Raw r‖s signature format (IEEE P1363)

The fixed-length encoding of an ECDSA or DSA signature as r and s concatenated, each left-padded to the byte length of the group order, used by JOSE, COSE, WebCrypto and many HSM APIs.

Also written asIEEE P1363raw ECDSA signaturer||sconcatenated signature

Named after IEEE Std 1363-2000. Lengths are fixed: 64 bytes for P-256 and secp256k1, 96 for P-384, 132 for P-521. The alternative is DER: a SEQUENCE of two minimal big-endian INTEGERs, each with a leading 0x00 when its top bit is set, which gives 70–72 bytes for P-256 and is variable by design.

Raw is used by JWS ES256 and friends (RFC 7518 §3.4), COSE (RFC 9053 §2.1), WebCrypto, PKCS #11 CKM_ECDSA, Windows CNG and Apple CryptoKit. DER is used by X.509 and CMS, TLS CertificateVerify, WebAuthn assertion signatures, OpenSSL, Java's SHA256withECDSA, Go's ecdsa.SignASN1 and Node's crypto.sign(). Switches: Node dsaEncoding: "ieee-p1363", Java SHA256withECDSAinP1363Format, Python encode_dss_signature and decode_dss_signature.

Conversions must pad: r or s is shorter than 32 bytes in about one signature in 128, and keeping DER's sign byte or dropping the padding yields 63- or 65-byte "raw" signatures that fail elsewhere. The DER ⇄ raw converter shows both forms.

Raw r‖s signature format (IEEE P1363)

Standards and references

Tools

Terms

Articles

Recipes

Errors