9

What will the signature length for 256 bit EC key in ECDSA algorithm? I wanted to validated signature length for the same. It will be great if some body can help me with one EC key set.

1

1 Answer 1

14

It depends on how you encode the signature. This is the code segment from OpenSSL that measures the length of ECDSA signature in DER format.

/** ECDSA_size
 * returns the maximum length of the DER encoded signature
 * \param  eckey pointer to a EC_KEY object
 * \return numbers of bytes required for the DER encoded signature
 */

int ECDSA_size(const EC_KEY *r)
{
    int ret,i;
    ASN1_INTEGER bs;
    BIGNUM  *order=NULL;
    unsigned char buf[4];
    const EC_GROUP *group;

    if (r == NULL)
        return 0;
    group = EC_KEY_get0_group(r);
    if (group == NULL)
        return 0;

    if ((order = BN_new()) == NULL) return 0;
    if (!EC_GROUP_get_order(group,order,NULL))
    {
        BN_clear_free(order);
        return 0;
    } 
    i=BN_num_bits(order);
    bs.length=(i+7)/8;
    bs.data=buf;
    bs.type=V_ASN1_INTEGER;
    /* If the top bit is set the asn1 encoding is 1 larger. */
    buf[0]=0xff;    

    i=i2d_ASN1_INTEGER(&bs,NULL);
    i+=i; /* r and s */
    ret=ASN1_object_size(1,i,V_ASN1_SEQUENCE);
    BN_clear_free(order);
    return(ret);
}

The result of the above function with an EC_KEY on prime256 curve as parameter is

sig_len = ECDSA_size(eckey);

where sig_len is 72.

You need 72 bytes for DER encoded ECDSA signature using a 256-bit EC key.

5
  • 1
    Note this is the maximum length; a significant fraction of actual signature values are shorter. If handling them yourself it is okay to include trailing unused space e.g. in a fixed-size database column, but for checking a received value, or when putting in a composite like an X.509 cert, you must support variable length. Feb 15, 2018 at 22:38
  • 1
    As you said it depends on the encoding. P1363 only needs 64 bytes. And an OpePGP encoding only needs 66 bytes. As you pointed out, ASN.1/DER needs up to 72 bytes. DER requires a minimum number of bytes. If ASN.1/BER is used, then the signature can be hundreds of bytes. Just pad the INTEGER on the left with a string of 0's. I believe BER is the case @dave_thompson pointed out.
    – jww
    Feb 18, 2018 at 5:21
  • @jww: there are other encodings, but OpenSSL only outputs DER, and this answer uses OpenSSL and explicitly says DER, and that's what I was commenting on. However, BER does not allow 'oversize' INTEGERs (nor composite ones); all it could do is make the SEQUENCE indefinite with EOC and that only adds 2 octets (and they're trailing zeros, which some sw mangles!) Feb 18, 2018 at 9:35
  • 1
    Yes this seems correct, because I tried generating an ECDSA signature that uses the SHA256 in the mbedTLS library using the method mbedtls_pk_sign . I was expecting to get a 64 byte result, as the pure mathematics of it would suggest (see [cryptobook.nakov.com/digital-signatures/…) But the result I got was 72, and the mbedTLS library uses the DER encoding format, so this seems correct to me after reading this post.
    – Papyrus
    Jul 7, 2022 at 15:29
  • ASN1 integers (used in DER encoding) are signed. But these signatures use unsigned numbers. This means that if the upper bit is "1", it would be a negative number. So to express an ASN1 unsigned integer whose top bit (if expressed as "X") bits were to be "1" and therefore negative requires adding a 0x00 MSB. Therefore such an integer must be expressed with one extra byte.
    – Brad
    Jan 26 at 18:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.