Photo by Romain Dancre on Unsplash

Oh, Google Tink, Private Key IDs and Signatures

I have been investigating ECDSA signatures and the DER format. Overall, in hex format, I always found that the DER signature starts with a “30” — to identify SEQUENCE — and then followed by two integers: r and s. But, when I was updating my Google Java Tink code I found this as a signature [here]:

Signature generator
Text: hello
Type: ECDSA_P256
Sig (Base64): ASZfrgQwRAIgZ7zQ37QHqqMjPMxObgq/58taZWSTrbXUkkyEoamBexICICCACK4t/8ooWS1HhT9BXQpaE6yH70zVDZe0x63O4DEw
Sig (Hex): 01265FAE043044022067BCD0DFB407AAA3233CCC4E6E0ABFE7CB5A656493ADB5D4924C84A1A9817B120220208008AE2DFFCA28592D47853F415D0A5A13AC87EF4CD50D97B4C7ADCEE03130
Valid Signature
Printing out key:
{
    "primaryKeyId": 643804676,
    "key": [{
        "keyData": {
            "typeUrl": "type.googleapis.com/google.crypto.tink.EcdsaPrivateKey",
            "keyMaterialType": "ASYMMETRIC_PRIVATE",
            "value": "EkwSBggDEAIYAhogSxH0Ta+brkGS9KTFyqM1i+nn05ukrs4IJZk3OcSNGAsiIAZ+ijm1cI/55L/Ldx0p8+Vo92y5XjMtPqLobyR96tlwGiBtCNp1QkmBTqqW1uiopnQUP2h+SqoEaD31SFBc2YNpFQ=="
        },
        "outputPrefixType": "TINK",
        "keyId": 643804676,
        "status": "ENABLED"
    }]
}

Everything seemed to be fine, and where I could validate the signature. But I was scratching my head trying to understand the…