title: openSSL: Import ECDSA signature from raw data with compressed CurvePoint R instead of r
body: <p>I want to verify some data packets which contain an ECDSA signature that is not ASN.1 DER encoded.</p>
  
  <p>I am trying to perform the task with openSSL (version 1.1.0) as it seems to bring all the required functionality.</p>
  
  <p>Currently I am stuck with importing the signature from the data packet.
  The signature looks like this:</p>
  
  <p><a href="https://i.stack.imgur.com/vgpH7.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/vgpH7.jpg" alt="signature shown in Wireshark"></a></p>
  
  <p>(The last 4 bytes should not be marked as part of the signature)</p>
  
  <p>TShark shows the relevant part like this:</p>
  
  <blockquote>
  <pre><code>    "gn.sh.sig": {
        "gn.st.pka": "0",
        "gn.st.eccpointtype": "3",
        "gn.st.opaque": "1f:f8:ad:a7:fd:99:b2:a8:a2:69:d4:d6:67:e5:ee:5b:3f:8b:e8:7f:49:fc:b4:79:95:98:15:0d:cb:bd:06:3c",
        "gn.st.opaque": "61:a4:6a:c9:a7:dd:bd:0d:9c:0a:0e:73:db:52:06:bb:79:53:99:51:16:45:45:81:4e:df:94:5c:58:59:40:14"
      }
  </code></pre>
  </blockquote>
  
  <p>The encoding is according ETSI TS 103 097 v1.2.1</p>
  
  <p>The first entry <code>opaque</code> together with the <code>ECC Point type</code> form an EccPoint named <code>R</code> while the second field <code>opaque</code> is named <code>s</code>.</p>
  
  <p>My first step is to create a signature in openSSL and import the data into it. </p>
  
  <p>My code (error handling removed to reduce size) looks like this:</p>
  
  <pre><code>#include &lt;openssl/conf.h&gt;
  #include &lt;openssl/evp.h&gt;
  #include &lt;openssl/err.h&gt;
  #include &lt;openssl/ec.h&gt;
  #include &lt;openssl/ecdsa.h&gt;
  #include &lt;openssl/bn.h&gt;
  
  #include &lt;stdlib.h&gt;
  #include &lt;stdio.h&gt;
  #include &lt;stdint.h&gt;
  #include &lt;string.h&gt;
  
  void verify_signature(void)
  {
    int res;
  
    // Which value is correct for r-part?
    static const char sig_r_hex[] = "1ff8ada7fd99b2a8a269d4d667e5ee5b3f8be87f49fcb4799598150dcbbd063c";
    static const char sig_s_hex[] = "61a46ac9a7ddbd0d9c0a0e73db5206bb79539951164545814edf945c58594014";
  
    BN_CTX *bn_ctx = BN_CTX_new();
    BN_CTX_start(bn_ctx);
  
    // Create signature and import from packet.
    BIGNUM *bn_r = BN_CTX_get(bn_ctx);
    BIGNUM *bn_s = BN_CTX_get(bn_ctx);
  
    res = BN_hex2bn(&amp;bn_r, sig_r_hex);
    res = BN_hex2bn(&amp;bn_s, sig_s_hex);
  
    ECDSA_SIG *signature = ECDSA_SIG_new();
    res = ECDSA_SIG_set0(signature, bn_r, bn_s);
    printf("ECDSA_SIG_set0(): %d\n", res);
  
    // ...
    // Create hash of message and verify signature with public key
    //...
  }
  
  int main(int arc, char *argv[])
  { 
    ERR_load_crypto_strings();
    OpenSSL_add_all_algorithms();
    OPENSSL_config(NULL);
  
    verify_signature();
  
    EVP_cleanup();
    CRYPTO_cleanup_all_ex_data();
    ERR_free_strings();
    return 0;
  }
  </code></pre>
  
  <p>What I am currently missing is how I should handle the value <code>R</code> properly. 
  Which parts of the compressed CurvePoint should be used as <code>r</code> to initialize the signature?
  Do I need to uncompress <code>y</code> part?
  Do I have to add some indication for the compressed <code>y</code> value?</p>
  
  <p>Any hints are welcome.</p>
  
  <p>Edit:</p>
  
  <p>From what I read in IEEE1609.2 and SEC-1 it is possible to add additional information to allow for faster computation of <code>R</code> from <code>r</code>. This may the the point <code>R</code> itself.
  As <code>r = xR mod n</code> it should be possible to calculate <code>r</code> from the EccPoint.</p>
  
  <p>Does openSSL support this mechanism to speed up verification or do I really have to remove the extra information (and find out how to do it) to feed <code>r</code> into openSSL?</p>