Skip to content

P256VERIFY

Signature verification

Verify a secp256r1 (NIST P-256) ECDSA signature.

Address0x0000000000000000000000000000000000000100
NameP256VERIFY
Minimum gas6,900
Input160 bytes (exact)
Output32 bytes, or empty on failure
Available sinceOsaka

Input

hash32 B
r32 B
s32 B
x32 B
y32 B
OffsetLengthFieldDescription
032hashThe 32-byte message hash.
3232rSignature component r.
6432sSignature component s.
9632xX coordinate of the public key.
12832yY coordinate of the public key.

Output

A 32-byte word equal to 1 when the signature is valid.

Gas

6900

Failure behaviour

  • Returns empty data with no error if the input is not exactly 160 bytes, if the public key is not on the curve, or if the signature does not verify.
  • There is no low-s requirement, so signatures are malleable: (r, s) and (r, n − s) both verify. Do not use the signature bytes as a unique identifier.
  • Gas is charged in full either way.

Notes

  • P-256 is a classical curve. It is broken by a cryptographically relevant quantum computer exactly as secp256k1 is — it is here for compatibility with WebAuthn and platform keystores, not for post-quantum security. For that, use 0x14 or 0x15.

Calling it

Precompiles have no ABI and no function selector: the input is raw bytes at the exact offsets above. Call with staticcall.

// P256VERIFY at 0x0100
(bool ok, bytes memory out) = address(0x0100).staticcall(input);
require(ok, "P256VERIFY reverted");

Specification

  • EIP-7951: Precompile for secp256r1 curve support