diff --git a/CMakeLists.txt b/CMakeLists.txt
index d1c42e51..ce2dcc8a 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1024,7 +1024,7 @@ endif()
 #
 set(CPACK_PACKAGE_NAME "GmSSL")
 set(CPACK_PACKAGE_VENDOR "GmSSL develop team")
-set(CPACK_PACKAGE_VERSION "3.3.0-dev.1171")
+set(CPACK_PACKAGE_VERSION "3.3.0-dev.1172")
 set(CPACK_PACKAGE_DESCRIPTION_FILE ${PROJECT_SOURCE_DIR}/README.md)
 set(CPACK_NSIS_MODIFY_PATH ON)
 include(CPack)
diff --git a/include/gmssl/secp256r1_ecdsa.h b/include/gmssl/secp256r1_ecdsa.h
index 77dc9841..56e3368e 100644
--- a/include/gmssl/secp256r1_ecdsa.h
+++ b/include/gmssl/secp256r1_ecdsa.h
@@ -44,15 +44,21 @@ int secp256r1_ecdsa_signature_print_ex(FILE *fp, int fmt, int ind, const char *l
 int secp256r1_ecdsa_signature_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *sig, size_t siglen);
 
 
-int secp256r1_ecdsa_do_sign_ex(const SECP256R1_KEY *key, const secp256r1_t k, const uint8_t dgst[32], SECP256R1_ECDSA_SIGNATURE *sig);
-int secp256r1_ecdsa_do_sign(const SECP256R1_KEY *key, const uint8_t dgst[32], SECP256R1_ECDSA_SIGNATURE *sig);
-int secp256r1_ecdsa_do_verify(const SECP256R1_KEY *key, const uint8_t dgst[32], const SECP256R1_ECDSA_SIGNATURE *sig);
+int secp256r1_ecdsa_do_sign_ex(const SECP256R1_KEY *key, const secp256r1_t k,
+	const uint8_t *dgst, size_t dgstlen, SECP256R1_ECDSA_SIGNATURE *sig);
+int secp256r1_ecdsa_do_sign(const SECP256R1_KEY *key,
+	const uint8_t *dgst, size_t dgstlen, SECP256R1_ECDSA_SIGNATURE *sig);
+int secp256r1_ecdsa_do_verify(const SECP256R1_KEY *key,
+	const uint8_t *dgst, size_t dgstlen, const SECP256R1_ECDSA_SIGNATURE *sig);
 
 
 // 这个函数应该改为将key的类型编程通用支持P256, P384的，摘要可以支持不同长度的
-int secp256r1_ecdsa_sign(const SECP256R1_KEY *key, const uint8_t dgst[32], uint8_t *sig, size_t *siglen);
-int secp256r1_ecdsa_sign_fixlen(const SECP256R1_KEY *key, const uint8_t dgst[32], size_t siglen, uint8_t *sig);
-int secp256r1_ecdsa_verify(const SECP256R1_KEY *key, const uint8_t dgst[32], const uint8_t *sig, size_t siglen);
+int secp256r1_ecdsa_sign(const SECP256R1_KEY *key,
+	const uint8_t *dgst, size_t dgstlen, uint8_t *sig, size_t *siglen);
+int secp256r1_ecdsa_sign_fixlen(const SECP256R1_KEY *key,
+	const uint8_t *dgst, size_t dgstlen, size_t siglen, uint8_t *sig);
+int secp256r1_ecdsa_verify(const SECP256R1_KEY *key,
+	const uint8_t *dgst, size_t dgstlen, const uint8_t *sig, size_t siglen);
 
 
 // 后面的CTX就没有意义了
diff --git a/include/gmssl/secp384r1_ecdsa.h b/include/gmssl/secp384r1_ecdsa.h
index 4118811c..411da7c5 100644
--- a/include/gmssl/secp384r1_ecdsa.h
+++ b/include/gmssl/secp384r1_ecdsa.h
@@ -44,15 +44,21 @@ int secp384r1_ecdsa_signature_print_ex(FILE *fp, int fmt, int ind, const char *l
 int secp384r1_ecdsa_signature_print(FILE *fp, int fmt, int ind, const char *label, const uint8_t *sig, size_t siglen);
 
