PHPackages starkbank/ecdsa - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. starkbank/ecdsa ActiveLibrary starkbank/ecdsa =============== fast openSSL-compatible implementation of the Elliptic Curve Digital Signature Algorithm (ECDSA) 2.1.0(2y ago)11434.3M—3.8%1713MITPHPPHP >=7.0 Since Apr 18Pushed 1w ago4 watchersCompare [ Source](https://github.com/starkbank/ecdsa-php)[ Packagist](https://packagist.org/packages/starkbank/ecdsa)[ Docs](https://github.com/starkbank/ecdsa-php)[ RSS](/packages/starkbank-ecdsa/feed)WikiDiscussions master Synced 1mo ago READMEChangelog (9)DependenciesVersions (8)Used By (13) A lightweight and fast pure PHP ECDSA ------------------------------------- [](#a-lightweight-and-fast-pure-php-ecdsa) ### Overview [](#overview) This is a pure PHP implementation of the Elliptic Curve Digital Signature Algorithm. It is compatible with OpenSSL and uses elegant math such as Jacobian Coordinates to speed up the ECDSA on pure PHP. ### Security [](#security) starkbank-ecdsa includes the following security features: - **RFC 6979 deterministic nonces**: Eliminates the catastrophic risk of nonce reuse that leaks private keys - **Low-S signature normalization**: Prevents signature malleability (BIP-62) - **Public key on-curve validation**: Blocks invalid-curve attacks during verification - **Montgomery ladder scalar multiplication**: Constant-operation point multiplication to mitigate timing side channels - **Hash truncation**: Correctly handles hash functions larger than the curve order (e.g. SHA-512 with secp256k1) ### Installation [](#installation) #### Composer [](#composer) To install the package with Composer, run: ``` composer require starkbank/ecdsa ``` To use the bindings, use Composer's autoload: ``` require_once('vendor/autoload.php'); ``` #### External dependencies [](#external-dependencies) The package makes use of the 'GNU Multiple Precision' (GMP) library. For installation details, see: ### Curves [](#curves) We currently support `secp256k1` and `prime256v1` (P-256), but you can add more curves to the project. You just need to use the `CurveFp::add()` method. ### Speed [](#speed) We ran a test on a MAC Pro using PHP 8.5. The library was run 100 times and the averages displayed below were obtained: Librarysignverifystarkbank-ecdsa0.3ms0.8msPerformance is driven by Jacobian coordinates, a branch-balanced Montgomery ladder for variable-base scalar multiplication, a precomputed affine table of powers-of-two multiples of the generator (`[G, 2G, 4G, ..., 2^n*G]`) combined with a width-2 NAF of the scalar to eliminate doublings during signing, a mixed affine+Jacobian addition fast path, curve-specific shortcuts in point doubling (A=0 for secp256k1, A=-3 for prime256v1), the secp256k1 GLV endomorphism to split 256-bit scalars into two ~128-bit halves for a 4-scalar simultaneous multi-exponentiation during verification, Shamir's trick with Joint Sparse Form as the fallback path for curves without an efficient endomorphism, and the extended Euclidean algorithm for modular inversion. ### Sample Code [](#sample-code) How to sign a json message for [Stark Bank](https://starkbank.com): ``` # Generate privateKey from PEM string $privateKey = EllipticCurve\PrivateKey::fromPem(" -----BEGIN EC PARAMETERS----- BgUrgQQACg== -----END EC PARAMETERS----- -----BEGIN EC