CSR signature using elliptic curve We've been asked to generate a certificate signing request using elliptic curve and we can't use any third-party library as it's an embedded application with very limited resources).

We are used to generating CSR using RSA, but we can't find any documentation on how to do that with an elliptic curve; specifically, which data to use for the signing part. Studying OpenSSL-generated CSR it looks like there are multiple signatures generated, or a hash of some kind, but we don't know. And OpenSSL source code is quite difficult to read when you're not used to it.

Can anyone point us in the right direction?
It should be pretty much the same. If you can sign a CSR with RSA you can sign with ECC. The exact same data is signed, what changes is:


The signature algorithm should be the right OID (e.g. ecdsaWithSHA256)
The signature value must be the ECDSA signature encoded as specified in SEC (i.e. an ASN.1 sequence of the two integers in the signature)
The public key value must a SubjectPublicKeyInfo structure with values specified in RFC5480: the algorithm field is an AlgorithmIdentifier whose algorithm field is the OID id-ecPublicKey and whose parameters field is the OID of the curve used. Finally, the subjectPublicKey field in SubjectPublicKeyInfo is the public key encoded as specified by SEC section 2.3.3.