What is ECC?ECC stands for elliptic curve cryptography and is an alternative approach to public-key cryptography over the current RSA standard.
What is different about ECC vs. RSA?Approaches to public-key cryptography are based around the impracticality of solving specific mathematical problems. RSA for instance, is based around the infeasibility of factoring the product of two large primes. ECC’s approach centers on the difficulty of finding the discrete logarithm between points on an elliptic curve, even if one of those points is known.
What are the advantages of ECC vs. RSA?ECC can use smaller key sizes while offering comparable cryptographic strength.For example, a 256-bit ECC key is equivalent to an RSA 3072-bit key. See the table below for a more complete comparison:
|Symmetric Key length (bit)||RSA Key length (bit)||ECC Key length (bit)|
The smaller key size means less computational overhead and reduced storage requirements, which in turn translates to better performance, especially for computationally constrained devices.
Yes, as of May 27th, 2015 you can paste in an ECC CSR when you order or reissue your SSL Certificate for all GlobalSign SSL products. The certificate will be signed under the same SHA-256 hierarchy for that product eliminating the need to add additional intermediates to your existing server configuration.
Does GlobalSign offer ECC Certificates?
GlobalSign offers free reissues, consider reissuing your SSL certificate today to take advantage of the improved security!
Are there any special requirements?There are many different ECC Curves; GlobalSign will sign ECC keys generated using the NIST SuiteB P-256 and P-384 curves.
How can I generate an ECC key & CSR?The OpenSSL command to generate a 256-bit ECC key is:
openssl ecparam -out server.key -name prime256v1 -genkey
From there, you can use the standard command to generate a CSR from your ECC key:
openssl req -new -key server.key -out server.csr
For IIS, you will need to specify the Cryptographic Service Provider to generate an ECC key. Detailed instructions here.