EC Signatures

For the purposes of these mechanisms, an ECDSA signature is an octet string of even length which is at most two times nLen octets, where nLen is the length in octets of the base point order n. The signature octets correspond to the concatenation of the ECDSA values r and s, both represented as an octet string of equal length of at most nLen with the most significant byte first. If r and s have different octet length, the shorter of both must be padded with leading zero octets such that both have the same octet length. Loosely spoken, the first half of the signature is r and the second half is s. For signatures created by a token, the resulting signature is always of length 2 nLen. For signatures passed to a token for verification, the signature may have a shorter length but must be composed as specified before.

If the length of the hash value is larger than the bit length of n, only the leftmost bits of the hash up to the length of n will be used.

Note: For applications, it is recommended to encode the signature as an octet string of length two times nLen if possible. This ensures that the application works with PKCS#11 modules which have been implemented based on an older version of this document. Older versions required all signatures to have length two times nLen. It may be impossible to encode the signature with the maximum length of two times nLen if the application just gets the integer values of r and s (i.e. without leading zeros), but does not know the base point order n, because r and s can have any value between zero and the base point order n.

This section defines the key type "CKK_ECDSA" and "CKK_EC" for type CK_KEY_TYPE as used in the CKA_KEY_TYPE attribute of key objects.

Mechanisms:

Note: CKM_ECDSA_KEY_PAIR_GEN is deprecated in v2.11

CKM_ECDSA_KEY_PAIR_GEN 
CKM_EC_KEY_PAIR_GEN 
CKM_ECDSA 
CKM_ECDSA_SHA1 
CKM_ECDH1_DERIVE 
CKM_ECDH1_COFACTOR_DERIVE 
CKM_ECMQV_DERIVE

RSA Security Inc. Public-Key Cryptography Standards - PKCS#11 - v220