Reference
Libraries
59 libraries and command-line tools, with the behaviour that breaks interoperability — signature encodings, nonces, low-S, curves, key formats, JWT defaults — recorded by running each one, not copied from its documentation.
59 of 59 shown
By language
Node.js
- @noble/curvesPaul Miller's audited, dependency-free elliptic-curve library for JavaScript: ECDSA on NIST, secp256k1 and Brainpool curves, EdDSA, Schnorr and more — deterministic, low-S and message-hashing by default since version 2.Node.jsWebCryptoECDSAEdDSAChecked: 2.4.0 · October 20, 2026
- ellipticFedor Indutny's elliptic, the pure-JavaScript ECDSA and EdDSA library behind a decade of browser bundles and wallets — deterministic but not low-S by default, digest-only input, and an open advisory about wrong nonces on P-521.Node.jsECDSAEdDSAChecked: 6.6.1 · October 20, 2026
- ethers.jsethers.js v6, the long-standing JavaScript library for Ethereum wallets and contracts: 65-byte r‖s‖v signatures with v = 27/28, EIP-191 message hashing, RFC 6979 nonces and a hard refusal of high-S signatures.Node.jsWebCryptoECDSAEthereum and BitcoinChecked: 6.17.0 · October 20, 2026
- jose (panva)Filip Skokan's jose: a dependency-free JOSE implementation (JWS, JWE, JWK, JWKS, JWT) on top of WebCrypto that runs unchanged in Node.js, browsers, Deno, Bun and edge runtimes, with EdDSA and ML-DSA but no secp256k1.Node.jsWebCryptoJOSE and JWTChecked: 6.2.13 · October 20, 2026
- jsonwebtoken (Node.js)Auth0's jsonwebtoken, the most installed JWT package for Node.js: HMAC, RSA and ECDSA tokens on top of node:crypto, with algorithm checks tied to the key type since version 9 — but no EdDSA.Node.jsJOSE and JWTChecked: 9.0.3 · October 20, 2026
- node-forgeDigital Bazaar's node-forge, a pure-JavaScript TLS, PKI and PKCS toolkit: RSA, PKCS#12, X.509 and Ed25519 — but no ECDSA at all, so it cannot read an elliptic-curve key or certificate.Node.jsEdDSAChecked: 1.4.0 · October 20, 2026
- Node.js node:cryptoNode.js's built-in crypto module: ECDSA, EdDSA, RSA and post-quantum signatures on top of the OpenSSL bundled with each Node.js release — DER signatures, random nonces and no low-S policy by default.Node.jsECDSAEdDSAPost-quantumChecked: 24.22.0 · October 20, 2026
- SimpleWebAuthnMatthew Miller's SimpleWebAuthn, the most widely used passkey library for TypeScript: option generators and response verifiers that require user verification by default, accept only DER assertion signatures and refuse counter regressions.Node.jsWebCryptoWebAuthnChecked: 14.0.3 · October 20, 2026
- viemwevm's viem, the TypeScript interface to Ethereum used by wagmi: 65-byte r‖s‖v signatures with v = 27/28, EIP-191 hashing and RFC 6979 — but, unlike ethers, it recovers high-S signatures and does not read EIP-2098 compact ones.Node.jsWebCryptoECDSAEthereum and BitcoinChecked: 2.57.7 · October 20, 2026
WebCrypto
Python
- Authlib (authlib.jose)Authlib's JOSE module, the token layer under Authlib's OAuth and OpenID Connect clients and servers: deprecated in 1.9 in favour of joserfc, it decodes without validating claims and allows alg: none once you list it.PythonJOSE and JWTChecked: 1.9.1 · October 20, 2026
- coincurveOfek Lev's coincurve, Python bindings to Bitcoin Core's libsecp256k1: DER signatures over SHA-256 by default, RFC 6979, strict low-S on both sides, recoverable and BIP-340 Schnorr signatures.PythonECDSAChecked: 21.0.0 · October 20, 2026
