P-256 (secp256r1, prime256v1, NIST P-256)

P-256 is an elliptic curve standardized by NIST and also published by SECG as secp256r1; OpenSSL calls it prime256v1. All three names refer to the same curve. It provides about 128-bit security. In TLS it is used as the key-exchange group secp256r1 for ECDHE and in the signature scheme ecdsa_secp256r1_sha256 for ECDSA.

Why it matters

P-256 is the most common curve for ECDSA certificates. As of November 2026, WebPKI CAs issue ECDSA certificates on P-256 and P-384. The TLS 1.3 specification (RFC 8446, now RFC 9846) makes secp256r1 key exchange and ECDSA P-256 signatures mandatory to implement for TLS 1.3, so practically every TLS stack supports it. It also has broad support in hardware security modules and FIPS-validated modules. For key exchange, many clients prefer X25519 (or the hybrid X25519MLKEM768), with P-256 as the widely supported fallback.

Example

Generate a P-256 key and confirm the curve:

openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out example.com.key
openssl pkey -in example.com.key -noout -text | grep -i curve

The output shows the OID name prime256v1 and the NIST name P-256. In nginx, ssl_ecdh_curve X25519:prime256v1; offers it as a key-exchange group.

Common misconceptions

• "P-256, secp256r1 and prime256v1 are different curves." They are three names for one curve, used by NIST, SECG and OpenSSL respectively.
• "P-256 is weaker than RSA-2048 because 256 is less than 2048." P-256 gives about 128-bit security versus roughly 112 bits for RSA-2048.
• "P-256 is known to be broken." How its constants were chosen has been debated for years, but no practical weakness is known and it remains approved and widely deployed.