 
-int secp384r1_ecdsa_do_sign_ex(const SECP384R1_KEY *key, const secp384r1_t k, const uint8_t dgst[48], SECP384R1_ECDSA_SIGNATURE *sig);
-int secp384r1_ecdsa_do_sign(const SECP384R1_KEY *key, const uint8_t dgst[48], SECP384R1_ECDSA_SIGNATURE *sig);
-int secp384r1_ecdsa_do_verify(const SECP384R1_KEY *key, const uint8_t dgst[48], const SECP384R1_ECDSA_SIGNATURE *sig);
+int secp384r1_ecdsa_do_sign_ex(const SECP384R1_KEY *key, const secp384r1_t k,
+	const uint8_t *dgst, size_t dgstlen, SECP384R1_ECDSA_SIGNATURE *sig);
+int secp384r1_ecdsa_do_sign(const SECP384R1_KEY *key,
+	const uint8_t *dgst, size_t dgstlen, SECP384R1_ECDSA_SIGNATURE *sig);
+int secp384r1_ecdsa_do_verify(const SECP384R1_KEY *key,
+	const uint8_t *dgst, size_t dgstlen, const SECP384R1_ECDSA_SIGNATURE *sig);
 
 
 // 这个函数应该改为将key的类型编程通用支持P256, P384的，摘要可以支持不同长度的
-int secp384r1_ecdsa_sign(const SECP384R1_KEY *key, const uint8_t dgst[48], uint8_t *sig, size_t *siglen);
-int secp384r1_ecdsa_sign_fixlen(const SECP384R1_KEY *key, const uint8_t dgst[48], size_t siglen, uint8_t *sig);
-int secp384r1_ecdsa_verify(const SECP384R1_KEY *key, const uint8_t dgst[48], const uint8_t *sig, size_t siglen);
+int secp384r1_ecdsa_sign(const SECP384R1_KEY *key,
+	const uint8_t *dgst, size_t dgstlen, uint8_t *sig, size_t *siglen);
+int secp384r1_ecdsa_sign_fixlen(const SECP384R1_KEY *key,
+	const uint8_t *dgst, size_t dgstlen, size_t siglen, uint8_t *sig);
+int secp384r1_ecdsa_verify(const SECP384R1_KEY *key,
+	const uint8_t *dgst, size_t dgstlen, const uint8_t *sig, size_t siglen);
 
 
 // 后面的CTX就没有意义了
diff --git a/include/gmssl/version.h b/include/gmssl/version.h
index 38b94de4..bddc6cf8 100644
--- a/include/gmssl/version.h
+++ b/include/gmssl/version.h
@@ -18,7 +18,7 @@ extern "C" {
 
 
 #define GMSSL_VERSION_NUM	30300
-#define GMSSL_VERSION_STR	"GmSSL 3.3.0-dev.1171"
+#define GMSSL_VERSION_STR	"GmSSL 3.3.0-dev.1172"
 
 int gmssl_version_num(void);
 const char *gmssl_version_str(void);
diff --git a/src/ec_ecdsa.c b/src/ec_ecdsa.c
index 901e87df..929e6a32 100644
--- a/src/ec_ecdsa.c
+++ b/src/ec_ecdsa.c
@@ -7,7 +7,6 @@
  *  http://www.apache.org/licenses/LICENSE-2.0
  */
 
-#include <string.h>
 #include <gmssl/ecdsa.h>
 #ifdef ENABLE_SECP256R1
 #include <gmssl/secp256r1_ecdsa.h>
@@ -18,45 +17,6 @@
 #include <gmssl/error.h>
 
