noble-secp256k1
Fastest 4KB JS implementation of secp256k1 ECDH & ECDSA signatures compliant with RFC6979.
If you're looking for additional features, check out noble-curves: a drop-in replacement with common.js, Schnorr signatures, DER encoding and support for different hash functions.
Check out Upgrading section for v1 to v2 transition instructions, the online demo, secp256k1-node compatibility layer and blog post Learning fast elliptic-curve cryptography in JS.
This library belongs to noble crypto
noble-crypto — high-security, easily auditable set of contained cryptographic libraries and tools.
- No dependencies, protection against supply chain attacks
- Auditable TypeScript / JS code
- Supported in all major browsers and stable node.js versions
- All releases are signed with PGP keys
- Check out homepage & all libraries: curves (4kb versions secp256k1, ed25519), hashes
Usage
npm install @noble/secp256k1
We support all major platforms and runtimes.
For node.js <= 18, a polyfill for globalThis.crypto
is needed, see below.
For React Native, you may need a polyfill for getRandomValues.
import * as secp from '@noble/secp256k1';
// import * as secp from "https://deno.land/x/secp256k1/mod.ts"; // Deno
// import * as secp from "https://unpkg.com/@noble/secp256k1"; // Unpkg
(async () => {
// keys, messages & other inputs can be Uint8Arrays or hex strings
// Uint8Array.from([0xde, 0xad, 0xbe, 0xef]) === 'deadbeef'
const privKey = secp.utils.randomPrivateKey(); // Secure random private key
// sha256 of 'hello world'
const msgHash = 'b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9';
const pubKey = secp.getPublicKey(privKey);
const signature = await secp.signAsync(msgHash, privKey); // Sync methods below
const isValid = secp.verify(signature, msgHash, pubKey);
const alicesPubkey = secp.getPublicKey(secp.utils.randomPrivateKey());
secp.getSharedSecret(privKey, alicesPubkey); // Elliptic curve diffie-hellman
signature.recoverPublicKey(msgHash); // Public key recovery
})();
Advanced examples:
// Enable synchronous methods.
// Only async methods are available by default, to keep the library dependency-free.
import { hmac } from '@noble/hashes/hmac';
import { sha256 } from '@noble/hashes/sha256';
secp.etc.hmacSha256Sync = (k, ...m) => hmac(sha256, k, secp.etc.concatBytes(...m))
// secp.sign(msgHash, privKey); // sync methods can be used now
// node.js 18 and earlier requires globalThis.crypto polyfill.
import { webcrypto } from 'node:crypto';
// @ts-ignore
if (!globalThis.crypto) globalThis.crypto = webcrypto;
// Enable OpenSSL compatibility.
// OpenSSL allows to create malleable signatures, which are not compatible with BTC/ETH.
// By default, `lowS: true` prohibits signatures which have (sig.s >= CURVE.n/2n).
const signatureMalleable = secp.sign(msgHash, privKey, { lowS: false });
// Signatures with improved security, containing additional entropy.
// Adds entropy to deterministic signature, follows section 3.6 of RFC6979.
// When `true`, it would be filled with 32b from CSPRNG.
// **Strongly recommended** to use, to improve security:
// - No disadvantage: if an entropy generator is broken, sigs would be the same
// as they are without the option
// - It would help a lot in case there is an error somewhere in `k` gen.
// Exposing `k` could leak private keys
// - Sigs with extra entropy would have different `r` / `s`, which means they
// would still be valid, but may break some test vectors if you're
// cross-testing against other libs
const signatureImproved = secp.sign(msgHash, privKey, { extraEntropy: true });
API
There are 3 main methods: getPublicKey(privateKey)
,
sign(messageHash, privateKey)
and
verify(signature, messageHash, publicKey)
.
type Hex = Uint8Array | string;
// Generates public key from 32-byte private key.
// isCompressed=true by default, meaning 33-byte output. Set to false for 65b.
function getPublicKey(privateKey: Hex, isCompressed?: boolean): Uint8Array;
// Use:
// - `ProjectivePoint.fromPrivateKey(privateKey)` for Point instance
// - `ProjectivePoint.fromHex(publicKey)` to convert hex / bytes into Point.
// Generates low-s deterministic-k RFC6979 ECDSA signature.
