I try to use Elliptic-curve cryptography system first time really, so i confused about it.
this is the scenario: First i want to hash a message then, sign it. i use javascript so i try to follow this code.

The reason of my confused is why this code use 'sha256' algorithm to hash a message? is there any reason for that?

Also is there any hash algorithm customized or preferred to use with ECC?

To be more clear, is ECC using to sign and generate keys but does not have a special algorithm to hash a message?


  • 1
    $\begingroup$ Try to be more precise. 1) In the title you are talking about cryptography in general, which includes encryption and digital signature. In the text you are talking about signature only. 2) "to sign an encrypted message" - this means one particular method, where as other are also possible, e.g. first sign, then encrypt. If you need signature, then ask exactly that, like "how can I sign"? Don't mix it with one particular method. 3) How is SHA-256 related to it? $\endgroup$
    – mentallurg
    Jun 5, 2020 at 4:28
  • $\begingroup$ @mentallurg sorry for that, i tried to clarify my question. $\endgroup$
    – norah
    Jun 5, 2020 at 5:05

1 Answer 1


You really have two questions, and so I'll try to address both of them; it appears that your question really is the second one, but the answer to the first one will illuminate the second one:

The reason of my confused is why this code use [a hash function] to hash a message? is there any reason for that?

Well, we use some public key transform to transform 'the message' and the 'private key' into 'a signature'; however this transform takes input of fixed size. That is, it cannot handle a message longer than expected (and this is pretty much true for all signature algorithms: Elliptic Curve signature algorithms, RSA, postquantum signature algorithms).

Now, we may want to sign documents considerably larger than the maximum that the raw public key operation can handle. The internal parts of ECDSA with P256 can handle only 256 bits at a time, quite often, we want to sign something that's larger than 32 bytes. To handle this, what we do is send the actual message through a 'hash function', that is, a transform that converts our long message into a fixed length (which the raw public key operation can handle). We hash the message, and then hand that hash to the ECDSA internal logic. Then, to verify a signature, the verifier hands the message it has to the same hashing logic, computes the hash, and then hands that hash to the ECDSA verification logic.

By the above description, there are a couple of things which are apparent:

  • The hashing logic must be public; after all, the verifier (which we can assume has the public key, but no secret knowledge) must be able to compute it.

  • The hash must be 'collision resistant'; that is, it should be infeasible (that is, no one can do it) to find two different messages that hash to the same value. After all, if someone could find two messages $\text{Good Message}$ and $\text{Evil Message}$ that hash to the same value, he could take $\text{Good Message}$, convince the signer to generate a signature for it (which he might, as the message is benign), and then that signature would also be a valid signature for $\text{Evil Message}$ (because the signature only depends on the hash, and those two messages hash to the same value).

is why this code use 'sha256' algorithm? is there any hash algorithm customized or preferred to use with ECC?

No, there is no specialized hash algorithm for ECC. If you look through the criteria I gave for hash functions, there's nothing specific to the public key method. A hash function that is good for RSA will also be good for ECC.

We have a number of functions that appear to be good hash functions; SHA256 is one of them, and that happens to be want they picked.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.