How to fix Error: ECDSA signature verification failed (signature invalid) in Node.js

const crypto = require('crypto');

// Signing
const { privateKey, publicKey } = crypto.generateKeyPairSync('ec', {
  namedCurve: 'prime256v1' // Also known as P-256 or secp256r1
});

const sign = crypto.createSign('SHA256');
sign.update('data to sign');
const signature = sign.sign(privateKey);

// Verification - must use same curve and algorithm
const verify = crypto.createVerify('SHA256');
verify.update('data to sign');
const isValid = verify.verify(publicKey, signature);
console.log('Signature valid:', isValid);

const crypto = require('crypto');

// Option 1: DER encoding (default)
const signDER = crypto.createSign('SHA256');
signDER.update('data');
const derSignature = signDER.sign({
  key: privateKey,
  dsaEncoding: 'der' // Default
});

// Option 2: IEEE-P1363 encoding (r || s format)
const signIEEE = crypto.createSign('SHA256');
signIEEE.update('data');
const ieeeSignature = signIEEE.sign({
  key: privateKey,
  dsaEncoding: 'ieee-p1363'
});

// Verification must match encoding
const verify = crypto.createVerify('SHA256');
verify.update('data');
const isValid = verify.verify({
  key: publicKey,
  dsaEncoding: 'der' // Must match signing encoding
}, derSignature);

const jwt = require('jsonwebtoken');
const fs = require('fs');

// Generate EC key pair for ES256
const { generateKeyPairSync } = require('crypto');
const { privateKey, publicKey } = generateKeyPairSync('ec', {
  namedCurve: 'prime256v1', // P-256 for ES256
  publicKeyEncoding: { type: 'spki', format: 'pem' },
  privateKeyEncoding: { type: 'pkcs8', format: 'pem' }
});

// Sign with ES256
const token = jwt.sign({ data: 'payload' }, privateKey, {
  algorithm: 'ES256'
});

// Verify with matching algorithm
try {
  const decoded = jwt.verify(token, publicKey, {
    algorithms: ['ES256'] // Must include the algorithm used to sign
  });
  console.log('Token valid:', decoded);
} catch (err) {
  console.error('Verification failed:', err.message);
}

const crypto = require('crypto');

const data = 'critical data';

// Sign
const sign = crypto.createSign('SHA256');
sign.update(data); // Data as string
const signature = sign.sign(privateKey);

// INCORRECT - different encoding
const verify1 = crypto.createVerify('SHA256');
verify1.update(Buffer.from(data, 'utf8')); // Explicitly encoded
console.log('Valid:', verify1.verify(publicKey, signature)); // May fail

// CORRECT - same format
const verify2 = crypto.createVerify('SHA256');
verify2.update(data); // Same as signing
console.log('Valid:', verify2.verify(publicKey, signature)); // Should work

// For complex objects, normalize before signing/verifying
function normalizeData(obj) {
  return JSON.stringify(obj, Object.keys(obj).sort());
}

const payload = { b: 2, a: 1 };
const normalized = normalizeData(payload);
// Sign and verify using normalized string

# Update to latest versions
npm update jsonwebtoken
npm update elliptic
npm update jsrsasign

# Or specify versions with known fixes
npm install elliptic@^6.5.8
npm install jsonwebtoken@^9.0.0

const crypto = require('crypto');

function inspectSignature(signature) {
  // For IEEE-P1363 format (r || s)
  const len = signature.length / 2;
  const r = signature.slice(0, len);
  const s = signature.slice(len);

  console.log('Signature length:', signature.length);
  console.log('r component:', r.toString('hex'));
  console.log('s component:', s.toString('hex'));

  // Check for valid ranges
  console.log('r is zero:', r.every(b => b === 0));
  console.log('s is zero:', s.every(b => b === 0));
}

// Test your signature
inspectSignature(signature);

// For DER format, use ASN.1 parser
const asn1 = require('asn1.js');
const ECSignature = asn1.define('ECSignature', function() {
  this.seq().obj(
    this.key('r').int(),
    this.key('s').int()
  );
});

try {
  const decoded = ECSignature.decode(signature, 'der');
  console.log('DER r:', decoded.r.toString(16));
  console.log('DER s:', decoded.s.toString(16));
} catch (err) {
  console.error('Not valid DER format:', err.message);
}