack an ECDSA code, although hackers will certainly try to do so. |
| Implementation complexity | Implement the technology poorly (as Sony did in 2010), and you'll leave your site open to hacking. If you're not certain how to put it into practice, it's best to stick with technology you know. |
| Faster load times | Websites aim to load pages within about a half-second. Exchanging keys adds time. ECDA's keys are small, which means they can speed up a site. |
| Required use | If you're operating within the bitcoin environment, you must use ECDSA. No other option is available to you. |
What are the risks of using ECDSA?
Risks involve complexity. Implement the technology poorly and you'll leave your site open to hacking. If you're not certain how to put it into practice, it's best to stick with technology you know.
Let us help
You know you must protect critical data, but you aren't sure how to make it happen. We understand, and we can help. Find out more about what we can do to protect your data, employees, and customers.
Frequently asked questions
What is the elliptic curve digital signature algorithm (ECDSA)?
ECDSA is a form of digital signature that uses elliptic curve mathematics to generate keys. It's mathematically simple to compute a key in one direction, but very difficult to reverse the process — making it a strong cryptographic method for verifying identities online and in cryptocurrency environments.
How does elliptic curve digital signature algorithm (ECDSA) differ from older signature algorithms?
Since the mid-1990s, websites have used relatively simple mathematical principles in key generation, which hackers find easier to crack. ECDSA, by contrast, relies on elliptic curve mathematics, where reversing the key-generation process requires solving the elliptic curve discrete logarithm problem — a notoriously hard mathematical challenge.
Why is elliptic curve digital signature algorithm (ECDSA) required for Bitcoin?
If you're operating within the bitcoin environment, you must use ECDSA. No other option is available to you, making it the mandatory digital signature standard for cryptocurrency transactions in that ecosystem.
What are the main risks of implementing elliptic curve digital signature algorithm (ECDSA)?
The primary risk involves implementation complexity. Implement the technology poorly — as Sony did in 2010 — and you'll leave your site open to hacking. If you're not certain how to put it into practice, it's best to stick with technology you know.
Does elliptic curve digital signature algorithm (ECDSA) affect website load times?
Yes, positively. Websites aim to load pages within about a half-second, and exchanging keys adds time. ECDSA's keys are small, which means they can speed up a site compared to algorithms that use larger keys.
When was elliptic curve digital signature algorithm (ECDSA) officially standardized?
The American National Standards Institute (ANSI) accepted ECDSA as a standard in 1999, and the Institute of Electrical and Electronics Engineers (IEEE) and National Institute of Standards and Technology (NIST) accepted it as a standard in 2000.
References
ECDSA vs. RSA: Everything You Need to Know. (June 2020). InfoSec.
The Elliptic Curve Digital Signature Algorithm. (2001). Certicom Corporation.
What Is a Good Page Load Time for SEO: How Fast Is Fast Enough? (December 2020). SEM Rush.
PS3 Hacked Through Poor Cryptography Implementation. (December 2010). Ars Technica.
