I'm trying to perform ECDSA verification in hardware. I'm using the SECT233R1 curve (NIST B-233). I have a question about the hash function used while doing so.

I want to use the SHA256 hash function while signing and verifying. In this case, the hash function will have a larger message length (256-bits) than the elliptic curve finite field element (233-bits).

I have the same question as this. Is it sufficient to operate on the lower 233-bits?

Thanks in advance!


1 Answer 1


Is it sufficient to operate on the lower 233-bits (of the SHA-256 hash)?

No. That's not my reading of the de-facto reference: sec1v2's statement of ECDSA, section 5 (with the second case of section 5.2 applicable), combined with the endianness specification of SHA-256.

When signing per ECDSA with curve sect233r1 and SHA-256, one should keep the leftmost/first/high-order 233 bits of the SHA-256 hash, and consider this as an integer per big-endian convention.

That is keep the first 29 out of 32 bytes, and the high-order bit of the 30th byte. That later bit will be the parity of the integer $e$ used in next steps.

  • $\begingroup$ Thanks for your answer! $\endgroup$ Nov 22, 2022 at 11:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.