---
product: Chilkat
product_version: 11.7.0
language: pascal
language_label: Lazarus Pascal
class: Ecc
license: bundle
deprecated: false
reference_html: https://www.chilkatsoft.com/refdoc/pascal_EccRef.html
---
# Chilkat Ecc — Lazarus Pascal — v11.7.0

> Chilkat 11.7.0 · language=pascal · class=Ecc
> Other versions: replace `11.7.0` in this URL. Other languages: `https://www.chilkatsoft.com/ai-docs/v/11.7.0/<lang>/classes/Ecc.md`.
> Language-wide rules (install, unlock, error model, strings/bytes): `https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/guide.md`.

## Purpose

**Generate EC keys, create ECDSA signatures, verify signatures, and compute shared secrets.**

`Chilkat.Ecc` is the Chilkat class for direct elliptic-curve cryptographic operations. It can generate EC private keys, sign hashes or data using ECDSA, verify ECDSA signatures, sign through ECDSA certificates, and compute encoded shared secrets from compatible EC key pairs. It is used when an application needs explicit control over elliptic-curve keys, signatures, signature encoding, or key-agreement output.

**Generate EC private keys**

Create elliptic-curve private keys for supported curves and use the resulting key with Chilkat signing, verification, or key-agreement APIs.

**ECDSA signing**

Sign hashes or input data using an EC private key, producing ECDSA signatures in the configured output format.

**ECDSA verification**

Verify ECDSA signatures using the matching EC public key and the original hash or data.

**Certificate-based signing**

Sign with an ECDSA certificate when the certificate has access to its associated private key.

**Shared-secret calculation**

Compute an encoded shared secret from compatible EC private and public keys for key-agreement workflows.

**Signature format control**

Use `AsnFormat` to control whether ECDSA signatures are encoded as ASN.1/DER or as raw `r || s` values.

**Common pattern:** Generate or load an EC key, choose the required signature format with `AsnFormat`, then sign or verify using the method that matches the input form: hash, data, key, or certificate. For shared-secret workflows, compute the ECDH-style secret and pass the result through the key derivation or encoding step required by the protocol.

For an extended overview, see [Ecc Class Overview](https://www.chilkatsoft.com/ecc_class_overview.asp).

## Object creation, unlocking and error handling

**Create / Free**

```pascal
uses
  Chilkat.Ecc;

var
  obj: TEcc;
begin
  obj := TEcc.Create;
  try
    if not obj.IsValid then
      raise Exception.Create('Failed to create a TEcc instance.');

    // ... use obj ...

  finally
    obj.Free;
  end;
end;
```

`constructor Create;`

Allocates the underlying CkEcc object and returns a new TEcc instance. Simply adding **Chilkat.Ecc** to the unit's `uses` clause is enough to locate and bind to the Chilkat shared library (DLL / .so / .dylib) at runtime — no separate load step is required. Check `obj.IsValid` after calling `Create`; it is `False` if the underlying library could not be found/loaded or the object could not be allocated (for example, when unlicensed).

`destructor Destroy; override;`

Every TEcc created by calling `Create` should eventually be released by calling `.Free` (inherited from `TObject`). The destructor automatically disposes the underlying CkEcc handle. A native (unmanaged) memory leak occurs if the object is never freed.

Call `Global.UnlockBundle` once at the start of the program, before using this or any other Chilkat class. Any string unlocks a fully functional 30-day trial; a purchased unlock code is used in production. See `guide.md` for the exact code in Lazarus Pascal.