 
-#ifdef ENABLE_SECP256R1
-static int ecdsa_digest_to_p256(const uint8_t *dgst, size_t dgstlen, uint8_t out[32])
-{
-	if (!dgst || !out) {
-		error_print();
-		return -1;
-	}
-	if (dgstlen == 32) {
-		memcpy(out, dgst, 32);
-	} else if (dgstlen == 48) {
-		memcpy(out, dgst, 32);
-	} else {
-		error_print();
-		return -1;
-	}
-	return 1;
-}
-#endif
-
-#ifdef ENABLE_SECP384R1
-static int ecdsa_digest_to_p384(const uint8_t *dgst, size_t dgstlen, uint8_t out[48])
-{
-	if (!dgst || !out) {
-		error_print();
-		return -1;
-	}
-	if (dgstlen == 32) {
-		memset(out, 0, 16);
-		memcpy(out + 16, dgst, 32);
-	} else if (dgstlen == 48) {
-		memcpy(out, dgst, 48);
-	} else {
-		error_print();
-		return -1;
-	}
-	return 1;
-}
-#endif
-
 int ecdsa_sign(const EC_KEY *key, const uint8_t *dgst, size_t dgstlen,
 	uint8_t *sig, size_t *siglen)
 {
@@ -67,25 +27,17 @@ int ecdsa_sign(const EC_KEY *key, const uint8_t *dgst, size_t dgstlen,
 	switch (key->oid) {
 #ifdef ENABLE_SECP256R1
 	case OID_secp256r1:
-		{
-			uint8_t e[32];
-			if (ecdsa_digest_to_p256(dgst, dgstlen, e) != 1
-				|| secp256r1_ecdsa_sign(&key->u.secp256r1_key, e, sig, siglen) != 1) {
-				error_print();
-				return -1;
-			}
+		if (secp256r1_ecdsa_sign(&key->u.secp256r1_key, dgst, dgstlen, sig, siglen) != 1) {
+			error_print();
+			return -1;
 		}
 		return 1;
 #endif
 #ifdef ENABLE_SECP384R1
 	case OID_secp384r1:
-		{
-			uint8_t e[48];
-			if (ecdsa_digest_to_p384(dgst, dgstlen, e) != 1
-				|| secp384r1_ecdsa_sign(&key->u.secp384r1_key, e, sig, siglen) != 1) {
-				error_print();
-				return -1;
-			}
+		if (secp384r1_ecdsa_sign(&key->u.secp384r1_key, dgst, dgstlen, sig, siglen) != 1) {
+			error_print();
+			return -1;
 		}
 		return 1;
 #endif
@@ -105,25 +57,17 @@ int ecdsa_sign_fixed_len(const EC_KEY *key, const uint8_t *dgst, size_t dgstlen,
 	switch (key->oid) {
 #ifdef ENABLE_SECP256R1
 	case OID_secp256r1:
-		{
-			uint8_t e[32];
-			if (ecdsa_digest_to_p256(dgst, dgstlen, e) != 1
-				|| secp256r1_ecdsa_sign_fixlen(&key->u.secp256r1_key, e, siglen, sig) != 1) {
-				error_print();
-				return -1;
-			}
+		if (secp256r1_ecdsa_sign_fixlen(&key->u.secp256r1_key, dgst, dgstlen, siglen, sig) != 1) {
+			error_print();
+			return -1;
 		}
 		return 1;
 #endif
 #ifdef ENABLE_SECP384R1
 	case OID_secp384r1:
-		{
-			uint8_t e[48];
-			if (ecdsa_digest_to_p384(dgst, dgstlen, e) != 1
-				|| secp384r1_ecdsa_sign_fixlen(&key->u.secp384r1_key, e, siglen, sig) != 1) {
-				error_print();
-				return -1;
-			}
+		if (secp384r1_ecdsa_sign_fixlen(&key->u.secp384r1_key, dgst, dgstlen, siglen, sig) != 1) {
+			error_print();
+			return -1;
 		}
 		return 1;
 #endif
@@ -144,13 +88,8 @@ int ecdsa_verify(const EC_KEY *key, const uint8_t *dgst, size_t dgstlen,
 #ifdef ENABLE_SECP256R1
 	case OID_secp256r1:
 		{
-			uint8_t e[32];
 			int ret;
-			if (ecdsa_digest_to_p256(dgst, dgstlen, e) != 1) {
-				error_print();
-				return -1;
-			}
-			if ((ret = secp256r1_ecdsa_verify(&key->u.secp256r1_key, e, sig, siglen)) < 0) {
+			if ((ret = secp256r1_ecdsa_verify(&key->u.secp256r1_key, dgst, dgstlen, sig, siglen)) < 0) {
 				error_print();
 				return -1;
 			}
@@ -160,13 +99,8 @@ int ecdsa_verify(const EC_KEY *key, const uint8_t *dgst, size_t dgstlen,
 #ifdef ENABLE_SECP384R1
 	case OID_secp384r1:
 		{
-			uint8_t e[48];
 			int ret;
-			if (ecdsa_digest_to_p384(dgst, dgstlen, e) != 1) {
-				error_print();
-				return -1;
-			}
-			if ((ret = secp384r1_ecdsa_verify(&key->u.secp384r1_key, e, sig, siglen)) < 0) {
+			if ((ret = secp384r1_ecdsa_verify(&key->u.secp384r1_key, dgst, dgstlen, sig, siglen)) < 0) {
 				error_print();
 				return -1;
 			}
diff --git a/src/ecdsa.c b/src/ecdsa.c
index 638c9477..f4b1cec7 100644
--- a/src/ecdsa.c
+++ b/src/ecdsa.c
@@ -12,6 +12,7 @@
 #include <stdlib.h>
 #include <gmssl/asn1.h>
 #include <gmssl/digest.h>
+#include <gmssl/sha2.h>
 #include <gmssl/rand.h>
 #include <gmssl/error.h>
 #include <gmssl/secp256r1_ecdsa.h>
@@ -47,7 +48,30 @@ int secp256r1_ecdsa_signature_print(FILE *fp, int fmt, int ind, const char *labe
 	return 1;
 }
 