- JWCryptoRed Hat's JWCrypto, the JOSE implementation used by FreeIPA and many enterprise Python services: full JWS/JWE/JWK coverage including ML-DSA, a 60-second default leeway, and alg: none only on request.PythonJOSE and JWTChecked: 1.6.1 · October 20, 2026
- py_webauthnDuo Labs' py_webauthn, the reference WebAuthn relying-party library for Python: DER-only assertion signatures and strict counters, but user verification is not enforced unless you ask for it.PythonWebAuthnChecked: 3.0.1 · October 20, 2026
- pyca/cryptographyThe Python Cryptographic Authority's cryptography package, the standard crypto library for Python: OpenSSL-backed ECDSA with DER signatures and opt-in RFC 6979, EdDSA, ML-KEM and ML-DSA, and no JWK support.PythonECDSAEdDSAPost-quantumChecked: 50.0.2 · October 20, 2026
- PyJWTJosé Padilla's PyJWT, the most used JWT library for Python: an explicit algorithms list is mandatory, alg: none never verifies, and public keys are refused as HMAC secrets — but expiry is optional and leeway is zero.PythonJOSE and JWTChecked: 2.15.1 · October 20, 2026
- python-ecdsatlsfuzzer's pure-Python ECDSA and EdDSA library: raw r‖s signatures over SHA-1 unless told otherwise, random nonces by default with RFC 6979 one method away, and public keys as bare x‖y.PythonECDSAEdDSAChecked: 0.19.2 · October 20, 2026
- python-josepython-jose, a JOSE library still common in FastAPI tutorials: optional algorithms, no PS or EdDSA support, ES256 tokens signed with P-384 keys, and an open advisory that lets a DER public key act as an HMAC secret.PythonJOSE and JWTChecked: 3.5.0 · October 20, 2026
- web3.py (eth-account)The Ethereum Foundation's web3.py, whose signing is done by eth-account: 65-byte r‖s‖v signatures with v = 27/28, EIP-191 and RFC 6979 — and, like viem but unlike ethers, recovery from high-S signatures.PythonECDSAEthereum and BitcoinChecked: 8.0.0 · October 20, 2026
Go
- Go crypto/ecdsa (standard library)Go's standard-library signature packages — crypto/ecdsa with crypto/x509, ed25519, mlkem and mldsa: DER signatures over a digest you supply, randomized nonces that ignore your Reader, NIST curves only.GoECDSAEdDSAPost-quantumChecked: 1.27.3 · October 20, 2026
- go-ethereum cryptoThe crypto package of go-ethereum (geth): secp256k1 signing over a 32-byte hash with no message prefix, 65-byte signatures with v = 0/1, and a verifier that rejects high-S while recovery accepts it.GoECDSAEthereum and BitcoinChecked: 1.17.8 · October 20, 2026
- go-josego-jose, the Go JOSE implementation used by projects such as Kubernetes, Vault and Dex: algorithm lists are mandatory when parsing since v4, signature checking and claims validation are two separate calls, and leeway defaults to one minute.GoJOSE and JWTChecked: 4.1.6 · October 20, 2026
- go-webauthngo-webauthn, the WebAuthn relying-party library for Go: DER-only assertion signatures, user verification driven by the session, and counter regressions reported as a clone warning instead of a failed login.GoWebAuthnChecked: 0.18.2 · October 20, 2026
- golang-jwt/jwtgolang-jwt/jwt, the community-maintained successor of dgrijalva/jwt-go and the most used JWT package for Go: key-typed verification, none behind an explicit sentinel, and optional expiry unless you ask for it.GoJOSE and JWTChecked: 5.3.1 · October 20, 2026
