Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My understanding of ECDSA signature length is that it depends on the key size. So for instance, if a "prime256v1" is used, the signature length will be 64 because (n/8)*2 and for "secp384r1" it will be 96. However, I don't understand why is it for "secp521r1" the signature length is 132 instead of 130?

share|improve this question

An ECDSA signature consists of two integers that can range between 0 and $n$, where $n$ is the curve order.

For secp521r1, the curve order is just a shade under $2^{521}-1$, hence it requires 521 bits to express one of those integers, or 1042 to express two.

130 bytes would not be sufficient, as that has only 1040 bits.

131 bytes would suffice; however the convention is to express those two integers separately; each integer takes up 66 bytes, and hence 132 is used for the two. You could combine the top byte of each integer into a single byte (as the top byte of each integer is either 0 or 1), reducing the signature size to 131 bytes; however I haven't heard of anyone bothering.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.