Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In ASN.1, the X and Y values for a 256-bit elliptic curve key are stored as a single 66-byte ASN.1 BITSTRING. Are the values just the first and second half of this bitstring?

The private key is an OCTET STRING at the beginning of the DER private key and I know what to do with it; the public key is a BITSTRING for some reason.

share|improve this question
Public keys are always BIT STRING in X.509; this is an historical remnant from older times, kept for the sake of backward compatibility. – Thomas Pornin Mar 30 '13 at 20:24
up vote 7 down vote accepted

The first octet in a DER encoded BITSTRING is the number of unused bits (0 in this case). The remaining 65 octets are the elliptic curve point encoded as described in SEC 1 ( section 2.3.4. The first octet distinguishes the identity point and whether point compression is being used. Since you have 65=1+32+32 octets, this is an uncompressed point and the first octet should be 04, follows by the X and Y values encoded as described in section 2.3.6 (basically fixed length big endian).

share|improve this answer
Link is broken: The PDF can be found via the Internet Archive:… – Etan Mar 17 '15 at 11:37

An ECDSA private key is just an integer, not a pair of integers. Therefore you simply need to interpret this bitstring as an integer, per the ASN.1 specs.

share|improve this answer
How about the public key? – joeforker Mar 28 '13 at 14:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.