Java
- Bouncy Castle (Java)The Legion of the Bouncy Castle's Java provider and PKIX toolkit: every curve the JDK dropped, deterministic ECDSA on request, PEM parsing, and the widest set of post-quantum signatures on the JVM.JavaKotlinECDSAEdDSAPost-quantumChecked: 1.86 · October 20, 2026
- Java JCA (SunEC, JDK 25)The Java Cryptography Architecture with the JDK's SunEC provider, as in JDK 25: DER by default with an in-P1363-format variant, random nonces, only the three NIST curves, plus Ed25519, Ed448, ML-KEM and ML-DSA.JavaKotlinECDSAEdDSAPost-quantumChecked: 25.0.4.1 · October 20, 2026
- java-jwt (Auth0)Auth0's java-jwt: a compact JWT library where each verifier is bound to one Algorithm object, JWT.decode() checks nothing, and the algorithm set stops at HS, RS and ES — no PS256 and no EdDSA.JavaKotlinJOSE and JWTChecked: 4.6.2 · October 20, 2026
- JJWT (io.jsonwebtoken)Les Hazlewood's JJWT, a widely used JWT library for Java and Android: the verification key fixes the acceptable algorithm, unsigned tokens need an explicit unsecured() parser, and weak HMAC keys are refused outright.JavaKotlinJOSE and JWTChecked: 0.13.0 · October 20, 2026
- jose4jBrian Campbell's jose4j, the JOSE library behind several Java identity servers: a JwtConsumer that blocks none and refuses mismatched key types by default, but allows any other algorithm for a key unless you constrain it.JavaKotlinJOSE and JWTChecked: 0.9.7 · October 20, 2026
- Nimbus JOSE + JWTConnect2id's Nimbus JOSE + JWT, the JOSE library inside Spring Security and many Java OAuth servers: a processor whose key selector is the algorithm allow-list, unsigned tokens refused, and 60 seconds of default clock skew.JavaKotlinJOSE and JWTChecked: 10.10 · October 20, 2026
- Tink (Java)Google's Tink for Java, a misuse-resistant crypto API built around keysets and templates: default signatures carry a 5-byte Tink prefix no other library understands, and the template names hide which encoding you get.JavaKotlinECDSAEdDSAChecked: 1.24.0 · October 20, 2026
- WebAuthn4JWebAuthn4J, the WebAuthn verification library behind Spring Security's passkey support and Keycloak: no hidden defaults for user verification, DER-only signatures, and a hard failure on counter regressions.JavaKotlinWebAuthnChecked: 0.31.11.RELEASE · October 20, 2026
.NET
- .NET System.Security.Cryptography.NET's System.Security.Cryptography: ECDSA that signs raw r‖s (IEEE P1363) by default, unlike every OpenSSL-based stack, no Ed25519 in the box, and post-quantum classes whose availability depends on the operating system..NETECDSAChecked: 10.0.13 · October 20, 2026
- Bouncy Castle for .NET (BouncyCastle.Cryptography)Bouncy Castle for .NET, the managed crypto library .NET developers add for what the base class library lacks: Ed25519 and Ed448, secp256k1 on every platform, deterministic ECDSA, PGP, PEM, and ML-KEM, ML-DSA and SLH-DSA without depending on the OS..NETECDSAEdDSAPost-quantumChecked: 2.7.0 · October 20, 2026
- Microsoft.IdentityModel (JsonWebTokenHandler)Microsoft.IdentityModel's JsonWebTokenHandler, the JWT validator under ASP.NET Core authentication and Microsoft Entra ID SDKs: five minutes of default clock skew, exp required, and ES256 tokens accepted from P-384 keys..NETJOSE and JWTChecked: 8.23.0 · October 20, 2026
Rust
