The difference in size between ECDSA output and hash size

So if I use secp256k1 for example, I've got my key size of 256 bit, and say I sign a SHA256 hash of a message, with size 256 bit, I get an output of size 512bit. Why is there a difference between the hash size and the EC size. In other words, why isn't SHA512 used instead to provide bigger entropy?

I'm not too familiar with the actual ECDSA algorithm so I'm probably missing something.

Thanks!

1 Answer

First to explain you, why you get 512-bit outputs from a 256-bit curve:
The output is basically a point (x-coordinate is enough) and a message-dependant value, with the x-coordinate being expressed as integer. You can verify the signature by checking for a specific relationship between the point and the message-dependant value and the public key point. In order for this relationship to be build the private key is required.

Second, to answer your question why SHA-256 is used and not SHA-512. Consider how the hash function is actually used in ECDSA. You always take the $n$ leftmost bits of it, with $n$ being the curve order bitlength. So if you use SHA-512 you're "wasting" 256 bits, whereas with SHA-256 you "waste" nothing.
And from a key-length point it also makes sense to settle on the 128-bit security level (which is defined through your choice of secp256) and it would make no sense to choose a hash-function with 256-bit security level to be used with a curve providing 128-bits.

• Well, with modular arithmetic that should be almost nothing, even with 256 bits. Note that there is also the less known SHA-512/256 which is somewhat more secure and actually faster on 64 bit machines (but support, alas, is generally lacking from crypto-API's. May 21 '15 at 21:46
• The output of ECDSA is a couple (r, s) of numbers computed modulus n (one of the curve parameters, it is a 256 bit prime). This is the reason to get a 512 bit signature. May 21 '15 at 22:29