How to convert an ECDSA signature between DER and raw in WebCrypto

1function derToRaw(der, size = 32) { // size: 32 P-256, 48 P-384, 66 P-521
2  if (der[0] !== 0x30) throw new Error("not a DER SEQUENCE");
3  let o = der[1] & 0x80 ? 2 + (der[1] & 0x7f) : 2; // skip long-form length
4  const readInt = () => {
5    if (der[o++] !== 0x02) throw new Error("expected INTEGER");
6    const len = der[o++];
7    let v = der.subarray(o, o + len);
8    o += len;
9    while (v.length > size && v[0] === 0x00) v = v.subarray(1);
10    const out = new Uint8Array(size);
11    out.set(v, size - v.length); // left-pad to fixed width
12    return out;
13  };
14  const raw = new Uint8Array(2 * size);
15  raw.set(readInt(), 0);
16  raw.set(readInt(), size);
17  return raw;
18}

1const rawSig = derToRaw(derSignature); // derSignature: Uint8Array
2 
3const ok = await crypto.subtle.verify(
4  { name: "ECDSA", hash: "SHA-256" },
5  publicKey,
6  rawSig,
7  new TextEncoder().encode(message),
8);

How it works

1. DER wraps r and s in SEQUENCE/INTEGER framing with minimal-length rules; raw format is just both integers at fixed width, concatenated.
2. The function strips the sign-padding 0x00 bytes DER adds and left-pads each value to size — the two operations that differ between the formats.
3. Work on Uint8Array: if the signature arrived as an ArrayBuffer (e.g. from fetch), wrap it first — new Uint8Array(buffer).

Gotchas

• Skipping conversion and passing DER to subtle.verify does not throw — it resolves to false, indistinguishable from a bad signature. Length is your tell: DER is ~70–72 bytes on P-256, raw is exactly 64.
• Both halves need the padding treatment: a conversion that handles r but slices s naively still fails on the subset of signatures where s has a padding byte.
• The reverse direction (raw → DER, for sending WebCrypto signatures to OpenSSL) must strip zeros and re-add 0x00 when the top bit is set — see the Node.js recipe for a tested rawToDer.

Related recipes

• How to verify an ECDSA signature in WebCrypto
• How to convert an ECDSA signature between DER and raw in Node.js
• How to verify an ES256 JWT in WebCrypto