How to verify an ECDSA signature in Rust

1[dependencies]
2p256 = { version = "=0.14.0", features = ["ecdsa", "pem"] }
3 

1use p256::ecdsa::{Signature, VerifyingKey, signature::Verifier};
2use p256::pkcs8::DecodePublicKey;
3 
4fn main() -> Result<(), Box<dyn std::error::Error>> {
5    // "BEGIN PUBLIC KEY" (SPKI); a key on any other curve is rejected right here
6    let public_key = VerifyingKey::from_public_key_pem(&std::fs::read_to_string("pub.pem")?)?;
7    let message = std::fs::read("message.txt")?;
8 
9    // ASN.1 DER, as OpenSSL, Java and Go produce it; malformed bytes fail to parse
10    let signature = Signature::from_der(&std::fs::read("sig.der")?)?;
11 
12    // verify() hashes the message with SHA-256 itself
13    match public_key.verify(&message, &signature) {
14        Ok(()) => println!("valid"),
15        Err(_) => println!("INVALID"),
16    }
17    Ok(())
18}
19 

1// r‖s from a JWS or WebCrypto: exactly 64 bytes on P-256, no DER framing
2let raw = Signature::from_slice(&std::fs::read("sig.raw")?)?;
3println!("{}", if public_key.verify(&message, &raw).is_ok() { "valid" } else { "INVALID" });
4 

How it works

1. VerifyingKey::from_public_key_pem comes from the DecodePublicKey trait and reads SPKI (BEGIN PUBLIC KEY). The type is curve-specific: a P-384 key fails to load as p256::ecdsa::VerifyingKey.
2. Signature::from_der parses strict ASN.1 DER and checks that r and s are valid scalars; Signature::from_slice takes exactly 64 bytes of r‖s.
3. verify from the Verifier trait hashes the message with SHA-256 — the hash bound to P-256 in this crate — and returns Ok(()) or an opaque signature::Error.
4. Both encodings parse into the same Signature value, so one verify call serves both; the run checks DER, raw, and a message with one changed byte.

Gotchas

• Errors are deliberately opaque: a malformed signature, a 70-byte buffer passed to from_slice and a wrong signature all display as signature error. Log which step failed (parse or verify) yourself.
• p256 accepts high-S signatures, but k256 (secp256k1) rejects them in verify, following Bitcoin's rule. A signature that verifies with p256 code can fail with k256 code purely because of s — call normalize_s() on the signer side.
• With ring (the crypto behind rustls), UnparsedPublicKey expects the bare 65-byte SEC1 point, not SPKI: passing the 91-byte SPKI DER fails with Unspecified. Pick ECDSA_P256_SHA256_ASN1 for DER and ECDSA_P256_SHA256_FIXED for r‖s.
• Loading a BEGIN CERTIFICATE file with from_public_key_pem fails: parse the certificate (for example with x509-parser) and take its SubjectPublicKeyInfo.

Related recipes

• How to sign a message with ECDSA in Rust
• How to convert an ECDSA signature between DER and raw in Rust
• How to verify an ES256 JWT in Rust
• How to verify an ECDSA signature in Go
• How to verify an ECDSA signature in Swift