# What Is P-256 (secp256r1, prime256v1, NIST P-256)?

> P-256 is a NIST elliptic curve over a 256-bit prime field, also named secp256r1 or prime256v1, widely used for ECDSA certificates and ECDHE.

Source: https://ssl.sh/glossary/p-256/
Last updated: 2026-11-10

P-256 is an elliptic curve standardized by NIST and also published by SECG as secp256r1; OpenSSL calls it prime256v1. All three names refer to the same curve. It provides about 128-bit security. In TLS it is used as the key-exchange group secp256r1 for [ECDHE](https://ssl.sh/glossary/ecdhe/) and in the signature scheme ecdsa_secp256r1_sha256 for [ECDSA](https://ssl.sh/glossary/ecdsa/).

## Why it matters
P-256 is the most common curve for ECDSA certificates. As of November 2026, WebPKI CAs issue ECDSA certificates on P-256 and P-384. The TLS 1.3 specification ([RFC 8446](https://www.rfc-editor.org/rfc/rfc8446), now [RFC 9846](https://www.rfc-editor.org/rfc/rfc9846)) makes secp256r1 key exchange and ECDSA P-256 signatures mandatory to implement for TLS 1.3, so practically every TLS stack supports it. It also has broad support in hardware security modules and FIPS-validated modules. For key exchange, many clients prefer X25519 (or the hybrid X25519MLKEM768), with P-256 as the widely supported fallback.

## Example
Generate a P-256 key and confirm the curve:

```bash
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out example.com.key
openssl pkey -in example.com.key -noout -text | grep -i curve
```

The output shows the OID name prime256v1 and the NIST name P-256. In nginx, `ssl_ecdh_curve X25519:prime256v1;` offers it as a key-exchange group.

## Common misconceptions
- **"P-256, secp256r1 and prime256v1 are different curves."** They are three names for one curve, used by NIST, SECG and OpenSSL respectively.
- **"P-256 is weaker than RSA-2048 because 256 is less than 2048."** P-256 gives about 128-bit security versus roughly 112 bits for RSA-2048.
- **"P-256 is known to be broken."** How its constants were chosen has been debated for years, but no practical weakness is known and it remains approved and widely deployed.

## Related terms

- [ECC](https://ssl.sh/zh/glossary/ecc/): ECC 即椭圆曲线密码学，是基于有限域上椭圆曲线代数结构的公钥密码技术，能用较短的密钥提供很高的安全强度。
- [ECDSA](https://ssl.sh/zh/glossary/ecdsa/): ECDSA 是基于椭圆曲线的数字签名算法，在 TLS 证书中作为 RSA 的替代方案，密钥和签名更小、签名运算更快。
- [ECDHE](https://ssl.sh/zh/glossary/ecdhe/): ECDHE 是椭圆曲线上的临时 Diffie-Hellman 密钥交换，TLS 双方每次握手都生成新的椭圆曲线密钥对，并据此协商出共享密钥。
- [Ed25519](https://ssl.sh/zh/glossary/ed25519/): Ed25519 是在 Curve25519 爱德华兹形式上实现的 EdDSA 签名方案，由 RFC 8032 定义，公钥 32 字节，签名 64 字节且为确定性签名。
- [密钥长度](https://ssl.sh/zh/glossary/key-size/): 密钥长度是密钥的位数，其安全含义取决于算法，例如 256 位的 ECDSA 密钥比 2048 位的 RSA 密钥更强。
- [X25519MLKEM768](https://ssl.sh/zh/glossary/x25519mlkem768/): X25519MLKEM768 是把经典的 X25519 与后量子算法 ML-KEM-768 组合起来的 TLS 1.3 混合密钥交换群，Chrome 从 131 版起使用。