## Members common to every Chilkat class

Documented once per language in `common-members.md`; listed here so this page is self-contained.

| Property | Signature | Access | Meaning |
|---|---|---|---|
| `DebugLogFilePath` | `property DebugLogFilePath: string read GetDebugLogFilePath write SetDebugLogFilePath;` | read/write | If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. |
| `LastErrorHtml` | `property LastErrorHtml: string read GetLastErrorHtml;` | read-only | Provides HTML-formatted information about the last called method or property. |
| `LastErrorText` | `property LastErrorText: string read GetLastErrorText;` | read-only | Provides plain text information about the last called method or property. |
| `LastErrorXml` | `property LastErrorXml: string read GetLastErrorXml;` | read-only | Provides XML-formatted information about the last called method or property. |
| `LastMethodSuccess` | `property LastMethodSuccess: Boolean read GetLastMethodSuccess write SetLastMethodSuccess;` | read/write | Indicates the success or failure of the most recent method call: `True` means success, `False` means failure. |
| `VerboseLogging` | `property VerboseLogging: Boolean read GetVerboseLogging write SetVerboseLogging;` | read/write | If set to `True`, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. |
| `Version` | `property Version: string read GetVersion;` | read-only | Version of the component/library, such as "10.1.0" |

## Member index

| Member | Kind | Signature |
|---|---|---|
| `AsnFormat` | property, read/write | `property AsnFormat: Boolean read GetAsnFormat write SetAsnFormat;` |
| `GenKey` | method | `// prng is a TPrng object. // privKey is a TPrivateKey object. function GenKey(const curveName: string;     prng: TChilkatBase;     privKey: TChilkatBase): Boolean;` |
| `GenKey2` | method | `// privKey is a TPrivateKey object. function GenKey2(const curveName: string;     const encodedK: string;     const encoding: string;     privKey: TChilkatBase): Boolean;` |
| `SharedSecretENC` | method | `// privKey is a TPrivateKey object. // pubKey is a TPublicKey object. function SharedSecretENC(privKey: TChilkatBase;     pubKey: TChilkatBase;     const encoding: string): string;` |
| `SignBd` | method | `// bdData is a TBinData object. // privKey is a TPrivateKey object. // prng is a TPrng object. function SignBd(bdData: TChilkatBase;     const hashAlg: string;     const encoding: string;     privKey: TChilkatBase;     prng: TChilkatBase): string;` |
| `SignBdUsingCert` | method | `// bdData is a TBinData object. // cert is a TCert object. function SignBdUsingCert(bdData: TChilkatBase;     const hashAlg: string;     const encoding: string;     cert: TChilkatBase): string;` |
| `SignHashENC` | method | `// privkey is a TPrivateKey object. // prng is a TPrng object. function SignHashENC(const encodedHash: string;     const encoding: string;     privkey: TChilkatBase;     prng: TChilkatBase): string;` |
| `SignHashUsingCert` | method | `// cert is a TCert object. function SignHashUsingCert(const encodedHash: string;     const encoding: string;     cert: TChilkatBase): string;` |
| `VerifyBd` | method | `// bdData is a TBinData object. // pubkey is a TPublicKey object. function VerifyBd(bdData: TChilkatBase;     const hashAlg: string;     const encodedSig: string;     const encoding: string;     pubkey: TChilkatBase): Integer;` |
| `VerifyHashENC` | method | `// pubkey is a TPublicKey object. function VerifyHashENC(const encodedHash: string;     const encodedSig: string;     const encoding: string;     pubkey: TChilkatBase): Integer;` |

## Properties

### Ecc.AsnFormat

`Chilkat 11.7.0 · pascal · Ecc · AsnFormat · property · read/write · since 9.5.0.97`

```pascal
property AsnFormat: Boolean read GetAsnFormat write SetAsnFormat;
```

Controls the binary layout of ECDSA signatures created by this object. The default is `True`.

| Value | Signature layout |
| :--- | :--- |
| `True` | ASN.1 DER: a `SEQUENCE` containing the two INTEGER values `r` and `s`. Its encoded length can vary because DER INTEGER values may require leading sign-padding bytes. |
| `False` | Raw format: fixed-width, unsigned big-endian `r` followed immediately by fixed-width `s`, commonly written `r \|\| s`. |

**Signing versus verification:** This property controls generated signatures. Chilkat verification methods automatically recognize both ASN.1 DER and raw `r || s` signatures.

