To verify an ECDSA signature in Java you need nothing but the JDK: KeyFactory loads the public key and java.security.Signature checks the signature. The one decision that matters is the algorithm name — SHA256withECDSA reads ASN.1 DER signatures, while SHA256withECDSAinP1363Format reads the raw r‖s form that JWS and WebCrypto produce.

Verify.java — verify a DER signature (what OpenSSL and the JDK itself produce)

1import java.nio.file.Files;
2import java.nio.file.Path;
3import java.security.KeyFactory;
4import java.security.PublicKey;
5import java.security.Signature;
6import java.security.spec.X509EncodedKeySpec;
7import java.util.Base64;
8 
9public class Verify {
10  public static void main(String[] args) throws Exception {
11    // "BEGIN PUBLIC KEY" is SPKI: drop the armor lines, decode the base64 body
12    String pem = Files.readString(Path.of("pub.pem"));
13    byte[] spki = Base64.getMimeDecoder().decode(pem.replaceAll("-----[^-]+-----", ""));
14    PublicKey publicKey = KeyFactory.getInstance("EC").generatePublic(new X509EncodedKeySpec(spki));
15 
16    byte[] message = Files.readAllBytes(Path.of("message.txt"));
17    byte[] signature = Files.readAllBytes(Path.of("sig.der")); // ASN.1 DER, at most 72 bytes on P-256
18 
19    Signature verifier = Signature.getInstance("SHA256withECDSA");
20    verifier.initVerify(publicKey);
21    verifier.update(message); // the message itself: the JDK hashes it
22    System.out.println(verifier.verify(signature) ? "valid" : "INVALID");
23  }
24}
25

raw r‖s signatures: same key and message, P1363 algorithm name

1// r‖s from a JWS or WebCrypto: exactly 64 bytes on P-256, no DER framing
2byte[] raw = Files.readAllBytes(Path.of("sig.raw"));
3 
4Signature p1363 = Signature.getInstance("SHA256withECDSAinP1363Format");
5p1363.initVerify(publicKey);
6p1363.update(message);
7System.out.println(p1363.verify(raw) ? "valid" : "INVALID");
8

How it works

X509EncodedKeySpec is the JDK's name for SPKI, the body of a BEGIN PUBLIC KEY block. The MIME decoder skips line breaks, so only the armor lines need removing.
KeyFactory.getInstance("EC") takes the curve from the key itself — nothing in the code says P-256.
SHA256withECDSA fixes both the hash and the signature encoding (DER). Pass the original message to update; the JDK computes the SHA-256 digest itself.
SHA256withECDSAinP1363Format (JDK 9 and later) reads the fixed-length r‖s form directly, so a JWS or WebCrypto signature needs no conversion.

Gotchas

A raw 64-byte signature passed to SHA256withECDSA throws SignatureException: Invalid encoding for signature instead of returning false. The opposite mistake is silent: a DER signature given to the P1363 algorithm simply verifies as false.
verify returns false for a wrong signature but throws on malformed input, so treat SignatureException as "invalid" in request handlers rather than letting it surface as a server error.
secp256k1 was removed from the JDK's SunEC provider in JDK 16 (Curve not supported: secp256k1). Verifying Bitcoin or Ethereum keys needs Bouncy Castle registered as a provider.
A BEGIN CERTIFICATE file is not an SPKI and fails in X509EncodedKeySpec. Load it with CertificateFactory and call getPublicKey() instead.

How to verify an ECDSA signature in Java

How it works

Gotchas

Related recipes