Trivy reports an EC algorithm asset whose estimated classical security level is less than 112 bits. An estimate of exactly 112 bits does not match this rule.
Classical security strength describes estimated resistance to attacks using classical computers. It is different from the curve’s key size: for example, Trivy assigns P-256 a classical security level of 128 bits.
Curves with lower security strength offer less resistance to attacks against the underlying discrete logarithm problem. Depending on their use, this can undermine digital signatures or key agreement. The 112-bit threshold follows the baseline strength in NIST SP 800-131A Rev. 2 for generating elliptic curve signatures and for approved elliptic curve key agreement.
The rule can only evaluate curves that Trivy can parse and for which it can estimate a classical security level. A missing estimate does not produce a finding. See the scanner documentation for supported algorithms and parsing limitations.
The finding refers to the EC algorithm asset rather than each individual key. Several keys using the same curve in one file may therefore share one finding. This rule does not assess the complete strength of a certificate signature or determine whether an application uses the algorithm.