[Feat] Introduce ECDSA verification opcodes #2913

raychu86 · 2025-09-03T17:29:05Z

Motivation

This PR introduces native ECDSA signature verification to on-chain (finalize) execution to improve interoperability and broaden supported signature formats. With on-chain verification, programs can trust externally signed messages and approvals without off-chain helpers, enabling cross-chain messaging, asset flows, multisig/governance, etc. The initial scope focuses on verification with a simple canonical representation and deterministic, consensus-safe behavior, while leaving room to add other schemes and encodings over time.

The list of new ecdsa.verify.<variant> instructions are as follows:

ecdsa.verify.keccak256
ecdsa.verify.keccak256.raw
ecdsa.verify.keccak256.eth
ecdsa.verify.keccak384
ecdsa.verify.keccak384.raw
ecdsa.verify.keccak384.eth
ecdsa.verify.keccak512
ecdsa.verify.keccak512.raw
ecdsa.verify.keccak512.eth
ecdsa.verify.sha3_256
ecdsa.verify.sha3_256.raw
ecdsa.verify.sha3_256.eth
ecdsa.verify.sha3_384
ecdsa.verify.sha3_384.raw
ecdsa.verify.sha3_384.eth
ecdsa.verify.sha3_512
ecdsa.verify.sha3_512.raw
ecdsa.verify.sha3_512.eth

The variant types allow the users to select the underlying hash function used, the serialization type (with .raw), and if the address being verified is a 20-byte Ethereum address. The .raw variants indicate if the message should be serialized in it's raw bit form or with Aleo specific variant bits; this is necessary to ensure compatibility with external signing libraries. By default the .eth variants will serialize the message in it's raw form, so there is no need for an additional .eth.raw suffixed variant.

A few additional features are also included:

.raw serialization variants
- All existing hash opcodes will now have a new variant by appending .raw to the end.
- sign.verify.raw is also introduced to
- This performs the hash on the raw serialization of the pre-image that does not contain any Aleo specific variant bits
Increasing array size from 32 to 256.

Test Plan

Local Devnet

TODO

Add additional integration tests
Add input type checks for the ECDSA opcode operands
Add array size increase checks for pre-V11 programs
Perform stress testing for the array size increase

Questions for Auditors

Is the removal of the terminator bit in the ToFieldsRaw implementation safe?

…feat/ecdsa

Signed-off-by: Raymond Chu <14917648+raychu86@users.noreply.github.com>

vicsn

Looks excellent, from my humble perspective. 🎆

Can you update the docstring for ConsensusVersion::V11?

vicsn · 2025-09-07T11:17:20Z

circuit/environment/src/traits/to_bits.rs

 }

+/// Unary operator for converting to raw bits.
+pub trait ToBitsRaw: ToBits {


Inactionable rant: long term it might make more sense to have trait ToBits: ToBitsRaw, as I understand that to_bits serialization could call to_bits_raw internally. But then again, we don't want to enable raw serialization for all types, so I guess the current approach is fine and helpful.

circuit/program/src/data/plaintext/to_bits_raw.rs

vicsn · 2025-09-07T11:57:15Z

circuit/environment/src/traits/to_bits.rs

+    #[inline]
+    fn write_bits_raw_le(&self, vec: &mut Vec<Self::Boolean>) {
+        // The slice is order-preserving, meaning the first circuit in is the first circuit bits out.
+        for elem in self.iter() {


Note: the element-wise little endian serialization is bound to lead to confusion so we should really document this well on the SDK sode.

If you agree, do you want to note this explicitly in the PR description so it'll make its way into the release notes?

CC @Roee-87 just FYI

console/algorithms/src/ecdsa/mod.rs

vicsn · 2025-09-07T20:38:58Z

synthesizer/program/src/logic/instruction/operation/hash.rs

            (16, _) => bail!("'hash_many.psd4' is not yet implemented"),
            (17, _) => bail!("'hash_many.psd8' is not yet implemented"),
-            (18.., _) => bail!("Invalid 'hash' variant: {}", $variant),
+            (18, _) => $q($N::hash_to_group_bhp256(&bits_raw()))?.into(),


Double checking: are we sure we don't have to guard this by Address | Group like we do for some other match arms? (Meaning the previous code would have a bug)

hash_to_group* for the BHP and Pedersen variants is the uncompressed version. If you look at their corresponding hash.* (without to_group), you'll see that it calls the uncompressed hash and then casts it to a field.

We guard for Poseidon because its standard version outputs a field. hash_to_group_psd encodes with Elligator. I could not tell you what security properties this affords.

vicsn · 2025-09-08T10:38:50Z

console/algorithms/src/ecdsa/tests.rs

+}
+
+#[test]
+fn test_ecdsa_signature_vector_1() {


Is there any canonical set of test vectors which we can use, for ECDSA and/or Ethereum's usage?

Still waiting on test vectors from partners, however we should pull in any standard library of ECDSA test vectors if they are available.

vicsn · 2025-09-08T10:41:51Z

console/program/src/data/plaintext/mod.rs

-    31, 32
-);
+// Implement for `[U8<N>, SIZE]` for sizes 1 through 256.
+seq_macro::seq!(S in 1..=256 {


That's a lot of code generation. Which will increase even more if we have a larger array size. The use of seq! feels like an antipattern here, albeit a pretty one.

