ECDSA in Javascript Cryptography

ECDSA (Elliptic Curve Digital Signature Algorithm) is a cryptographic algorithm widely used for digital signatures. It’s particularly popular due to its efficiency and security compared to other algorithms like RSA.

Generating Key Pairs

The first step is to generate a pair of public and private keys. These keys are essential for signing and verifying messages.

// const crypto = require('crypto'); for Nodejs

async function generateKeys() {
  const keyPair = await crypto.subtle.generateKey(
    { name: "ECDSA", namedCurve: "P-256" },
    true,
    ["sign", "verify"],
  );
  return keyPair;
}

• crypto.subtle.generateKey: Generates a key pair.
• name: Specifies the algorithm (ECDSA).
• namedCurve: Defines the elliptic curve used (P-256 is a common choice).
• true: Indicates that the keys should be extractable.
• ["sign", "verify"]: Specifies the allowed operations (signing and verifying).

Signing a Message

Once you have a private key, you can use it to sign a message.

async function signMessage(privateKey, data) {
  const signature = await crypto.subtle.sign(
    {
      name: "ECDSA",
      hash: { name: "SHA-256" },
    },
    privateKey,
    new TextEncoder().encode(data),
  );

  return { signature, data };
}

• crypto.subtle.sign: Signs the data using the private key.
• name: Specifies the algorithm (ECDSA).
• hash: Defines the hash algorithm used (SHA-256).
• privateKey: The private key used for signing.
• new TextEncoder().encode(data): Converts the data to a Uint8Array.

Verifying a Signature

To verify a signature, you’ll need the public key and the original data.

async function verifyMessage(publicKey, signature, data) {
  const isValid = await crypto.subtle.verify(
    {
      name: "ECDSA",
      hash: { name: "SHA-256" },
    },
    publicKey,
    signature,
    new TextEncoder().encode(data),
  );

  return isValid;
}

• crypto.subtle.verify: Verifies the signature using the public key.
• name: Specifies the algorithm (ECDSA).
• hash: Defines the hash algorithm used (SHA-256).
• publicKey: The public key used for verification.
• signature: The signature to verify.
• new TextEncoder().encode(data): Converts the data to a Uint8Array.

Example Usage

(async () => {
  const keyPair = await generateKeys();
  const { signature, data } = await signMessage(keyPair.privateKey, "hello");

  const isValid = await verifyMessage(keyPair.publicKey, signature, data);
  console.log("Signature valid:", isValid);

  const isNotValid = await verifyMessage(keyPair.publicKey, signature, "data");
  console.log("Signature is not valid:", isNotValid);
})();

This code first generates a key pair, signs the message “hello”, and then verifies the signature.

Conclusion

While this code provides a basic understanding of ECDSA in Javascript browser, Deno and Node.js, real-world applications often involve more complex scenarios, such as storing private keys securely and handling potential vulnerabilities.

Remember: In Cryptography, ECDSA is primarily designed for digital signatures. It’s used to verify the authenticity and integrity of data, not to encrypt or decrypt it.

Further Reading

• avaScript Cryptography using RSA-OAEP