EVP_SIGNATURE-ECDSA(7ossl)

📦
version 3.5.9 · 8 versions
, in alpine 3.23, alpine 3.24

💜 EVP_SIGNATURE-ECDSA — the ECDSA glow-up for EVP_PKEY

ok so bestie, welcome to EVP_SIGNATURE-ECDSA(7ossl) — the manual page that explains the ECDSA signature implementation sitting inside EVP_PKEY. It's giving ✨crypto✨ but make it readable.

🌸 NAME 🌸

EVP_SIGNATURE-ECDSA — literally the EVP_PKEY ECDSA signature implementation. That's the whole vibe.

🦋 DESCRIPTION 🦋

So, this page is all about support for computing ECDSA signatures. And if you're curious about EC keys themselves (like, the actual key side of things), go peek at EVP_PKEY-EC(7) — that's where all the key-related tea lives. 💅

🔥 Algorithm Names 🔥

Okay so in this list, the names are grouped together to signify that they're the same algorithm having multiple names. And yes — that also includes the OID in canonical decimal form. Which means (and this is the useful bit) they're possible to fetch if the caller has a mere OID that came out in this form after a call to OBJ_obj2txt(3). Slay. 🎀

🚨 heads up: it can't be used with EVP_PKEY_sign_message_init(3). Not a vibe. 😭
  • "ECDSA-SHA1", "ECDSA-SHA-1", "ecdsa-with-SHA1", "1.2.840.10045.4.1"
  • "ECDSA-SHA2-224", "ECDSA-SHA224", "ecdsa-with-SHA224", "1.2.840.10045.4.3.1"
  • "ECDSA-SHA2-256", "ECDSA-SHA256", "ecdsa-with-SHA256", "1.2.840.10045.4.3.2"
  • "ECDSA-SHA2-384", "ECDSA-SHA384", "ecdsa-with-SHA384", "1.2.840.10045.4.3.3"
  • "ECDSA-SHA2-512", "ECDSA-SHA512", "ecdsa-with-SHA512", "1.2.840.10045.4.3.4"
  • "ECDSA-SHA3-224", "ecdsa_with_SHA3-224", "id-ecdsa-with-sha3-224", "2.16.840.1.101.3.4.3.9"
  • "ECDSA-SHA3-256", "ecdsa_with_SHA3-256", "id-ecdsa-with-sha3-256", "2.16.840.1.101.3.4.3.10"
  • "ECDSA-SHA3-384", "ecdsa_with_SHA3-384", "id-ecdsa-with-sha3-384", "2.16.840.1.101.3.4.3.11"
  • "ECDSA-SHA3-512", "ecdsa_with_SHA3-512", "id-ecdsa-with-sha3-512", "2.16.840.1.101.3.4.3.12"

Those last ones are ECDSA signature schemes with diverse message digest algorithms. They're all supported explicitly fetched with EVP_PKEY_sign_init_ex2(3) and EVP_PKEY_sign_message_init(3). Periodt. 💅✨

🎀 ECDSA Signature Parameters 🎀

The following signature parameters can be set using EVP_PKEY_CTX_set_params(). And when can you call that, bestie? It may be called after EVP_PKEY_sign_init() or EVP_PKEY_verify_init(), and before calling EVP_PKEY_sign() or EVP_PKEY_verify(). Timing is everything. ⏰

  • "digest" (OSSL_SIGNATURE_PARAM_DIGEST) <UTF8 string>
  • "properties" (OSSL_SIGNATURE_PARAM_PROPERTIES) <UTF8 string>
🙈 okay so these two are not supported with the ECDSA signature schemes that already include a message digest algorithm. Go check "Algorithm Names" above — iykyk.
  • "nonce-type" (OSSL_SIGNATURE_PARAM_NONCE_TYPE) <unsigned integer>
  • "key-check" (OSSL_SIGNATURE_PARAM_FIPS_KEY_CHECK) <integer>
  • "digest-check" (OSSL_SIGNATURE_PARAM_FIPS_DIGEST_CHECK) <integer>

These parameters are described in provider-signature(7) — that's the lore drop, go read it. 📖

The following signature parameters can be retrieved using EVP_PKEY_CTX_get_params():

  • "algorithm-id" (OSSL_SIGNATURE_PARAM_ALGORITHM_ID) <octet string>
  • "digest" (OSSL_SIGNATURE_PARAM_DIGEST) <UTF8 string>
  • "nonce-type" (OSSL_SIGNATURE_PARAM_NONCE_TYPE) <unsigned integer>
  • "fips-indicator" (OSSL_SIGNATURE_PARAM_FIPS_APPROVED_INDICATOR) <integer>
  • "verify-message" (OSSL_SIGNATURE_PARAM_FIPS_VERIFY_MESSAGE) <integer>

And yeah, the parameters are described in provider-signature(7) too. Same source, iconic consistency. ⭐

🌈 SEE ALSO 🌈

The whole squad, fr fr:

Copyright 2020-2026 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page, bestie — you ate that 🫶 this was OpenSSL 3.5.9, dated 2026-09-29, and it lives at EVP_SIGNATURE-ECDSA(7ossl). go forth and sign things 💖✨

📦 where this page comes from