**Protocol compatibility:** Neither format is universally interchangeable. Use the layout required by the receiving protocol or file format.

## Methods

### Ecc.GenKey

`Chilkat 11.7.0 · pascal · Ecc · GenKey · method · since 11.0.0`

```pascal
// prng is a TPrng object.

// privKey is a TPrivateKey object.

function  GenKey(const curveName: string;
    prng: TChilkatBase;
    privKey: TChilkatBase): Boolean;
```

Generates a new elliptic-curve private key and stores it in `privKey`. `curveName` selects the named curve, and `prng` supplies the cryptographically secure random data used to choose the private scalar. Returns `True` on success and `False` on failure.

Supported curve names are:

| Curve name | Notes |
| :--- | :--- |
| `secp256r1` | Also known as P-256 and `prime256v1`. |
| `secp384r1` | Also known as P-384. |
| `secp521r1` | Also known as P-521. |
| `secp256k1` | Widely associated with Bitcoin and related systems. |
| `secp192r1`, `secp224r1` | Older, smaller SEC curves retained for compatibility. |
| `brainpoolP160r1`, `brainpoolP192r1`, `brainpoolP224r1`, `brainpoolP256r1`, `brainpoolP320r1`, `brainpoolP384r1`, `brainpoolP512r1` | Brainpool prime-field curves. |

**Choose the curve required by the protocol:** The curve name determines the key size, signature size, and interoperability. P-256, P-384, and P-521 are broadly standardized; `secp256k1` is commonly required by Bitcoin-related systems. Older and smaller curves should generally be used only for compatibility with an existing format or peer.

**Random generation matters:** The security of the private key depends on the randomness supplied by `prng`. Use a properly initialized cryptographic `Prng`.

Returns True for success, False for failure.

### Ecc.GenKey2

`Chilkat 11.7.0 · pascal · Ecc · GenKey2 · method · since 11.0.0`

```pascal
// privKey is a TPrivateKey object.

function  GenKey2(const curveName: string;
    const encodedK: string;
    const encoding: string;
    privKey: TChilkatBase): Boolean;
```

Constructs an elliptic-curve private key in `privKey` from a caller-supplied private scalar. `curveName` selects the named curve, `encodedK` contains the scalar, and `encoding` names its representation, such as `hex`, `base64`, or `decimal`. Returns `True` on success and `False` on failure.

Supported curve names are:

| Curve name | Notes |
| :--- | :--- |
| `secp256r1` | Also known as P-256 and `prime256v1`. |
| `secp384r1` | Also known as P-384. |
| `secp521r1` | Also known as P-521. |
| `secp256k1` | Widely associated with Bitcoin and related systems. |
| `secp192r1`, `secp224r1` | Older, smaller SEC curves retained for compatibility. |
| `brainpoolP160r1`, `brainpoolP192r1`, `brainpoolP224r1`, `brainpoolP256r1`, `brainpoolP320r1`, `brainpoolP384r1`, `brainpoolP512r1` | Brainpool prime-field curves. |

**`encodedK` is the private key value:** Despite the historical argument name, `encodedK` is the long-lived private scalar used to construct the key. It is not the temporary ECDSA signing nonce also commonly denoted by *k*. The value must be valid for the selected curve, unpredictable when used as a real key, and kept secret.

**Typical use:** Use this method to reproduce a known key for a test vector or to import a scalar supplied by another system. Use `GenKey` to create a new random private key.

Returns True for success, False for failure.

### Ecc.SharedSecretENC

`Chilkat 11.7.0 · pascal · Ecc · SharedSecretENC · method · since 9.5.0.52`

```pascal
// privKey is a TPrivateKey object.

// pubKey is a TPublicKey object.

function  SharedSecretENC(privKey: TChilkatBase;
    pubKey: TChilkatBase;
    const encoding: string): string;
```

**Full documentation for this method (same in every language):** [List of Supported Encodings (Base64, Hex, etc.)](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md)

Computes an elliptic-curve Diffie-Hellman shared secret from the private key in `privKey` and the peer's public key in `pubKey`. `encoding` specifies how the resulting bytes are encoded in the returned string, such as `hex` or `base64`.

