Package: crypto/ecdsa

package ecdsa Import Path crypto/ecdsa (on go.dev) Dependency Relation imports 19 packages, and imported by 2 packages

Involved Source Files d ecdsa.go Package ecdsa implements the Elliptic Curve Digital Signature Algorithm, as defined in [FIPS 186-5]. Signatures generated by this package are not deterministic, but entropy is mixed with the private key and the message, achieving the same level of security in case of randomness source failure. Operations involving private keys are implemented using constant-time algorithms, as long as an [elliptic.Curve] returned by [elliptic.P224], [elliptic.P256], [elliptic.P384], or [elliptic.P521] is used. ecdsa_legacy.go notboring.go

Code Examples package main import ( "crypto/ecdsa" "crypto/elliptic" "crypto/rand" "crypto/sha256" "fmt" ) func main() { privateKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) if err != nil { panic(err) } msg := "hello, world" hash := sha256.Sum256([]byte(msg)) sig, err := ecdsa.SignASN1(rand.Reader, privateKey, hash[:]) if err != nil { panic(err) } fmt.Printf("signature: %x\n", sig) valid := ecdsa.VerifyASN1(&privateKey.PublicKey, hash[:], sig) fmt.Println("signature verified:", valid) }

Package-Level Functions (total 7)

func GenerateKey(c elliptic.Curve, rand io.Reader) (*PrivateKey, error) GenerateKey generates a new ECDSA private key for the specified curve. Most applications should use [crypto/rand.Reader] as rand. Note that the returned key does not depend deterministically on the bytes read from rand, and may change between calls and/or between versions.

func ParseRawPrivateKey(curve elliptic.Curve, data []byte) (*PrivateKey, error) ParseRawPrivateKey parses a private key encoded as a fixed-length big-endian integer, according to SEC 1, Version 2.0, Section 2.3.6 (sometimes referred to as the raw format). It returns an error if the value is not reduced modulo the curve's order, or if it's zero. curve must be one of [elliptic.P224], [elliptic.P256], [elliptic.P384], or [elliptic.P521], or ParseRawPrivateKey returns an error. ParseRawPrivateKey accepts the same format as [ecdh.Curve.NewPrivateKey] does for NIST curves, but returns a [PrivateKey] instead of an [ecdh.PrivateKey]. Note that private keys are more commonly encoded in ASN.1 or PKCS#8 format, which can be parsed with [x509.ParseECPrivateKey] or [x509.ParsePKCS8PrivateKey] (and [encoding/pem]).

func ParseUncompressedPublicKey(curve elliptic.Curve, data []byte) (*PublicKey, error) ParseUncompressedPublicKey parses a public key encoded as an uncompressed point according to SEC 1, Version 2.0, Section 2.3.3 (also known as the X9.62 uncompressed format). It returns an error if the point is not in uncompressed form, is not on the curve, or is the point at infinity. curve must be one of [elliptic.P224], [elliptic.P256], [elliptic.P384], or [elliptic.P521], or ParseUncompressedPublicKey returns an error. ParseUncompressedPublicKey accepts the same format as [ecdh.Curve.NewPublicKey] does for NIST curves, but returns a [PublicKey] instead of an [ecdh.PublicKey]. Note that public keys are more commonly encoded in DER (or PEM) format, which can be parsed with [x509.ParsePKIXPublicKey] (and [encoding/pem]).

func Sign(rand io.Reader, priv *PrivateKey, hash []byte) (r, s *big.Int, err error) Sign signs a hash (which should be the result of hashing a larger message) using the private key, priv. If the hash is longer than the bit-length of the private key's curve order, the hash will be truncated to that length. It returns the signature as a pair of integers. Most applications should use [SignASN1] instead of dealing directly with r, s.

func SignASN1(rand io.Reader, priv *PrivateKey, hash []byte) ([]byte, error) SignASN1 signs a hash (which should be the result of hashing a larger message) using the private key, priv. If the hash is longer than the bit-length of the private key's curve order, the hash will be truncated to that length. It returns the ASN.1 encoded signature. The signature is randomized. Most applications should use [crypto/rand.Reader] as rand. Note that the returned signature does not depend deterministically on the bytes read from rand, and may change between calls and/or between versions.

func Verify(pub *PublicKey, hash []byte, r, s *big.Int) bool Verify verifies the signature in r, s of hash using the public key, pub. Its return value records whether the signature is valid. Most applications should use VerifyASN1 instead of dealing directly with r, s. The inputs are not considered confidential, and may leak through timing side channels, or if an attacker has control of part of the inputs.

func VerifyASN1(pub *PublicKey, hash, sig []byte) bool VerifyASN1 verifies the ASN.1 encoded signature, sig, of hash using the public key, pub. Its return value records whether the signature is valid. The inputs are not considered confidential, and may leak through timing side channels, or if an attacker has control of part of the inputs.