P256 Precompile

Address: 0x0000000000000000000000000000000000001011 This is the implementation of RIP-7212, which provides a precompiled contract for verifying signatures in the secp256r1 or P-256 elliptic curve.

Overview

The P256 precompile enables efficient signature verification for the secp256r1 curve, which is widely used in modern security systems including:

Apple’s Secure Enclave
WebAuthn/FIDO2
Android Keychain
Various hardware security modules (HSMs)
PassKeys

This precompile implementation is significantly more gas efficient (up to 60x) compared to Solidity-based implementations.

Interface

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

address constant P256VERIFY_PRECOMPILE_ADDRESS = 0x0000000000000000000000000000000000001011;

IP256VERIFY constant P256VERIFY_CONTRACT = IP256VERIFY(P256VERIFY_PRECOMPILE_ADDRESS);

interface IP256VERIFY {
    function verify(
        bytes memory signature
    ) external view returns (bytes memory response);
}

Implementation Library

Here’s a complete implementation of the P256 library that provides a convenient wrapper around the precompile:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.23;

import "./ECDSA.sol";
import "./P256Verify.sol";

/// @title P256
/// @author klkvr <https://github.com/klkvr>
/// @author jxom <https://github.com/jxom>
/// @notice Wrapper function to abstract low level details of call to the P256
///         signature verification precompile as defined in EIP-7212, see
///         <https://eips.ethereum.org/EIPS/eip-7212>.
library P256 {
    /// @notice P256VERIFY operation
    /// @param digest 32 bytes of the signed data hash
    /// @param signature Signature of the signer
    /// @param publicKey Public key of the signer
    /// @return success Represents if the operation was successful
    function verify(bytes32 digest, ECDSA.Signature memory signature, ECDSA.PublicKey memory publicKey)
        internal
        view
        returns (bool)
    {
        bytes memory input = abi.encode(digest, signature.r, signature.s, publicKey.x, publicKey.y);
        bytes memory output = P256VERIFY_CONTRACT.verify(input);
        bool success = output.length == 32 && output[31] == 0x01;

        return success;
    }
}

Basic Usage

Using the P256 Library

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.23;

import "./P256.sol";
import "./ECDSA.sol";

contract P256Example {
    using P256 for bytes32;

    function verifySignature(
        bytes32 messageHash,
        ECDSA.Signature memory signature,
        ECDSA.PublicKey memory publicKey
    ) public view returns (bool) {
        return P256.verify(messageHash, signature, publicKey);
    }
}

Direct Precompile Usage

For more control, you can call the precompile directly:

pragma solidity ^0.8.0;

interface IP256Verify {
    function verify(bytes calldata input) external view returns (bytes32);
}

contract P256Verifier {
    IP256Verify constant P256_PRECOMPILE = IP256Verify(0x0000000000000000000000000000000000001011);

    function verifySignature(
        bytes32 messageHash,
        bytes32 r,
        bytes32 s,
        bytes32 publicKeyX,
        bytes32 publicKeyY
    ) external view returns (bool) {
        bytes memory input = abi.encodePacked(
            messageHash,
            r,
            s,
            publicKeyX,
            publicKeyY
        );

        bytes32 result = P256_PRECOMPILE.verify(input);
        return result != bytes32(0);
    }
}

Signature Format

The signature verification requires the following components:

digest: 32 bytes of the signed data hash
signature: Contains the r and s components of the signature
publicKey: Contains the x and y coordinates of the public key

The precompile expects these components to be encoded in a specific format:

First 32 bytes: message hash
Next 32 bytes: r component of the signature
Next 32 bytes: s component of the signature
Next 32 bytes: x coordinate of the public key
Next 32 bytes: y coordinate of the public key

Total length: 160 bytes

Gas Costs

The precompile is highly gas efficient compared to Solidity implementations. The exact gas cost per byte of verified data is set to GasCostPerByte = 300, which gives us:

Total Cost: 300 × 160 = 48,000 gas per verification
Efficiency: Up to 60x more efficient than pure Solidity implementations