// Use with `extraEntropy: true` to improve security.
function sign(
messageHash: Hex, // message hash (not message) which would be signed
privateKey: Hex, // private key which will sign the hash
opts?: { lowS: boolean, extraEntropy: boolean | Hex } // optional params
): Signature;
function signAsync(
messageHash: Hex,
privateKey: Hex,
opts?: { lowS: boolean; extraEntropy: boolean | Hex }
): Promise<Signature>;
// Verifies ECDSA signature.
// lowS option Ensures a signature.s is in the lower-half of CURVE.n.
// Used in BTC, ETH.
// `{ lowS: false }` should only be used if you need OpenSSL-compatible signatures
function verify(
signature: Hex | Signature, // returned by the `sign` function
messageHash: Hex, // message hash (not message) that must be verified
publicKey: Hex, // public (not private) key
opts?: { lowS: boolean } // optional params; { lowS: true } by default
): boolean;
// Computes ECDH (Elliptic Curve Diffie-Hellman) shared secret between
// key A and different key B.
function getSharedSecret(
privateKeyA: Uint8Array | string, // Alices's private key
publicKeyB: Uint8Array | string, // Bob's public key
isCompressed = true // optional arg. (default) true=33b key, false=65b.
): Uint8Array;
// Use `ProjectivePoint.fromHex(publicKeyB).multiply(privateKeyA)` for Point instance
// Recover public key from Signature instance with `recovery` bit set
signature.recoverPublicKey(
msgHash: Uint8Array | string
): Uint8Array | undefined;
A bunch of useful utilities are also exposed:
type Bytes = Uint8Array;
const etc: {
hexToBytes: (hex: string) => Bytes;
bytesToHex: (b: Bytes) => string;
concatBytes: (...arrs: Bytes[]) => Bytes;
bytesToNumberBE: (b: Bytes) => bigint;
numberToBytesBE: (num: bigint) => Bytes;
mod: (a: bigint, b?: bigint) => bigint;
invert: (num: bigint, md?: bigint) => bigint;
hmacSha256Async: (key: Bytes, ...msgs: Bytes[]) => Promise<Bytes>;
hmacSha256Sync: HmacFnSync;
hashToPrivateKey: (hash: Hex) => Bytes;
randomBytes: (len: number) => Bytes;
};
const utils: {
normPrivateKeyToScalar: (p: PrivKey) => bigint;
randomPrivateKey: () => Bytes;
isValidPrivateKey: (key: Hex) => boolean;
precompute(p: ProjectivePoint, windowSize?: number): ProjectivePoint;
};
class ProjectivePoint {
constructor(px: bigint, py: bigint, pz: bigint);
static readonly BASE: ProjectivePoint;
static readonly ZERO: ProjectivePoint;
static fromAffine(point: AffinePoint): ProjectivePoint;
static fromHex(hex: Hex): ProjectivePoint;
static fromPrivateKey(n: PrivKey): ProjectivePoint;
get x(): bigint;
get y(): bigint;
add(other: ProjectivePoint): ProjectivePoint;
assertValidity(): void;
equals(other: ProjectivePoint): boolean;
multiply(n: bigint): ProjectivePoint;
negate(): ProjectivePoint;
subtract(other: ProjectivePoint): ProjectivePoint;
toAffine(): AffinePoint;
toHex(isCompressed?: boolean): string;
toRawBytes(isCompressed?: boolean): Bytes;
}
class Signature {
constructor(r: bigint, s: bigint, recovery?: number | undefined);
static fromCompact(hex: Hex): Signature;
readonly r: bigint;
readonly s: bigint;
readonly recovery?: number | undefined;
ok(): Signature;
hasHighS(): boolean;
recoverPublicKey(msgh: Hex): Point;
toCompactRawBytes(): Bytes;
toCompactHex(): string;
}
CURVE // curve prime; order; equation params, generator coordinates
Security
The module is production-ready. It is cross-tested against noble-curves, and has similar security.
- The current version is rewrite of v1, which has been audited by cure53: PDF (funded by Umbra.cash & community).
- It's being fuzzed by Guido Vranken's cryptofuzz: run the fuzzer by yourself to check.
Our EC multiplication is hardened to be algorithmically constant time.
