public final class Secp256k1

ECDSA over the secp256k1 curve, the signature scheme of Bitcoin and Ethereum, written in portable Java so a wallet can sign on the device and a server can verify or sign with the same class.

Keys are raw bytes: a private key is 32 big-endian bytes in [1, n-1], a public key is the SEC 1 encoding of the point, either compressed (33 bytes, 02/03 then x) or uncompressed (65 bytes, 04 then x then y). Every method accepts a public key in either form.

Signing an Ethereum transaction

byte[] priv = Hash.fromHex("4c0883a69102937d6231471b5dbb6204fe5129617082792ae468d01a3f362318");

// the address is the last 20 bytes of keccak256(x || y)
byte[] pub = Secp256k1.publicKey(priv, false);          // 04 || x || y
byte[] xy = new byte[64];
System.arraycopy(pub, 1, xy, 0, 64);
byte[] digest = Hash.keccak256(xy);
byte[] address = new byte[20];
System.arraycopy(digest, 12, address, 0, 20);           // 2c7536e3605d9c16a7a3d7b1898e529396a65c23

// sign the keccak256 of the RLP-encoded transaction
byte[] rlp = Hash.fromHex("02c0");                       // your encoded transaction
Secp256k1.EcdsaSignature sig = Secp256k1.sign(Hash.keccak256(rlp), priv);
byte[] r = sig.r();
byte[] s = sig.s();
int v = 27 + sig.recoveryId();                           // or chainId * 2 + 35 + recoveryId

Signatures are deterministic (RFC 6979, HMAC-SHA256) and always low-S, as Bitcoin’s standardness rules and Ethereum’s EIP-2 require, and they carry the recovery id Ethereum derives the signer’s address from. verify rejects a high-S signature the way libsecp256k1 does; recoverPublicKey accepts either, the way the EVM’s ecrecover does. A signature from another library can be lowered with EcdsaSignature.normalize.

Constant time

Everything that touches a private key or a nonce – key derivation, signing, the tweak used by BIP32 derivation – runs in constant time: the field and scalar arithmetic uses fixed 16-bit limbs with no data-dependent branches, the curve arithmetic uses complete addition formulas that have no special case for doubling or the point at infinity, and the scalar multiplication is a fixed-window ladder whose table lookup reads every entry. Verification and recovery handle public data only and share the same code. The implementation is independent of libsecp256k1 and depends on nothing but this package and the core JDK subset, so it runs identically on every port and on the backend.