Two parties obtain the same result when each combines its own private key with the other party's corresponding public key. Both keys must use the same named curve and must be suitable EC keys.

**Do not use the raw result directly as a long-term encryption key:** A shared secret is normally passed through the key-derivation function required by the surrounding protocol, together with any required context, salt, or transcript information. Key agreement by itself also does not authenticate the peer; an unauthenticated exchange is vulnerable to a man-in-the-middle attack.

**ECDH, not ECDSA:** ECDSA is a signature algorithm. This method performs ECDH-style key agreement.

Returns True for success, False for failure.

### Ecc.SignBd

`Chilkat 11.7.0 · pascal · Ecc · SignBd · method · since 9.5.0.85`

```pascal
// bdData is a TBinData object.

// privKey is a TPrivateKey object.

// prng is a TPrng object.

function  SignBd(bdData: TChilkatBase;
    const hashAlg: string;
    const encoding: string;
    privKey: TChilkatBase;
    prng: TChilkatBase): string;
```

Hashes the bytes currently contained in `bdData` and creates an ECDSA signature with the EC private key in `privKey`. `hashAlg` selects the hash algorithm and may be `sha256`, `sha384`, or `sha512`. `encoding` selects the textual encoding of the returned signature, such as `hex` or `base64`. `prng` supplies the random source used during ECDSA signature generation.

The signature's binary layout is controlled by `AsnFormat`. The contents of the `BinData` object are read but not modified.

**Sign the exact bytes:** Verification succeeds only when the verifier hashes the same byte sequence with the same hash algorithm and uses the public key corresponding to `privKey`.

**Protect the signing nonce:** Use a cryptographically secure `Prng`. Reusing or predicting an ECDSA nonce can expose the private key.

Returns True for success, False for failure.

### Ecc.SignBdUsingCert

`Chilkat 11.7.0 · pascal · Ecc · SignBdUsingCert · method · since 9.5.0.91`

```pascal
// bdData is a TBinData object.

// cert is a TCert object.

function  SignBdUsingCert(bdData: TChilkatBase;
    const hashAlg: string;
    const encoding: string;
    cert: TChilkatBase): string;
```

Hashes the bytes in `bdData` and creates an ECDSA signature using the private key associated with the certificate in `cert`. `hashAlg` selects `sha256`, `sha384`, or `sha512`; `encoding` selects the textual encoding of the returned signature.

The certificate must contain an EC public key and must provide access to its corresponding private key. The private key may be embedded with the certificate or supplied through the platform or key-storage mechanism from which the certificate was loaded. Signature layout is controlled by `AsnFormat`.

**Certificate versus key:** The certificate identifies the public key and may describe the key owner, but signing requires actual access to the associated private key. A public-only certificate cannot sign.

Returns True for success, False for failure.

### Ecc.SignHashENC

`Chilkat 11.7.0 · pascal · Ecc · SignHashENC · method · since 9.5.0.52`

```pascal
// privkey is a TPrivateKey object.

// prng is a TPrng object.

function  SignHashENC(const encodedHash: string;
    const encoding: string;
    privkey: TChilkatBase;
    prng: TChilkatBase): string;
```

**Full documentation for this method (same in every language):** [List of Supported Encodings (Base64, Hex, etc.)](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md)

Creates an ECDSA signature over a digest that has already been computed by the application. `encodedHash` contains the digest encoded using the binary encoding named by `encoding`, such as `hex` or `base64`. `privkey` supplies the EC private key, and `prng` supplies the random source used during signature generation.

The returned signature uses the same textual encoding named by `encoding`. Its binary layout is controlled by `AsnFormat`: ASN.1 DER when `True`, or raw `r || s` when `False`.

**No hashing is performed:** `encodedHash` must be the exact digest required by the protocol. The verifier must use the same digest bytes and the matching public key.