- aws-lc-rsAWS's aws-lc-rs, a ring-compatible Rust API over the AWS-LC C library: the same FIXED/ASN1 encoding constants as ring, plus P-521, secp256k1, ML-KEM and ML-DSA in the stable API, and an optional FIPS 140-3 build.RustECDSAEdDSAPost-quantumChecked: 1.18.2 · October 20, 2026
- jsonwebtoken (Rust)Vincent Prouillet's jsonwebtoken crate, the most used JWT library for Rust: a closed Algorithm enum with no none, required exp, 60 seconds of default leeway, and — since version 10 — a crypto backend you must choose.RustJOSE and JWTChecked: 11.1.0 · October 20, 2026
- ringBrian Smith's ring, the Rust crypto library under rustls and many web servers: a deliberately small API where the algorithm constant fixes the signature encoding, private keys are PKCS#8 only, and the curves are P-256, P-384 and Ed25519.RustECDSAEdDSAChecked: 0.17.14 · October 20, 2026
- RustCrypto ecdsa (p256, p384, k256)RustCrypto's pure-Rust ECDSA: the ecdsa crate with one crate per curve (p256, p384, p521, k256…) — RFC 6979 and raw r‖s by default, but secp256k1 is low-S on both sides while the NIST curves are not.RustECDSAChecked: 0.17.0 · October 20, 2026
PHP
- firebase/php-jwtfirebase/php-jwt, the most installed JWT package for PHP: a Key object that pins the algorithm, short HMAC keys refused, but no ES512 or PS384/512, no issuer or audience checks, and ES256 accepted from P-384 keys.PHPJOSE and JWTChecked: 7.2.1 · October 20, 2026
- lcobucci/jwtLuís Cobucci's lcobucci/jwt, the JWT library behind Laravel Passport and many PHP frameworks: every check is an explicit constraint, assert() refuses to run without one, and key lengths are enforced — but there is no RSA-PSS.PHPJOSE and JWTChecked: 5.6.1 · October 20, 2026
- PHP openssl extensionPHP's bundled openssl extension: DER ECDSA signatures over the curves of the linked OpenSSL, Ed25519 and Ed448 key types, and an openssl_verify() that returns -1 — a truthy value — for malformed input.PHPECDSAEdDSAChecked: 8.5.11 · October 20, 2026
- web-token (JWT Framework)Florent Morselli's JWT Framework (web-token), the complete JOSE implementation for PHP and Symfony: an AlgorithmManager that is the allow-list, separate claim checkers, every RFC 7518 signature algorithm plus EdDSA — but no ES256K.PHPJOSE and JWTChecked: 4.2.3 · October 20, 2026
Ruby
- Ruby OpenSSL (openssl gem)Ruby's openssl gem, the binding every Ruby crypto and JWT library sits on: DER signatures, exceptions instead of false for malformed input, immutable keys on OpenSSL 3, and ML-DSA through the generic PKey API.RubyECDSAEdDSAPost-quantumChecked: 4.0.2 · October 20, 2026
- ruby-jwt (jwt gem)ruby-jwt, the jwt gem used by most Ruby and Rails applications: an explicit algorithm is required, key types are checked, ES256K is included — but EdDSA moved to a separate gem in 3.x and short HMAC secrets are accepted silently.RubyJOSE and JWTChecked: 3.3.0 · October 20, 2026
Swift
- Apple CryptoKitApple CryptoKit, the Swift crypto framework built into iOS and macOS: ECDSA signatures that are both raw and DER, Ed25519 signatures that are randomized, ML-KEM, ML-DSA and X-Wing since the 26 releases, and Secure Enclave keys that the API exposes only as opaque handles.SwiftECDSAEdDSAPost-quantumChecked: macOS 27.0.1 · October 20, 2026