We're using built-in JS BigInt
, which is potentially vulnerable to
timing attacks as
per MDN.
But, JIT-compiler and Garbage Collector make "constant time" extremely hard
to achieve in a scripting language. Which means any other JS library doesn't
use constant-time bigints. Including bn.js or anything else.
Even statically typed Rust, a language without GC,
makes it harder to achieve constant-time
for some cases. If your goal is absolute security, don't use any JS lib —
including bindings to native ones. Use low-level libraries & languages.
We consider infrastructure attacks like rogue NPM modules very important;
that's why it's crucial to minimize the amount of 3rd-party dependencies & native
bindings. If your app uses 500 dependencies, any dep could get hacked and you'll
be downloading malware with every npm install
. Our goal is to minimize this attack vector.
Speed
Use noble-curves if you need even higher performance.
Benchmarks measured with Apple M2 on MacOS 13 with node.js 20.
getPublicKey(utils.randomPrivateKey()) x 6,430 ops/sec @ 155μs/op
sign x 3,367 ops/sec @ 296μs/op
verify x 600 ops/sec @ 1ms/op
getSharedSecret x 505 ops/sec @ 1ms/op
recoverPublicKey x 612 ops/sec @ 1ms/op
Point.fromHex (decompression) x 9,185 ops/sec @ 108μs/op
Compare to other libraries on M1 (openssl
uses native bindings, not JS):
elliptic#getPublicKey x 1,940 ops/sec
sjcl#getPublicKey x 211 ops/sec
elliptic#sign x 1,808 ops/sec
sjcl#sign x 199 ops/sec
openssl#sign x 4,243 ops/sec
ecdsa#sign x 116 ops/sec
bip-schnorr#sign x 60 ops/sec
elliptic#verify x 812 ops/sec
sjcl#verify x 166 ops/sec
openssl#verify x 4,452 ops/sec
ecdsa#verify x 80 ops/sec
bip-schnorr#verify x 56 ops/sec
elliptic#ecdh x 971 ops/sec
Contributing
- Clone the repository.
npm install
to install build dependencies like TypeScriptnpm run build
to compile TypeScript codenpm test
to run jest ontest/index.ts
Special thanks to Roman Koblov, who have helped to improve scalar multiplication speed.
Upgrading
noble-secp256k1 v2 features improved security and smaller attack surface. The goal of v2 is to provide minimum possible JS library which is safe and fast.
That means the library was reduced 4x, to just over 400 lines. In order to achieve the goal, some features were moved to noble-curves, which is even safer and faster drop-in replacement library with same API. Switch to curves if you intend to keep using these features:
- DER encoding: toDERHex, toDERRawBytes, signing / verification of DER sigs
- Schnorr signatures
- Using
utils.precompute()
for non-base point - Support for environments which don't support bigint literals
- Common.js support
- Support for node.js 18 and older without shim
Other changes for upgrading from @noble/secp256k1 1.7 to 2.0:
getPublicKey
- now produce 33-byte compressed signatures by default
- to use old behavior, which produced 65-byte uncompressed keys, set
argument
isCompressed
tofalse
:getPublicKey(priv, false)
sign
- is now sync; use
signAsync
for async version - now returns
Signature
instance with{ r, s, recovery }
properties canonical
option was renamed tolowS
recovered
option has been removed because recovery bit is always returned nowder
option has been removed. There are 2 options:- Use compact encoding:
fromCompact
,toCompactRawBytes
,toCompactHex
. Compact encoding is simply a concatenation of 32-byte r and 32-byte s. - If you must use DER encoding, switch to noble-curves (see above).
- Use compact encoding:
- is now sync; use
verify
strict
option was renamed tolowS
getSharedSecret
- now produce 33-byte compressed signatures by default
- to use old behavior, which produced 65-byte uncompressed keys, set
argument
isCompressed
tofalse
:getSharedSecret(a, b, false)
recoverPublicKey(msg, sig, rec)
was changed tosig.recoverPublicKey(msg)
number
type for private keys have been removed: usebigint
insteadPoint
(2d xy) has been changed toProjectivePoint
(3d xyz)utils
were split intoutils
(same api as in noble-curves) andetc
(hmacSha256Sync
and others)
License
MIT (c) Paul Miller (https://paulmillr.com), see LICENSE file.