starkbank / ecdsa-java

A lightweight and fast pure Java ECDSA library

A lightweight and fast ECDSA

Overview

This is a pure Java implementation of the Elliptic Curve Digital Signature Algorithm (ECDSA). It is compatible with Java 8+ and OpenSSL. It uses some elegant math such as Jacobian Coordinates to speed up the ECDSA.

Installation

Maven Central

In pom.xml:

<dependency>
    <groupId>com.starkbank</groupId>
    <artifactId>starkbank-ecdsa</artifactId>
    <version>1.0.2</version>
</dependency>

Then run:

mvn clean install

Curves

We currently support secp256k1, but it's super easy to add more curves to the project. Just add them on Curve.java

Speed

We ran a test on JDK 13.0.1 on a MAC Pro i5 2019. The libraries ran 100 times and showed the average times displayed bellow:

Library	sign	verify
java.security	0.9ms	2.4ms
starkbank-ecdsa	4.3ms	9.9ms

Sample Code

How to use it:

import com.starkbank.ellipticcurve.PrivateKey;
import com.starkbank.ellipticcurve.PublicKey;
import com.starkbank.ellipticcurve.Signature;
import com.starkbank.ellipticcurve.Ecdsa;


public class GenerateKeys{

    public static void main(String[] args){
        // Generate Keys
        PrivateKey privateKey = new PrivateKey();
        PublicKey publicKey = privateKey.publicKey();

        String message = "Testing message";
        // Generate Signature
        Signature signature = Ecdsa.sign(message, privateKey);

        // Verify if signature is valid
        boolean verified = Ecdsa.verify(message, signature, publicKey) ;

        // Return the signature verification status
        System.out.println("Verified: " + verified);

    }
}

OpenSSL

This library is compatible with OpenSSL, so you can use it to generate keys:

openssl ecparam -name secp256k1 -genkey -out privateKey.pem
openssl ec -in privateKey.pem -pubout -out publicKey.pem

Create a message.txt file and sign it:

openssl dgst -sha256 -sign privateKey.pem -out signatureBinary.txt message.txt

It's time to verify:

import com.starkbank.ellipticcurve.Ecdsa;
import com.starkbank.ellipticcurve.PublicKey;
import com.starkbank.ellipticcurve.Signature;
import com.starkbank.ellipticcurve.utils.ByteString;
import com.starkbank.ellipticcurve.utils.File;


public class VerifyKeys {

    public static void main(String[] args){
        // Read files
        String publicKeyPem = File.read("publicKey.pem");
        byte[] signatureBin = File.readBytes("signatureBinary.txt");
        String message = File.read("message.txt");

        ByteString byteString = new ByteString(signatureBin);

        PublicKey publicKey = PublicKey.fromPem(publicKeyPem);
        Signature signature = Signature.fromDer(byteString);

        // Get verification status:
        boolean verified = Ecdsa.verify(message, signature, publicKey);
        System.out.println("Verification status: " + verified);
    }
}

You can also verify it on terminal:

openssl dgst -sha256 -verify publicKey.pem -signature signatureBinary.txt message.txt

NOTE: If you want to create a Digital Signature to use in the Stark Bank, you need to convert the binary signature to base64.

openssl base64 -in signatureBinary.txt -out signatureBase64.txt

You can also verify it with this library:

import com.starkbank.ellipticcurve.utils.ByteString;
import com.starkbank.ellipticcurve.Signature;
import com.starkbank.ellipticcurve.utils.File;


public class GenerateSignature {

    public static void main(String[] args) {
        // Load signature file
        byte[] signatureBin = File.readBytes("signatureBinary.txt");
        Signature signature = Signature.fromDer(new ByteString(signatureBin));
        // Print signature
        System.out.println(signature.toBase64());
        }
}

Run all unit tests

gradle test

ecdsa-java's Issues

Private Key string representation

I just tried to get string representation of the Secret key and have got unexpected result:
Both methods:
ByteString bStr = privateKey.toByteString();
String res = BinaryAscii.hexFromBinary(bStr);

and:
String res = privateKey.secret.toString(16);

return some thing like this:

4b2e90b5a1044c47853924d138c033bf0ff8c73ec0bce4bef513c75ae5e57ddb0c
which differs in length with expected size (32 bytes) by one byte.

Explanations of correct use are highly appreciated.
Kind regards.

Add LICENSE for Java, PHP, Ruby, and Node

Considering using these libraries but I don't see a LICNESE file in each repo. Could you add a LICENSE for the Java, PHP, Ruby, and Node libs and include in a new release?

Performance analysis of secp521r1

Hi Team

Thanks for sharing your work in public. I took the code and added specification for NIST secp521r1 curve in the code and ,measured the performance for (ECDSA) Signature Verification. I got around 400 Signature verification.

Also when I saw your performance for secp256k1 curve

Library | sign | verify

java.security | 0.9ms | 2.4ms
starkbank-ecdsa | 4.3ms | 9.9ms

If I am correct. The java.security is performing 4 times better than your version?
Any thoughts

Wrong group id

In Maven Central the group id is "com.starkbank.ellipticcurve" not "com.starkbank" as you specify

็help me please

Request a method for using Public Key Hex to verify signatures.

ECDAA and ECDSA

Can this support ECDAA, is there a connection ?

It took 300ms-400ms to sign 100 times

@test
public void testSign() {
PrivateKey privateKey = new PrivateKey();
String message = "This is a text message";
long a = System.nanoTime();
for (int i = 0; i < 100; i++) {
Ecdsa.sign(message, privateKey);
}
long b = System.nanoTime();
System.out.println((b - a) / 1000000);
}

hi , please tell me Your Java version

The Oracle java is not support java.lang.Math.multiply and java.lang.Math.add

thanks