ES512: ECDSA with P-521 and SHA-512 in a JWT
ES512 signs with an elliptic curve key on P-521 using SHA-512. The name says 512 and the curve is 521 bits, which is the single most common misunderstanding about JOSE algorithm names.
At a glance
- Algorithm
- ES512, ECDSA using P-521 and SHA-512
- Registered in
- RFC 7518 section 3.4
- Implementation requirement
- Optional
- Key
- Elliptic curve key pair on P-521, also known as secp521r1. There is no P-512.
- Signature size
- 132 bytes, R and S at 66 bytes each, 176 base64url characters
- Verified in the decoder
- Yes, in your browser, with a PEM public key. The tool selects P-521 for this algorithm.
In detail
The algorithm name follows the hash, SHA-512, while the curve it is paired with is P-521. That curve uses a Mersenne prime, two to the power of 521 minus one, chosen because arithmetic modulo it is unusually efficient. There is no such thing as a P-512 curve, so a configuration or a document that names one is describing something that does not exist.
Those nine extra bits have a visible effect. A 521 bit value needs 66 bytes to hold, since 521 divided by eight rounds up, and R and S are each padded to that full width. The signature is therefore 132 bytes and 176 base64url characters, which makes ES512 the largest of the three ECDSA options and still smaller than any RSA signature on a compliant key.
That rounding is where implementations go wrong. Code written against P-256 assumptions sometimes computes the component width from the byte length of the value rather than from the curve, and a leading zero byte then disappears, producing a 131 byte signature that fails verification intermittently, only for the keys and signatures where the high byte happens to be zero. Intermittent is the worst kind of cryptographic bug to chase.
The decoder verifies ES512 in your browser with a PEM public key and uses P-521, since the algorithm name determines the curve. When a signature fails here with a key you trust, count the characters in the third part: 176 is correct, and anything shorter points at the padding bug rather than at a genuine forgery.
Examples
521 bits / 8 = 65.125, rounded up to 66 bytes per component
R: 66 bytes (left padded with zeros)
S: 66 bytes (left padded with zeros)
signature = R || S = 132 bytes = 176 base64url charactersThings that catch people out
- Looking for a P-512 curve in a key generation command. The curve is secp521r1, and no P-512 exists.
- Computing component width from the value instead of the curve. Dropping a leading zero gives a 131 byte signature that fails only sometimes.
- Assuming broad support. ES512 is optional in RFC 7518 and is the least implemented of the three ECDSA variants.
Try it: JWT Decoder
Paste a token to decode the header and payload, read the claims and expiry, and verify the signature in your browser. Nothing is uploaded.
JWT Decoder
LOCAL · Browser-OnlyDecode and inspect JSON Web Tokens without sending them to a server
Related JWT claims and algorithms
All jwt claims and algorithms →ES256: ECDSA with P-256 and SHA-256 in a JWT
ES256 signs a JWT with ECDSA on curve P-256 using SHA-256. Signature format, why raw R and S beats DER here, and verifying with a public key.
ES384: ECDSA with P-384 and SHA-384 in a JWT
ES384 signs a JWT with ECDSA on curve P-384 using SHA-384. Signature length, where the curve is mandated, and verification in your browser.
RS512: RSASSA-PKCS1-v1_5 with SHA-512 in a JWT
RS512 signs a JWT with RSA and SHA-512. Why the signature length follows the key rather than the hash, and what the decoder needs to verify one.
EdDSA: Edwards-curve Signatures in a JWT
EdDSA signs a JWT with Ed25519 or Ed448 under the OKP key type. What RFC 8037 defines, why it is deterministic, and why the decoder cannot verify it.
none: The Unsecured JWT Algorithm
The none algorithm means a JWT carries no signature at all. How the alg none attack works, what to configure, and how the decoder handles such a token.
alg (Algorithm) Header Parameter in a JWT
The alg header names the algorithm used to sign a JWT. Why the accepted algorithms belong in configuration, and what the decoder does with the value.
Tools for this
- JWT Decoder Free online JWT decoder - decode and inspect JSON Web Tokens without sending them to a server