**ECDSA nonce safety:** Every signature requires a secret per-signature value. It must be generated securely and must never be reused with the same private key, because nonce reuse or predictability can reveal the private key. Supply a properly initialized cryptographic `Prng`.

Returns True for success, False for failure.

### Ecc.SignHashUsingCert

`Chilkat 11.7.0 · pascal · Ecc · SignHashUsingCert · method · since 10.1.0`

```pascal
// cert is a TCert object.

function  SignHashUsingCert(const encodedHash: string;
    const encoding: string;
    cert: TChilkatBase): string;
```

Creates an ECDSA signature over a digest that has already been computed. `encodedHash` contains the digest encoded using the binary encoding named by `encoding`. `cert` supplies a certificate whose public key is EC and whose associated private key is accessible for signing.

The returned signature uses the same textual encoding named by `encoding`. Its binary layout is controlled by `AsnFormat`.

**No hashing is performed:** `encodedHash` must contain the final digest bytes expected by the receiving protocol. Use `SignBdUsingCert` when Chilkat should hash the source data before signing.

**Private-key requirement:** A certificate containing only a public key is not sufficient. The associated EC private key must be present and usable.

Returns True for success, False for failure.

### Ecc.VerifyBd

`Chilkat 11.7.0 · pascal · Ecc · VerifyBd · method · since 9.5.0.85`

```pascal
// bdData is a TBinData object.

// pubkey is a TPublicKey object.

function  VerifyBd(bdData: TChilkatBase;
    const hashAlg: string;
    const encodedSig: string;
    const encoding: string;
    pubkey: TChilkatBase): Integer;
```

Hashes the bytes in `bdData` using the algorithm named by `hashAlg` and verifies the ECDSA signature in `encodedSig` with the EC public key in `pubkey`. `encoding` identifies the textual encoding of the signature, such as `hex` or `base64`. Supported hash algorithms are `sha256`, `sha384`, and `sha512`.

Chilkat automatically recognizes ASN.1 DER and raw `r || s` signature layouts.

| Return | Meaning |
| :--- | :--- |
| `1` | Valid signature. |
| `0` | Invalid signature. |
| `-1` | Operational failure; examine `LastErrorText`. |

**Exact-data requirement:** A valid signature becomes invalid if any signed byte changes or if a different hash algorithm is selected.

### Ecc.VerifyHashENC

`Chilkat 11.7.0 · pascal · Ecc · VerifyHashENC · method · since 9.5.0.52`

```pascal
// pubkey is a TPublicKey object.

function  VerifyHashENC(const encodedHash: string;
    const encodedSig: string;
    const encoding: string;
    pubkey: TChilkatBase): Integer;
```

**Full documentation for this method (same in every language):** [List of Supported Encodings (Base64, Hex, etc.)](https://www.chilkatsoft.com/ai-docs/v/11.7.0/articles/binary_encodings.md)

Verifies an ECDSA signature over a digest that was computed by the application. `encodedHash` is the encoded digest, `encodedSig` is the encoded signature, `encoding` names the binary encoding used by both strings, and `pubkey` supplies the matching EC public key.

Chilkat automatically recognizes both supported ECDSA signature layouts: ASN.1 DER and fixed-width raw `r || s`. The `AsnFormat` property therefore does not need to match the signature being verified.

| Return | Meaning |
| :--- | :--- |
| `1` | The signature is valid for the supplied digest and public key. |
| `0` | The method ran successfully, but the signature is not valid. |
| `-1` | The verification operation could not be completed because of malformed input, an unsuitable key, an unsupported encoding, or another error. Examine `LastErrorText`. |

**Digest-level verification:** This method does not hash the original message. It verifies only the digest bytes supplied in `encodedHash`.

## Related classes

[`BinData`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/BinData.md), [`Cert`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/Cert.md), [`PrivateKey`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/PrivateKey.md), [`Prng`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/Prng.md), [`PublicKey`](https://www.chilkatsoft.com/ai-docs/v/11.7.0/pascal/classes/PublicKey.md)