What about we have just a single impl<N: Network> From<impl Iterator<Item = $element<N>>> for Plaintext<N>? To not have to think about differing guarantees we could ensure we don't surpass the maximum array length in there.

You could also use ExactSizeIterator

console/program/src/data/plaintext/to_fields_raw.rs

console/program/src/data_types/plaintext_type/mod.rs

synthesizer/src/vm/verify.rs

Signed-off-by: Raymond Chu <14917648+raychu86@users.noreply.github.com>

vicsn · 2025-09-25T09:52:28Z

synthesizer/program/src/lib.rs

+
+    /// Returns `true` if the program contains an array type with a size that exceeds the given maximum.
+    pub fn exceeds_max_array_size(&self, max_array_size: u32) -> bool {
+        self.mappings.values().any(|mapping| mapping.exceeds_max_array_size(max_array_size))


Can mapping keys also be arrays? MapKey contains a generic PlaintextType so maybe we should just check.

I believe that is already checked here: https://github.com/ProvableHQ/snarkVM/blob/feat/ecdsa/synthesizer/program/src/mapping/mod.rs#L59

d0cd · 2025-09-25T04:32:24Z

synthesizer/src/vm/verify.rs

+
+    #[cfg(feature = "test")]
+    #[test]
+    fn test_ecdsa_migration() {


I'm a proponent of these sorts of tests going in a test_v* file. It helps us easily look back on our test coverage for each consensus version.

raychu86 added 23 commits August 15, 2025 14:56

Add initial ecdsa.verify structure

276edb8

Add ECSDA instruction and costs

ee45de5

Implement ToBitsRaw for Plaintext and Value

e34b03c

Implement ToFieldsRaw for Plaintext and Value

0e3e9c1

Implement raw variants for hash instructions

1bbb670

Use proper variants for ecdsa.verify

81d765c

Implement raw variant for sign.verify

26f6b08

Add tests for raw hash opcodes

ad61b95

Implement console ecdsa sign and verify

72a59b3

Merge branch 'staging' of https://github.com/ProvableHQ/snarkVM into …

72091ac

…feat/ecdsa

Increase max array size to 256

2f7b13f

Add consensus check for new opcodes

77aee72

Implement ecdsa verification opcode

9607cc0

Implement ecdsa verification opcode for ETH

952c6bd

implement opcode check

0f4e41b

Merge branch 'staging' of https://github.com/ProvableHQ/snarkVM into …

a3b56dc

…feat/ecdsa

Fix ToBitsRaw

70790d4

Add ECDSA operand checks and tests

fa65b01

Remove eth.raw variant

11a78cc

Add ecdsa V11 migration tests

53f7882

Implmeent check for exceeding max array size

90fb757

Fix test

7221818

Update number of opcodes

604c19b

raychu86 changed the title ~~[WIP] [Feat] Introduce ECDSA verification opcodes~~ [Feat] Introduce ECDSA verification opcodes Sep 5, 2025

Merge branch 'staging' into feat/ecdsa

87646d3

Signed-off-by: Raymond Chu <14917648+raychu86@users.noreply.github.com>

raychu86 marked this pull request as ready for review September 5, 2025 23:08

vicsn reviewed Sep 8, 2025

View reviewed changes

d0cd added 3 commits September 10, 2025 15:07

Derive traits

6bf32e2

Add public method for the Leo interpreter

f80871e

Refactor out evaluate_schnorr_verification

5ca8320

raychu86 and others added 11 commits September 11, 2025 11:28

nit: reduce allocation

9fe20ae

Documentation and const nits

7752b68

Add closures to v11 checks

df71f32

Remove terminator bit

5c9fea4

Fix test comments

edc7413

Add documentation to ConsensusVersion::V11

5e0f983

Merge branch 'staging' into feat/ecdsa

0e0c11e

Signed-off-by: Raymond Chu <14917648+raychu86@users.noreply.github.com>

Refactor opcodes for reuse

ca9b47e

Change visibility

d3f6c36

Add benchmarks

e07a190

Adjust ecdsa pricing based on benchmarks

6a2b371

raychu86 requested review from Roee-87 and d0cd September 12, 2025 23:12

raychu86 added 3 commits September 15, 2025 13:05

Add support for ecdsa.verify.digest variants

b548c4e

Add recoveryID flexibility

edf4d7a

Update num expected opcodes

e27da59

vicsn reviewed Sep 25, 2025

View reviewed changes

d0cd reviewed Sep 25, 2025

View reviewed changes

d0cd mentioned this pull request Sep 26, 2025

[Feature] ECDSA + Bytes #2938

Merged

d0cd mentioned this pull request Oct 14, 2025

[Feature] ECDSA and bit operations. #2939

Merged

vicsn closed this pull request by merging all changes into staging in b1dde7d Oct 14, 2025

vicsn deleted the feat/ecdsa branch October 14, 2025 19:53

d0cd mentioned this pull request Oct 15, 2025

[Test] Additional tests for ECDSA and bit operations. #2961

Open

[Feat] Introduce ECDSA verification opcodes #2913

[Feat] Introduce ECDSA verification opcodes #2913

Uh oh!

Conversation

raychu86 commented Sep 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Test Plan

TODO

Questions for Auditors

Uh oh!

vicsn left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

d0cd Sep 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

raychu86 commented Sep 3, 2025 •

edited

Loading

d0cd Sep 25, 2025 •

edited

Loading