# X.509 ECDSA signature field in DER format includes '00' between bit string and sequence of r and s

I created a X.509 certificate with ECDSAwithSHA256(OID=1.2.840.10045.4.3.2) by openssl.
ECC parameter is secp256r1.

Following is the signatureAlgorithm and signatureValue.

30 0A 06 08 2A 86 48 CE 3D 04 03 02 // signatureAlgorithm field
03 49 // the starts of signatureValue indicating bitstring length of 0x49 bytes.
00 // what is this?
30 46 // the sequence of r and s as specified in RFC3279
02 21 00 98 21 1C AE A4 03 EA 1C 3A 9F 4B 9A AB 94 2E 89 97 67 F1 51 76 F8 00 A8 3B 72 57 1D 95 FA C6 B8 // this is r
02 21 00 A9 79 69 AC 04 A0 8C 2E 40 7C EF 81 B4 E2 1B DE 58 BB E4 EB 3D 4A 0D 7E 2D 80 EB FA 89 B5 B6 E8 // this is s


I don't get what '00' does here.

Is it related with following statements in the X.690 specification?

8.6.2.3 If the bitstring is empty, there shall be no subsequent octets, and the initial octet shall be zero.

## 1 Answer

No, the 00 simply indicates how many least significant bits are not used in the last octet of the BIT STRING.

As the bit string contains an octet string (consisting of the sequence of two integers) it will always be zero, as all the bits in the BIT STRING are used. This is defined for the BER/DER encoding of BIT STRING itself.

As for why the signature is not specified as an OCTET STRING itself, well, beats me, as most signatures are defines as OCTET STRING anyway, even if they are not constructed such as RSA signatures.

• Thank you. I got it. I've been confused with bit string and octet string. – rary21 Apr 17 '20 at 3:30