@noble/curves

Facts and the checks behind them

Nothing below is copied from documentation. The check content/libraries/verify/noble-curves/run.sh ran @noble/curves 2.4.0 in the container image node:24.22.0-bookworm-slim on October 20, 2026; the page must match what it printed, and each fact lists those lines.

• ECDSA signature encoding

  raw

  sign() returns 64 bytes of compact r‖s; format: "der" returns ASN.1 DER instead, and verify() needs the same option to read it.

  Recorded by the check

  fact ecdsa-signature-encoding = raw
  evidence ecdsa-signature-encoding: default 64 bytes; format "der" gives 71 bytes that parse as DER: true

• Low-S when signing

  low-s

  No high-S value appeared in 64 signatures on any of the seven Weierstrass curves: s is always normalized.

  Recorded by the check

  fact ecdsa-low-s-sign = low-s
  evidence ecdsa-low-s-sign: no high-S in 64 signatures on any of the seven curves

• High-S when verifying

  rejects-high-s

  With default options, every high-S signature made by node:crypto was rejected and every low-S one accepted; with lowS: false all 64 verified.

  Recorded by the check

  fact ecdsa-low-s-verify = rejects-high-s
  evidence ecdsa-low-s-verify: 64 node:crypto signatures: every high-S one rejected: true; every low-S one accepted: true; all 64 accepted with lowS false: true

• ECDSA nonce

  rfc6979

  RFC 6979: the P-256 test vector from appendix A.2.5 reproduced exactly, with s replaced by n − s. extraEntropy: true mixes in randomness (hedged signatures).

  Recorded by the check

  fact ecdsa-nonce = rfc6979
  evidence ecdsa-nonce: r matches RFC 6979 A.2.5: true; s equals n - s(RFC): true; extraEntropy true changes the bytes: true

• What the signing call hashes

  hashes-message

  2.x hashes the message with the curve's hash (SHA-256 for P-256); prehash: false signs and verifies a digest you computed.

  Recorded by the check

  fact ecdsa-prehash = hashes-message

• Signing input in version 1

  digest

  In 1.9.7, sign() treated its input as the digest: only sign(sha256(m)) reproduced the RFC 6979 vector. Upgrading from 1.x without changing call sites double-hashes.

  Recorded by the check

  fact v1-sign-input = digest
  evidence v1-sign-input: 1.x sign(sha256(m)) gives the RFC 6979 r: true; 1.x sign(m) does: false

• P-256 low-S in version 1

  either

  1.9.7 returned the RFC's high-S value unchanged for P-256; normalization on every curve is new in 2.x.

  Recorded by the check

  fact v1-p256-low-s-sign = either
  evidence v1-p256-low-s-sign: 1.x P-256 returned the RFC's high s unchanged: true

• Malformed ECDSA signature

  throws

  A signature of the wrong length — DER bytes without format: "der", or a 3-byte blob — throws expected Uint8Array of length 64; a well-formed but wrong signature returns false.

  Recorded by the check

  fact ecdsa-malformed-signature = throws
  evidence ecdsa-malformed-signature: DER without format: throws expected Uint8Array of length 64, got length=71
  evidence ecdsa-malformed-signature: 3 bytes: throws expected Uint8Array of length 64, got length=3
  evidence ecdsa-malformed-signature: 64 zero bytes: false

• ECDSA curves

  P-256P-384P-521secp256k1brainpoolP256r1brainpoolP384r1brainpoolP512r1

  P-256, P-384 and P-521 from nist.js, secp256k1 from secp256k1.js, and the Brainpool r1 curves from misc.js.

  Recorded by the check

  fact ecdsa-curves = P-256, P-384, P-521, secp256k1, brainpoolP256r1, brainpoolP384r1, brainpoolP512r1

• EdDSA

  Ed25519Ed25519phEd25519ctxEd448Ed448ph

  Ed25519 with its ph and ctx variants, Ed448 and Ed448ph all signed and verified.

  Recorded by the check

  fact eddsa = Ed25519, Ed25519ph, Ed25519ctx, Ed448, Ed448ph

• Post-quantum algorithms

  none

  No post-quantum algorithms in this package.

  Recorded by the check

  fact pqc = none
  evidence pqc: exports of the package mention ML-DSA or ML-KEM: false

• Public key formats

  sec1-uncompressedsec1-compressed

  Public keys are SEC1 points, compressed or uncompressed; a 64-byte x‖y and SPKI DER were rejected.

  Recorded by the check

  fact public-key-formats = sec1-uncompressed, sec1-compressed

• Default public key format

  sec1-compressed

  getPublicKey() returns the 33-byte compressed point unless you pass false for the uncompressed form.

  Recorded by the check

  fact default-public-key = sec1-compressed

• Private key formats

  raw-scalar

  Secret keys are the raw 32-byte scalar; PKCS#8 DER was rejected.

  Recorded by the check

  fact private-key-formats = raw-scalar

• Schnorr signatures

  BIP-340

  schnorr in secp256k1.js implements BIP-340: 64-byte signatures over x-only public keys.

  Recorded by the check

  fact schnorr = BIP-340

Usage

import { generateKeyPairSync, sign } from "node:crypto";
import { p256 } from "@noble/curves/nist.js";

// A signature made elsewhere: node:crypto (OpenSSL) emits DER, with s in either half.
const { privateKey, publicKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
const message = new TextEncoder().encode("order #1042 approved");
const der = sign("sha256", message, privateKey);
const jwk = publicKey.export({ format: "jwk" });
const point = Uint8Array.from([4, ...Buffer.from(jwk.x, "base64url"), ...Buffer.from(jwk.y, "base64url")]);

// noble 2.x hashes the message itself and rejects high-S unless told otherwise.
console.log("verified:", p256.verify(der, message, point, { format: "der", lowS: false }));

// Its own signatures are compact r||s, RFC 6979 and low-S: the same bytes every time.
const secretKey = p256.utils.randomSecretKey();
const first = p256.sign(message, secretKey);
const second = p256.sign(message, secretKey);
console.log("deterministic:", Buffer.from(first).equals(Buffer.from(second)), first.length);