How to verify an ECDSA signature in Ruby

1require "openssl"
2 
3public_key = OpenSSL::PKey.read(File.read("pub.pem")) # "BEGIN PUBLIC KEY" (SPKI)
4message = File.binread("message.txt")
5signature = File.binread(ARGV.fetch(0, "sig.der")) # ASN.1 DER, as OpenSSL produces it
6 
7begin
8  # verify(digest, signature, data) hashes the data itself
9  puts public_key.verify("SHA256", signature, message) ? "valid" : "INVALID"
10rescue OpenSSL::PKey::PKeyError => e
11  puts "malformed signature (#{e.message})" # bytes that are not DER raise instead of returning false
12end
13 

1# r‖s from a JWS or WebCrypto: wrap both halves as ASN.1 INTEGERs, then verify as DER
2raw = File.binread("sig.raw") # 64 bytes on P-256
3half = raw.bytesize / 2
4r, s = [raw.byteslice(0, half), raw.byteslice(half, half)].map { |bytes| OpenSSL::BN.new(bytes, 2) }
5der = OpenSSL::ASN1::Sequence([OpenSSL::ASN1::Integer(r), OpenSSL::ASN1::Integer(s)]).to_der
6puts public_key.verify("SHA256", der, message) ? "valid" : "INVALID"
7 

How it works

1. OpenSSL::PKey.read detects the PEM type and returns an OpenSSL::PKey::EC for an EC public key; the curve comes from the key.
2. verify("SHA256", signature, data) takes the digest name, the signature and the original data — the order differs from most other languages — and hashes the data itself.
3. It returns true or false for a well-formed signature and raises OpenSSL::PKey::PKeyError when the bytes are not DER at all; the run shows both outcomes.
4. OpenSSL::BN.new(bytes, 2) reads a binary string as a big-endian unsigned integer, and OpenSSL::ASN1::Sequence with two Integers builds the DER encoding, sign bytes included.

Gotchas

• A raw 64-byte signature raises OpenSSL::PKey::PKeyError: EVP_DigestVerify instead of returning false. Rescue it where you verify, or a malformed client signature becomes a 500 error.
• A public key stored in an environment variable usually arrives with literal \n sequences instead of line breaks, and OpenSSL::PKey.read then fails with Could not parse PKey. Restore the newlines (gsub("\\n", "\n")) before reading.
• verify with the wrong digest name returns false like a forgery: a SHA-384 signature checked with "SHA256" fails without any hint.
• secp256k1 keys work through the system OpenSSL, but OpenSSL accepts high-S signatures; Bitcoin-style rules that require low-S must be checked separately.

Related recipes

• How to sign a message with ECDSA in Ruby
• How to convert an ECDSA signature between DER and raw in Ruby
• How to verify an ES256 JWT in Ruby
• How to verify an ECDSA signature in Python
• How to verify an ECDSA signature in PHP