- swift-cryptoswift-crypto, Apple's open-source CryptoKit API for Linux and other platforms without CryptoKit: the same Swift types on a vendored BoringSSL — with deterministic Ed25519 where CryptoKit on macOS randomizes it, and no Secure Enclave.SwiftECDSAEdDSAPost-quantumChecked: 5.0.3 · October 20, 2026
C
- BoringSSLGoogle's BoringSSL, the OpenSSL fork used in Chrome and Android: DER ECDSA on the NIST curves only, Ed25519, and ML-KEM, ML-DSA and SLH-DSA with dedicated APIs — with no releases and no stability promise.CC++ECDSAEdDSAPost-quantumChecked: 2026-10-19-b50cad27ee80 · October 20, 2026
- GnuTLSGnuTLS, the GNU project's TLS and X.509 library: DER ECDSA on the NIST curves, RFC 6979 through a flag, Ed25519 and Ed448 — and, in the distribution build checked, no secp256k1 and no working post-quantum algorithms.CCommand lineECDSAEdDSAChecked: 3.8.13 · October 20, 2026
- liboqs (Open Quantum Safe)liboqs, the Open Quantum Safe project's C library of post-quantum KEMs and signatures: ML-KEM, ML-DSA and SLH-DSA next to a long list of candidates behind one API — meant, in its authors' words, for research and prototyping.CPost-quantumChecked: 0.16.0 · October 20, 2026
- LibreSSLOpenBSD's LibreSSL, the 2014 fork of OpenSSL used by OpenBSD and macOS's system tools: the same DER ECDSA and key formats, Ed25519 but no Ed448, ML-KEM through its own API, no ML-DSA, and no RFC 6979.CCommand lineECDSAEdDSAPost-quantumChecked: 4.3.1 · October 20, 2026
- libsecp256k1 (Bitcoin Core)Bitcoin Core's libsecp256k1, the reference secp256k1 implementation: opaque signatures serialized as compact or strict DER, RFC 6979 nonces, low-S on both sides, public-key recovery and BIP-340 Schnorr.CECDSAChecked: 0.5.0 · October 20, 2026
- libsodiumFrank Denis's libsodium, the portable fork of NaCl: Ed25519 signatures with strict verification, X25519, authenticated encryption, and ML-KEM-768 plus the X-Wing hybrid KEM — but no ECDSA at all.CEdDSAPost-quantumChecked: 1.0.22 · October 20, 2026
- Mbed TLS (TF-PSA-Crypto)Mbed TLS 4.x, the embedded TLS stack whose cryptography is now the PSA Crypto API: raw r‖s ECDSA signatures, deterministic ECDSA as a separate algorithm, and key policies that fix the algorithm per key.CECDSAPost-quantumChecked: 4.1.1 · October 20, 2026
- NSS (Network Security Services)NSS, Mozilla's crypto and TLS library behind Firefox and Thunderbird: two signing layers that disagree on the ECDSA encoding (DER through cryptohi, raw r‖s through PK11), P-256 to P-521 only, Ed25519 and ML-KEM.CCommand lineECDSAEdDSAPost-quantumChecked: 3.124 · October 20, 2026
- OpenSSLOpenSSL, the C library and command-line tool under most of the internet's TLS and much of its signing: DER signatures, random nonces with RFC 6979 on request, every common curve, and ML-KEM, ML-DSA and SLH-DSA since 3.5.COpenSSLCommand lineECDSAEdDSAPost-quantumChecked: 3.5.9 · October 20, 2026
- wolfSSL (wolfCrypt)wolfSSL's embedded TLS and wolfCrypt library: DER ECDSA over a digest you supply, with a verify call whose return code and verdict are separate — and a feature set that depends entirely on how it was built.CECDSAEdDSAPost-quantumChecked: 5.9.4 · October 20, 2026
Command line
- GnuPG (gpg)GnuPG 2.4, the OpenPGP implementation behind gpg: Ed25519 keys that expire after three years by default, deterministic RFC 6979 ECDSA on NIST, Brainpool and secp256k1 curves, Ed25519 signatures over a digest, and no post-quantum algorithms yet.Command lineECDSAEdDSAChecked: 2.4.9 · October 20, 2026
