P-256 is a named, standardized elliptic curve for public-key cryptography. It defines the curve choice behind a 256-bit elliptic-curve public key, so compatible parties can use the same cryptographic parameters. section 8.1.4 section 7.1.1
When choosing or recognizing P-256:
- Use the same curve on both sides of an ECC exchange; mismatched curves cannot interpret one another’s encrypted messages. section 7.1.1
- Treat P-256 as an approved named curve rather than assuming every mathematically possible curve is safe. section 7.1.1
- Recognize that curve selection involves security, performance, implementation safety, and trust in the curve designer. section 7.1.1
P-256 in an X.509 certificate
A GitHub certificate identifies its public-key algorithm as id-ecPublicKey, its key size as 256 bits, and its curve as prime256v1, also labeled NIST CURVE: P-256. section 8.1.4
Listing 8.4 Subject fields for the github.com certificate as of March 5, 2022
Subject: C=US,ST=California,L=San Francisco,O="GitHub, Inc.",CN=github.com
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (256 bit)
pub:
04:a3:a4:03:46:03:df:46:51:56:cb:c9:39:ab:22:
cd:e7:6c:59:96:7a:93:a0:fb:b9:40:1c:90:32:88:
36:c6:09:76:9c:50:f5:55:f7:76:5e:68:20:9c:ee:
22:ed:83:0c:15:30:10:41:44:5e:32:ac:90:a1:d5:
aa:f2:e5:43:b3
ASN1 OID: prime256v1
NIST CURVE: P-256
X509v3 extensions:
X509v3 Subject Alternative Name:
DNS:github.com, DNS:www.github.com
Inspect the certificate’s subject, encoded public key, ASN.1 object identifier, and explicit P-256 label. section 8.1.4
