How to convert an ECDSA signature between DER and raw in Go

1package main
2 
3import (
4	"encoding/asn1"
5	"fmt"
6	"math/big"
7)
8 
9type dsaSignature struct {
10	R, S *big.Int
11}
12 
13const size = 32 // 32 for P-256, 48 for P-384, 66 for P-521
14 
15func derToRaw(der []byte) ([]byte, error) {
16	var sig dsaSignature
17	rest, err := asn1.Unmarshal(der, &sig)
18	if err != nil {
19		return nil, err
20	}
21	if len(rest) != 0 {
22		return nil, fmt.Errorf("%d trailing bytes after signature", len(rest))
23	}
24	raw := make([]byte, 2*size)
25	sig.R.FillBytes(raw[:size]) // FillBytes left-pads with zeros
26	sig.S.FillBytes(raw[size:])
27	return raw, nil
28}
29 
30func rawToDer(raw []byte) ([]byte, error) {
31	half := len(raw) / 2
32	return asn1.Marshal(dsaSignature{
33		R: new(big.Int).SetBytes(raw[:half]),
34		S: new(big.Int).SetBytes(raw[half:]),
35	})
36}

How it works

1. asn1.Unmarshal maps the DER SEQUENCE { INTEGER, INTEGER } straight onto a struct of two *big.Int fields — field order is what binds R and S.
2. Check the rest return value: bytes after the SEQUENCE mean the input was not just a signature (or was concatenated with something).
3. FillBytes writes the integer right-aligned into a zero-filled slice — the safe way to get fixed-width output.

Gotchas

• Bytes() instead of FillBytes drops leading zeros and shifts the layout roughly 1 time in 256 — always use FillBytes for raw signature output.
• size is per-curve. Hard-coding 32 while handling P-384 signatures truncates integers via FillBytes panicking — treat the panic as the safety net it is, not as a crash to suppress.
• For verification you rarely need this file at all: ecdsa.VerifyASN1 takes DER directly, and ecdsa.Verify takes the big.Ints — convert only at true format boundaries (JWS, WebCrypto, hardware).

Related recipes

• How to verify an ECDSA signature in Go
• How to sign a message with ECDSA in Go
• How to verify an ES256 JWT in Go