7
$\begingroup$

My understanding of ECDSA signature length is that it depends on the key size. So for instance, if a "prime256v1" is used, the signature length will be 64 because (n/8)*2 and for "secp384r1" it will be 96. However, I don't understand why is it for "secp521r1" the signature length is 132 instead of 130?

$\endgroup$
12
$\begingroup$

An ECDSA signature consists of two integers that can range between 0 and $n$, where $n$ is the curve order.

For secp521r1, the curve order is just a shade under $2^{521}-1$, hence it requires 521 bits to express one of those integers, or 1042 to express two.

130 bytes would not be sufficient, as that has only 1040 bits.

131 bytes would suffice; however the convention is to express those two integers separately; each integer takes up 66 bytes, and hence 132 is used for the two. You could combine the top byte of each integer into a single byte (as the top byte of each integer is either 0 or 1), reducing the signature size to 131 bytes; however I haven't heard of anyone bothering.

$\endgroup$
  • 1
    $\begingroup$ And, in fact, in many cases (for instance, everything related to X.509 certificates and SSL/TLS), ECDSA signatures are defined to use ASN.1-based encoding, which increases things a bit, up to 139 bytes for curve secp521r1. So people seems to bother with increasing signature size, not reducing. $\endgroup$ – Thomas Pornin Jul 15 '17 at 4:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.