Real-World Use Cases

WebAuthn/PassKeys Authentication

pragma solidity ^0.8.0;

contract WebAuthnAuth {
    IP256Verify constant P256_PRECOMPILE = IP256Verify(0x0000000000000000000000000000000000001011);

    struct PublicKey {
        bytes32 x;
        bytes32 y;
    }

    mapping(address => PublicKey) public userKeys;

    function registerPasskey(
        bytes32 keyX,
        bytes32 keyY
    ) external {
        userKeys[msg.sender] = PublicKey(keyX, keyY);
    }

    function authenticateWithPasskey(
        bytes32 challengeHash,
        bytes32 r,
        bytes32 s
    ) external view returns (bool) {
        PublicKey memory userKey = userKeys[msg.sender];
        require(userKey.x != 0 && userKey.y != 0, "No passkey registered");

        bytes memory input = abi.encodePacked(
            challengeHash,
            r,
            s,
            userKey.x,
            userKey.y
        );

        bytes32 result = P256_PRECOMPILE.verify(input);
        return result != bytes32(0);
    }
}

Apple Secure Enclave Integration

contract SecureEnclaveAuth {
    event SecureOperation(address indexed user, bytes32 indexed operationHash);

    function executeSecureOperation(
        bytes32 operationHash,
        bytes32 r,
        bytes32 s,
        bytes32 enclaveKeyX,
        bytes32 enclaveKeyY
    ) external {
        require(
            verifyEnclaveSignature(operationHash, r, s, enclaveKeyX, enclaveKeyY),
            "Invalid Secure Enclave signature"
        );

        emit SecureOperation(msg.sender, operationHash);
    }

    function verifyEnclaveSignature(
        bytes32 hash,
        bytes32 r,
        bytes32 s,
        bytes32 x,
        bytes32 y
    ) internal view returns (bool) {
        bytes memory input = abi.encodePacked(hash, r, s, x, y);
        bytes32 result = P256_PRECOMPILE.verify(input);
        return result != bytes32(0);
    }
}

Multi-Signature with Hardware Keys

contract HardwareMultiSig {
    IP256Verify constant P256_PRECOMPILE = IP256Verify(0x0000000000000000000000000000000000001011);

    struct Signature {
        bytes32 r;
        bytes32 s;
    }

    struct PublicKey {
        bytes32 x;
        bytes32 y;
    }

    function verifyMultipleHardwareKeys(
        bytes32 messageHash,
        Signature[] calldata signatures,
        PublicKey[] calldata publicKeys,
        uint256 threshold
    ) external view returns (bool) {
        require(signatures.length == publicKeys.length, "Mismatched arrays");
        require(threshold <= signatures.length, "Invalid threshold");

        uint256 validSignatures = 0;

        for (uint i = 0; i < signatures.length; i++) {
            bytes memory input = abi.encodePacked(
                messageHash,
                signatures[i].r,
                signatures[i].s,
                publicKeys[i].x,
                publicKeys[i].y
            );

            bytes32 result = P256_PRECOMPILE.verify(input);
            if (result != bytes32(0)) {
                validSignatures++;
            }
        }

        return validSignatures >= threshold;
    }
}

Security Considerations

Important: Always validate public keys and signature components before verification to prevent invalid curve point attacks.

Public Key Validation

function isValidPublicKey(bytes32 x, bytes32 y) internal pure returns (bool) {
    // Ensure point is not at infinity
    if (x == 0 && y == 0) return false;

    // Additional validation should be performed for production use
    // The precompile will reject invalid curve points
    return true;
}

Signature Malleability

P256 signatures can be malleable. If your application requires unique signatures, implement additional checks:

function isLowS(bytes32 s) internal pure returns (bool) {
    // Check if s is in the lower half of the curve order
    // This prevents signature malleability
    return uint256(s) <= 0x7FFFFFFF80000000FFFFFFFFFFFFFFFF;
}

JavaScript Integration

Preparing Input Data

// Example: Preparing P256 verification input
function prepareP256Input(messageHash, signature, publicKey) {
  // Ensure all components are 32 bytes
  const hash = ethers.utils.hexZeroPad(messageHash, 32);
  const r = ethers.utils.hexZeroPad(signature.r, 32);
  const s = ethers.utils.hexZeroPad(signature.s, 32);
  const x = ethers.utils.hexZeroPad(publicKey.x, 32);
  const y = ethers.utils.hexZeroPad(publicKey.y, 32);