- OpenSSH (ssh-keygen)OpenSSH 10, the SSH suite whose ssh-keygen also converts keys and signs files and git commits: Ed25519 by default, ML-KEM hybrid key exchange first, DSA gone — and ECDSA signatures in SSH's own mpint encoding.Command lineECDSAEdDSAPost-quantumChecked: 10.3p1 · October 20, 2026
By capability
| Library | ECDSA | EdDSA | Post-quantum | JOSE and JWT | WebAuthn | Ethereum and Bitcoin |
|---|---|---|---|---|---|---|
| .NET System.Security.Cryptography | Supported | |||||
| @noble/curves | Supported | Supported | ||||
| Apple CryptoKit | Supported | Supported | Supported | |||
| Authlib (authlib.jose) | Supported | |||||
| aws-lc-rs | Supported | Supported | Supported | |||
| BoringSSL | Supported | Supported | Supported | |||
| Bouncy Castle (Java) | Supported | Supported | Supported | |||
| Bouncy Castle for .NET (BouncyCastle.Cryptography) | Supported | Supported | Supported | |||
| coincurve | Supported | |||||
| elliptic | Supported | Supported | ||||
| ethers.js | Supported | Supported | ||||
| firebase/php-jwt | Supported | |||||
| GnuPG (gpg) | Supported | Supported | ||||
| GnuTLS | Supported | Supported | ||||
| Go crypto/ecdsa (standard library) | Supported | Supported | Supported | |||
| go-ethereum crypto | Supported | Supported | ||||
| go-jose | Supported | |||||
| go-webauthn | Supported | |||||
| golang-jwt/jwt | Supported | |||||
| Java JCA (SunEC, JDK 25) | Supported | Supported | Supported | |||
| java-jwt (Auth0) | Supported | |||||
| JJWT (io.jsonwebtoken) | Supported | |||||
| jose (panva) | Supported | |||||
| jose4j | Supported | |||||
| jsonwebtoken (Node.js) | Supported | |||||
| jsonwebtoken (Rust) | Supported | |||||
| JWCrypto | Supported | |||||
| lcobucci/jwt | Supported | |||||
| liboqs (Open Quantum Safe) | Supported | |||||
| LibreSSL | Supported | Supported | Supported | |||
| libsecp256k1 (Bitcoin Core) | Supported | |||||
| libsodium | Supported | Supported | ||||
| Mbed TLS (TF-PSA-Crypto) | Supported | Supported | ||||
| Microsoft.IdentityModel (JsonWebTokenHandler) | Supported | |||||
| Nimbus JOSE + JWT | Supported | |||||
| node-forge | Supported | |||||
| Node.js node:crypto | Supported | Supported | Supported | |||
| NSS (Network Security Services) | Supported | Supported | Supported | |||
| OpenSSH (ssh-keygen) | Supported | Supported | Supported | |||
| OpenSSL | Supported | Supported | Supported | |||
| PHP openssl extension | Supported | Supported | ||||
| py_webauthn | Supported | |||||
| pyca/cryptography | Supported | Supported | Supported | |||
| PyJWT | Supported | |||||
| python-ecdsa | Supported | Supported | ||||
| python-jose | Supported | |||||
| ring | Supported | Supported | ||||
| Ruby OpenSSL (openssl gem) | Supported | Supported | Supported | |||
| ruby-jwt (jwt gem) | Supported | |||||
| RustCrypto ecdsa (p256, p384, k256) | Supported | |||||
| SimpleWebAuthn | Supported | |||||
| swift-crypto | Supported | Supported | Supported | |||
| Tink (Java) | Supported | Supported | ||||
| viem | Supported | Supported | ||||
| web-token (JWT Framework) | Supported | |||||
| web3.py (eth-account) | Supported | Supported | ||||
| WebAuthn4J | Supported | |||||
| WebCrypto (crypto.subtle) | Supported | Supported | ||||
| wolfSSL (wolfCrypt) | Supported | Supported | Supported |