ECC Sign (ECDSA)

Category: Asymmetric & Elliptic Curve · Node Type ID: asymmetric-ecc-sign

Signs message or hash using private key on specified curve

Overview

Computes an Elliptic Curve Digital Signature Algorithm (ECDSA, FIPS 186-5 / ANSI X9.62 / RFC 6979) signature over a message or pre-computed hash using a private key on the selected Weierstrass curve (P-256, P-384, P-521, secp256k1, brainpoolP256r1, or brainpoolP384r1).

When Pre-hash with SHA-256 is enabled (default true), the node automatically hashes the incoming Message with SHA-256 before signing. Turn Pre-hash with SHA-256 off (false) when signing a custom digest computed upstream (such as SHA-384, SHA-512, or Keccak-256 from Hash Digest).

When to Use

Creating ECDSA signatures for TLS, JWT (ES256/ES384/ES512/ES256K), Bitcoin/Ethereum transactions (secp256k1), or smartcard/ePassport certificates (brainpool).

Parameter Configuration

Parameter (ID)	Type & Default	Visibility Condition	Description & Options
Curve `curve`	`select` Default: `p256`	Always visible	Must match the elliptic curve of the connected `Private Key`. `secp256k1`: secp256k1 (Bitcoin / Ethereum) `p256`: NIST P-256 (secp256r1 / prime256v1) `p384`: NIST P-384 (secp384r1) `p521`: NIST P-521 (secp521r1) `brainpoolP256r1`: Brainpool P256r1 (RFC 5639) `brainpoolP384r1`: Brainpool P384r1 (RFC 5639) `brainpoolP512r1`: Brainpool P512r1 (RFC 5639)
Pre-hash with SHA-256 `autoHash`	`boolean` Default: `true` Supports Variable Reference (`$var`: `bool`)	Always visible	When enabled (`true`), hashes the `Message` input with SHA-256 before signing. When disabled (`false`), treats the `Message` input as an already-computed message digest.

Port I/O Specification

See Ports & Connections for general wiring rules, data type colors, and dynamic port creation.

Input Ports

Port Nature: Fixed Input Ports (2 total).

Port Name	Port ID	Data Type	Required	Visibility Condition	Description
`Private Key`	`privateKey`	`Bytes`	Required	Always visible	Raw private scalar bytes for the selected curve (32B for 256-bit curves, 48B for 384-bit curves, 66B for P-521).
`Message`	`data`	`Bytes`	Required	Always visible	Original message bytes (when `Pre-hash with SHA-256 = true`) or pre-computed hash digest bytes (when `false`).

Output Ports

Port Nature: Fixed Output Ports (1 total).

Port Name	Port ID	Data Type	Visibility Condition	Description
`Signature`	`signature`	`Bytes`	Always visible	Computed ECDSA signature bytes ($r \parallel s$).

Error Cases

When any of the following conditions occurs at runtime, this node transitions to an ERROR state and downstream nodes connected to its outputs do not execute.

Error Code	Default Engine Message	Trigger Condition
`INVALID_KEY_MATERIAL`	Invalid key length or format	Raised when `Private Key` has an invalid length or is out of the valid scalar range $[1, n-1]$ for the selected curve.

Examples

Signing an Ethereum Keccak-256 Digest on secp256k1

Hash a message with Keccak-256 and sign the raw digest on secp256k1.

Compute a 32-byte digest using Hash Digest (Algorithm = Keccak-256).
On ECC Sign (ECDSA), set Curve to secp256k1, uncheck Pre-hash with SHA-256, and connect your 32-byte private key and the Keccak-256 digest.