EVP_SIGNATURE-ECDSA(7ossl)

📦
version 15.1 · 3 versions
, in freebsd 15.1

💖 EVP_SIGNATURE-ECDSA(7ossl) — the ECDSA signature glow-up 💖

okay bestie, welcome to EVP_SIGNATURE-ECDSA, a page from the OpenSSL manuals (that's the 7ossl bit, section 7, iykyk). this is the whole entire lore on the EVP_PKEY ECDSA signature implementation. it's giving crypto, it's giving ✨, let's go 🫶

✨ NAME ✨

EVP_SIGNATURE-ECDSA — the EVP_PKEY ECDSA signature implementation. that's the whole name. iconic, brief, no notes 👑

🌸 DESCRIPTION 🌸

this page is your cheat sheet for computing ECDSA signatures. that's it, that's the vibe. 💅

if you're here for the EC keys side of things (like the actual keys, not the signing), go read EVP_PKEY-EC(7) — that's where all the key-related info lives. this page is keys-adjacent but not keys-primary, fr fr.

🦋 Algorithm Names 🦋

okay so real talk — in this list, some names are grouped together to signify that they're literally the same algorithm just rockin' multiple names. main character with many aliases energy. 💀

this also includes the OID in canonical decimal form, which means — wait for it — they're possible to fetch if the caller has a mere OID that came out in this form after a call to OBJ_obj2txt(3). slay, that's a whole pipeline. ✨

⚠️ it can't be used with EVP_PKEY_sign_message_init(3). like, it's just not that girl for that call. big no. 🙈

now the full roster, each line being one algorithm with all its names (and yes, the OID is in there too):

  • "ECDSA-SHA1", "ECDSA-SHA-1", "ecdsa-with-SHA1", "1.2.840.10045.4.1"
  • "ECDSA-SHA2-224", "ECDSA-SHA224", "ecdsa-with-SHA224", "1.2.840.10045.4.3.1"
  • "ECDSA-SHA2-256", "ECDSA-SHA256", "ecdsa-with-SHA256", "1.2.840.10045.4.3.2"
  • "ECDSA-SHA2-384", "ECDSA-SHA384", "ecdsa-with-SHA384", "1.2.840.10045.4.3.3"
  • "ECDSA-SHA2-512", "ECDSA-SHA512", "ecdsa-with-SHA512", "1.2.840.10045.4.3.4"
  • "ECDSA-SHA3-224", "ecdsa_with_SHA3-224", "id-ecdsa-with-sha3-224", "2.16.840.1.101.3.4.3.9"
  • "ECDSA-SHA3-256", "ecdsa_with_SHA3-256", "id-ecdsa-with-sha3-256", "2.16.840.1.101.3.4.3.10"
  • "ECDSA-SHA3-384", "ecdsa_with_SHA3-384", "id-ecdsa-with-sha3-384", "2.16.840.1.101.3.4.3.11"
  • "ECDSA-SHA3-512", "ecdsa_with_SHA3-512", "id-ecdsa-with-sha3-512", "2.16.840.1.101.3.4.3.12"

so what are these? they're ECDSA signature schemes with diverse message digest algorithms 🎀 and they're all supported explicitly fetched with EVP_PKEY_sign_init_ex2(3) and EVP_PKEY_sign_message_init(3). all of them. every single one. periodt. 💅

🎀 ECDSA Signature Parameters 🎀

okay so these next params? you set them with EVP_PKEY_CTX_set_params(). and the timing matters bestie — this may be called after EVP_PKEY_sign_init() or EVP_PKEY_verify_init(), and before calling EVP_PKEY_sign() or EVP_PKEY_verify(). it's giving step-2-of-3. don't skip steps. 🧚

  • "digest" (OSSL_SIGNATURE_PARAM_DIGEST) <UTF8 string>
  • "properties" (OSSL_SIGNATURE_PARAM_PROPERTIES) <UTF8 string>

these two are not supported with the ECDSA signature schemes that already include a message digest algorithm — peep "Algorithm Names" above. like, the SHA is already in the name, she doesn't need another one. 🫶

  • "nonce-type" (OSSL_SIGNATURE_PARAM_NONCE_TYPE) <unsigned integer>
  • "key-check" (OSSL_SIGNATURE_PARAM_FIPS_KEY_CHECK) <integer>
  • "digest-check" (OSSL_SIGNATURE_PARAM_FIPS_DIGEST_CHECK) <integer>

these parameters are described in provider-signature(7). go read that one, it's the lore drop. 📖

and now the ones you can retrieve with EVP_PKEY_CTX_get_params() — yes, there's a whole getter side, she has range:

  • "algorithm-id" (OSSL_SIGNATURE_PARAM_ALGORITHM_ID) <octet string>
  • "digest" (OSSL_SIGNATURE_PARAM_DIGEST) <UTF8 string>
  • "nonce-type" (OSSL_SIGNATURE_PARAM_NONCE_TYPE) <unsigned integer>
  • "fips-indicator" (OSSL_SIGNATURE_PARAM_FIPS_APPROVED_INDICATOR) <integer>
  • "verify-message" (OSSL_SIGNATURE_PARAM_FIPS_VERIFY_MESSAGE <integer>
🙈 and yes, that last one's missing its closing paren in the source — that's the original's typo, not mine, i'm just the messenger 💀

the parameters are described in provider-signature(7). again. because that's where they live. 💜

🦋 SEE ALSO 🦋

go touch some related pages, bestie, they all ate:

Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

mwah 💋 that's the page — this was OpenSSL 3.5.6, dated 2026-04-07, and you just read EVP_SIGNATURE-ECDSA(7ossl) front to back. ur literally a crypto girlie now. no cap. 🎀✨🔥

📦 where this page comes from