PRIVATE KEY----- MHQCAQEEIODvZuS34wFbt0X53+P5EnSj6tMjfVK01dD1dgDH02RzoAcGBSuBBAAK oUQDQgAE/nvHu/SQQaos9TUljQsUuKI15Zr5SabPrbwtbfT/408rkVVzq8vAisbB RmpeRREXj5aog/Mq8RrdYy75W9q/Ig== -----END EC PRIVATE KEY----- "); # Create message from json $message = array( "transfers" => array( array( "amount" => 100000000, "taxId" => "594.739.480-42", "name" => "Daenerys Targaryen Stormborn", "bankCode" => "341", "branchCode" => "2201", "accountNumber" => "76543-8", "tags" => array("daenerys", "targaryen", "transfer-1-external-id") ) ) ); $message = json_encode($message, JSON_PRETTY_PRINT); $signature = EllipticCurve\Ecdsa::sign($message, $privateKey); # Generate Signature in base64. This result can be sent to Stark Bank in header as Digital-Signature parameter echo "\n" . $signature->toBase64(); # To double check if message matches the signature $publicKey = $privateKey->publicKey(); echo "\n" . EllipticCurve\Ecdsa::verify($message, $signature, $publicKey); ``` Simple use: ``` # Generate new Keys $privateKey = new EllipticCurve\PrivateKey; $publicKey = $privateKey->publicKey(); $message = "My test message"; # Generate Signature $signature = EllipticCurve\Ecdsa::sign($message, $privateKey); # Verify if signature is valid echo "\n" . EllipticCurve\Ecdsa::verify($message, $signature, $publicKey); ``` How to add more curves: ``` $newCurve = new EllipticCurve\CurveFp( "0xf1fd178c0b3ad58f10126de8ce42435b3961adbcabc8ca6de8fcf353d86e9c00", "0xee353fca5428a9300d4aba754a44c00fdfec0c9ae4b1a1803075ed967b7bb73f", "0xf1fd178c0b3ad58f10126de8ce42435b3961adbcabc8ca6de8fcf353d86e9c03", "0xf1fd178c0b3ad58f10126de8ce42435b53dc67e140d2bf941ffdd459c6d655e1", "0xb6b3d4c356c139eb31183d4749d423958c27d2dcaf98b70164c97a2dd98f5cff", "0x6142e0f7c8b204911f9271f0f3ecef8c2701c307e8e4c9e183115a1554062cfb", "frp256v1", array(1, 2, 250, 1, 223, 101, 256, 1) ); EllipticCurve\CurveFp::add($newCurve); $publicKeyPem = "-----BEGIN PUBLIC KEY----- MFswFQYHKoZIzj0CAQYKKoF6AYFfZYIAAQNCAATeEFFYiQL+HmDYTf+QDmvQmWGD dRJPqLj11do8okvkSxq2lwB6Ct4aITMlCyg3f1msafc/ROSN/Vgj69bDhZK6 -----END PUBLIC KEY-----"; $publicKey = EllipticCurve\PublicKey::fromPem($publicKeyPem); print_r($publicKey->toPem()); ``` How to generate a compressed public key: ``` $privateKey = new EllipticCurve\PrivateKey; $publicKey = $privateKey->publicKey(); $compressedPublicKey = $publicKey->toCompressed(); echo $compressedPublicKey; ``` How to recover a compressed public key: ``` $compressedPublicKey = "0252972572d465d016d4c501887b8df303eee3ed602c056b1eb09260dfa0da0ab2"; $publicKey = EllipticCurve\PublicKey::fromCompressed($compressedPublicKey); print_r($publicKey->toPem()); ``` ### OpenSSL [](#openssl) This library is compatible with OpenSSL, so you can use it to generate keys: ``` openssl ecparam -name secp256k1 -genkey -out privateKey.pem openssl ec -in privateKey.pem -pubout -out publicKey.pem ``` Create a message.txt file and sign it: ``` openssl dgst -sha256 -sign privateKey.pem -out signatureDer.txt message.txt ``` It's time to verify: ``` $publicKeyPem = EllipticCurve\Utils\File::read("publicKey.pem"); $signatureDer = EllipticCurve\Utils\File::read("signatureDer.txt"); $message = EllipticCurve\Utils\File::read("message.txt"); $publicKey = EllipticCurve\PublicKey::fromPem($publicKeyPem); $signature = EllipticCurve\Signature::fromDer($signatureDer); echo "\n" . EllipticCurve\Ecdsa::verify($message, $signature, $publicKey); ``` You can also verify it on terminal: ``` openssl dgst -sha256 -verify publicKey.pem -signature signatureDer.txt message.txt ``` NOTE: If you want to create a Digital Signature to use in the [Stark Bank](https://starkbank.com), you need to convert the binary signature to base64. ``` openssl base64 -in signatureDer.txt -out signatureBase64.txt ``` You can also verify it with this library: ``` $signatureDer = EllipticCurve\Utils\File::read("signatureDer.txt"); $signature = EllipticCurve\Signature::fromDer($signatureDer); echo "\n" . $signature->toBase64(); ``` ### Run all unit tests [](#run-all-unit-tests) ``` php tests/test.php ``` ### Run benchmark [](#run-benchmark) ``` php benchmark.php ``` ### Health Score 57 ↑ FairBetter than 98% of packages Maintenance64 Regular maintenance activity Popularity65 Solid adoption and visibility Community34 Small or concentrated contributor base Maturity56 Maturing project, gaining track record Bus Factor2 2 contributors hold 50%+ of commits How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~206 days Total 7 Last Release 985d ago Major Versions 0.0.5 → 2.0.02022-09-22 PHP version history (2 changes)0.0.3PHP >=5.5 2.0.0PHP >=7.0 ### Community Maintainers ![](https://www.gravatar.com/avatar/4c92339779ad69305650769dc7849660ad9c49159ae94044e16b88a0ae0b5f4a?d=identicon)[cdottori](/maintainers/cdottori) ![](https://www.gravatar.com/avatar/9a045ea83eb19c2cf081683644325f0491d76fd99ff30a9ce2f47cff62604c45?d=identicon)[matheuscferraz](/maintainers/matheuscferraz) ![](https://www.gravatar.com/avatar/8e7d71d7b902babcc557e87cd09e816d1981edd2c444e56ebbd1cf22416a17ab?d=identicon)[rcmstark](/maintainers/rcmstark) ![](https://www.gravatar.com/avatar/c7101821e9ac356daac998a5353f96b24ba2c52e441b3b8de5fb157628c00b31?d=identicon)[pandora-stark](/maintainers/pandora-stark) --- Top Contributors [![cdottori-stark](https://avatars.githubusercontent.com/u/57642415?v=4)](https://github.com/cdottori-stark "cdottori-stark (28 commits)")[![rcmstark](https://avatars.githubusercontent.com/u/2885008?v=4)](https://github.com/rcmstark "rcmstark (11 commits)")[![lucasmiranda-stark](https://avatars.githubusercontent.com/u/274317799?v=4)](https://github.com/lucasmiranda-stark "lucasmiranda-stark (6 commits)")[![delsonb-stark](https://avatars.githubusercontent.com/u/112506111?v=4)](https://github.com/delsonb-stark "delsonb-stark (4 commits)")[![luistarkbank](https://avatars.githubusercontent.com/u/131908452?v=4)](https://github.com/luistarkbank "luistarkbank (2 commits)")[![matheuscferraz](https://avatars.githubusercontent.com/u/49496426?v=4)](https://github.com/matheuscferraz "matheuscferraz (2 commits)")[![xavier-stark](https://avatars.githubusercontent.com/u/103963255?v=4)](https://github.com/xavier-stark "xavier-stark (2 commits)")[![jerowork](https://avatars.githubusercontent.com/u/4119451?v=4)](https://github.com/jerowork "jerowork (1 commits)")[![elidemayo](https://avatars.githubusercontent.com/u/1295393?v=4)](https://github.com/elidemayo "elidemayo (1 commits)") ### Embed Badge ![Health badge](/badges/starkbank-ecdsa/health.svg) ``` [![Health](https://phpackages.com/badges/starkbank-ecdsa/health.svg)](https://phpackages.com/packages/starkbank-ecdsa) ``` PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)