Computational cryptography › Live on mainnet today › Plain curves
SIGNATUREPrimitiveGGM

P-256 ECDSA (passkeys)

In plain words

The curve used by passkeys, Face ID and Touch ID.

The idea: The same math as Ethereum's own curve, on a different curve. Your phone's secure chip holds the private key and signs a challenge when you use Face ID or Touch ID. A precompile lets a smart wallet check that signature cheaply, so the chip in your phone effectively becomes your wallet's key.

Why it matters: Lets smart wallets use your phone's passkey instead of a seed phrase.

The details

On the map: smart-wallet signers, secp256r1 precompile (EIP-7951)

ECDSA on the NIST P-256 curve[1], the signature scheme inside passkeys, Face ID and Touch ID secure enclaves and most hardware security keys[2].

Ethereum added a precompile to verify P-256 signatures cheaply in Fusaka (EIP-7951, December 2025)[3], so smart wallets can let users approve transactions with a passkey instead of a seed phrase. It rests on ECDLP over P-256 and falls to Shor just like secp256k1.

Rests on

If any of these breaks, this breaks too.

If it falls

If this breaks, these break with it.

About the tags

GGM
Its security proof only covers attackers who use the group as a black box (the generic group model), an idealization.

References

  1. NIST. Digital Signature Standard (DSS). NIST FIPS 186-5, 2023. doi:10.6028/NIST.FIPS.186-5
  2. W3C. Web Authentication: An API for accessing Public Key Credentials, Level 2. W3C Recommendation, 2021. w3.org/TR/webauthn-2
  3. Carl Beekhuizen, Ulaş Erdoğan and Doğan Alpaslan. EIP-7951: Precompile for secp256r1 Curve Support. Ethereum Improvement Proposals (Final), 2025. eips.ethereum.org/EIPS/eip-7951