P256VERIFY
Signature verification
Verify a secp256r1 (NIST P-256) ECDSA signature.
| Address | 0x0000000000000000000000000000000000000100 |
|---|---|
| Name | P256VERIFY |
| Minimum gas | 6,900 |
| Input | 160 bytes (exact) |
| Output | 32 bytes, or empty on failure |
| Available since | Osaka |
Input
hash32 B
r32 B
s32 B
x32 B
y32 B
| Offset | Length | Field | Description |
|---|---|---|---|
| 0 | 32 | hash | The 32-byte message hash. |
| 32 | 32 | r | Signature component r. |
| 64 | 32 | s | Signature component s. |
| 96 | 32 | x | X coordinate of the public key. |
| 128 | 32 | y | Y coordinate of the public key. |
Output
A 32-byte word equal to 1 when the signature is valid.
Gas
6900
Failure behaviour
- Returns empty data with no error if the input is not exactly 160 bytes, if the public key is not on the curve, or if the signature does not verify.
- There is no low-
srequirement, so signatures are malleable:(r, s)and(r, n − s)both verify. Do not use the signature bytes as a unique identifier. - Gas is charged in full either way.
Notes
- P-256 is a classical curve. It is broken by a cryptographically relevant quantum computer exactly as secp256k1 is — it is here for compatibility with WebAuthn and platform keystores, not for post-quantum security. For that, use
0x14or0x15.
Calling it
Precompiles have no ABI and no function selector: the input is raw bytes at the exact offsets above. Call with staticcall.
// P256VERIFY at 0x0100(bool ok, bytes memory out) = address(0x0100).staticcall(input);require(ok, "P256VERIFY reverted");Specification
- EIP-7951: Precompile for secp256r1 curve support