  // Concatenate all components
  return ethers.utils.concat([hash, r, s, x, y]);
}

// Usage with ethers.js
async function verifyP256Signature(contract, messageHash, signature, publicKey) {
  const input = prepareP256Input(messageHash, signature, publicKey);
  const result = await contract.P256_PRECOMPILE.verify(input);
  return result !== '0x0000000000000000000000000000000000000000000000000000000000000000';
}

Error Handling

The P256 precompile returns zero on failure. Common failure cases include:

Invalid Input Length: Input must be exactly 160 bytes
Invalid Public Key: Point not on the P256 curve
Invalid Signature: r or s values out of valid range
Verification Failure: Signature doesn’t match message and public key

function safeVerifyP256(
    bytes32 messageHash,
    bytes32 r,
    bytes32 s,
    bytes32 publicKeyX,
    bytes32 publicKeyY
) internal view returns (bool success, string memory error) {
    // Validate inputs
    if (!isValidPublicKey(publicKeyX, publicKeyY)) {
        return (false, "Invalid public key");
    }

    if (r == 0 || s == 0) {
        return (false, "Invalid signature components");
    }

    // Prepare input and verify
    bytes memory input = abi.encodePacked(
        messageHash, r, s, publicKeyX, publicKeyY
    );

    bytes32 result = P256_PRECOMPILE.verify(input);
    return (result != bytes32(0), result == bytes32(0) ? "Verification failed" : "");
}

Testing

Unit Tests

contract P256Test {
    IP256Verify constant P256_PRECOMPILE = IP256Verify(0x0000000000000000000000000000000000001011);

    function testValidSignature() public {
        // Test with known valid P256 signature
        bytes32 messageHash = 0x1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef;
        // Use actual test vectors for production tests
        bytes32 r = 0x...; // Valid r component
        bytes32 s = 0x...; // Valid s component
        bytes32 x = 0x...; // Valid public key x
        bytes32 y = 0x...; // Valid public key y

        bytes memory input = abi.encodePacked(messageHash, r, s, x, y);
        bytes32 result = P256_PRECOMPILE.verify(input);

        assert(result != bytes32(0));
    }
}

Performance Considerations

Gas Efficiency: 48,000 gas per verification vs 2M+ gas for Solidity implementations
Batch Operations: Consider batching multiple verifications in a single transaction
Caching: Cache public keys on-chain to reduce calldata for repeated verifications
Hardware Integration: Particularly efficient for applications using hardware-backed keys

For more information about the P256 precompile implementation, visit the Sei Chain repository.

Overview

Essentials

seid CLI

Frontend Development

Smart Contracts

sei-js Library

Videos

Ecosystem Tutorials

Reference

Hardware Wallets

Overview

Interface

Implementation Library

Basic Usage

Using the P256 Library

Direct Precompile Usage

Signature Format

Gas Costs

Real-World Use Cases

WebAuthn/PassKeys Authentication

Apple Secure Enclave Integration

Multi-Signature with Hardware Keys

Security Considerations

Public Key Validation

Signature Malleability

JavaScript Integration

Preparing Input Data

Error Handling

Testing

Unit Tests

Performance Considerations

Overview

Essentials

seid CLI

Frontend Development

Smart Contracts

sei-js Library

Videos

Ecosystem Tutorials

Reference

Hardware Wallets

Documentation Index

​Overview

​Interface

​Implementation Library

​Basic Usage

​Using the P256 Library

​Direct Precompile Usage

​Signature Format

​Gas Costs

​Real-World Use Cases

​WebAuthn/PassKeys Authentication

​Apple Secure Enclave Integration

​Multi-Signature with Hardware Keys

​Security Considerations

​Public Key Validation

​Signature Malleability

​JavaScript Integration

​Preparing Input Data

​Error Handling

​Testing

​Unit Tests

​Performance Considerations

Overview

Interface

Implementation Library

Basic Usage

Using the P256 Library

Direct Precompile Usage

Signature Format

Gas Costs

Real-World Use Cases

WebAuthn/PassKeys Authentication

Apple Secure Enclave Integration

Multi-Signature with Hardware Keys

Security Considerations

Public Key Validation

Signature Malleability

JavaScript Integration

Preparing Input Data

Error Handling

Testing

Unit Tests

Performance Considerations