-int secp256r1_ecdsa_do_sign_ex(const SECP256R1_KEY *key, const secp256r1_t k, const uint8_t dgst[32], SECP256R1_ECDSA_SIGNATURE *sig)
+static int secp256r1_ecdsa_digest_to_e(secp256r1_t e, const uint8_t *dgst, size_t dgstlen)
+{
+	uint8_t buf[SHA256_DIGEST_SIZE];
+
+	if (!dgst) {
+		error_print();
+		return -1;
+	}
+	if (dgstlen != SHA256_DIGEST_SIZE && dgstlen != SHA384_DIGEST_SIZE) {
+		error_print();
+		return -1;
+	}
+
+	memcpy(buf, dgst, sizeof(buf));
+	if (secp256r1_from_32bytes(e, buf) != 1
+		|| secp256r1_modn(e, e) != 1) {
+		error_print();
+		return -1;
+	}
+	return 1;
+}
+
+int secp256r1_ecdsa_do_sign_ex(const SECP256R1_KEY *key, const secp256r1_t k,
+	const uint8_t *dgst, size_t dgstlen, SECP256R1_ECDSA_SIGNATURE *sig)
 {
 	secp256r1_t e;
 	secp256r1_t x1;
@@ -56,8 +80,7 @@ int secp256r1_ecdsa_do_sign_ex(const SECP256R1_KEY *key, const secp256r1_t k, co
 	SECP256R1_POINT P;
 
 	// e = hash(m)
-	if (secp256r1_from_32bytes(e, dgst) != 1
-		|| secp256r1_modn(e, e) != 1) {
+	if (secp256r1_ecdsa_digest_to_e(e, dgst, dgstlen) != 1) {
 		error_print();
 		return -1;
 	}
@@ -87,7 +110,8 @@ int secp256r1_ecdsa_do_sign_ex(const SECP256R1_KEY *key, const secp256r1_t k, co
 	return 1;
 }
 
-int secp256r1_ecdsa_do_sign(const SECP256R1_KEY *key, const uint8_t dgst[32], SECP256R1_ECDSA_SIGNATURE *sig)
+int secp256r1_ecdsa_do_sign(const SECP256R1_KEY *key,
+	const uint8_t *dgst, size_t dgstlen, SECP256R1_ECDSA_SIGNATURE *sig)
 {
 	secp256r1_t k;
 
@@ -99,7 +123,7 @@ int secp256r1_ecdsa_do_sign(const SECP256R1_KEY *key, const uint8_t dgst[32], SE
 		}
 	} while (secp256r1_is_zero(k) || secp256r1_cmp(k, SECP256R1_N) >= 0);
 
-	if (secp256r1_ecdsa_do_sign_ex(key, k, dgst, sig) != 1) {
+	if (secp256r1_ecdsa_do_sign_ex(key, k, dgst, dgstlen, sig) != 1) {
 		error_print();
 		return -1;
 	}
@@ -107,7 +131,8 @@ int secp256r1_ecdsa_do_sign(const SECP256R1_KEY *key, const uint8_t dgst[32], SE
 }
 
 
-int secp256r1_ecdsa_do_verify(const SECP256R1_KEY *key, const uint8_t dgst[32], const SECP256R1_ECDSA_SIGNATURE *sig)
+int secp256r1_ecdsa_do_verify(const SECP256R1_KEY *key,
+	const uint8_t *dgst, size_t dgstlen, const SECP256R1_ECDSA_SIGNATURE *sig)
 {
 	secp256r1_t e;
 	secp256r1_t w;
@@ -129,8 +154,7 @@ int secp256r1_ecdsa_do_verify(const SECP256R1_KEY *key, const uint8_t dgst[32],
 	}
 
 	// e = hash(m)
-	if (secp256r1_from_32bytes(e, dgst) != 1
-		|| secp256r1_modn(e, e) != 1) {
+	if (secp256r1_ecdsa_digest_to_e(e, dgst, dgstlen) != 1) {
 		error_print();
 		return -1;
 	}
@@ -233,11 +257,12 @@ int secp256r1_ecdsa_signature_from_der(SECP256R1_ECDSA_SIGNATURE *sig, const uin
 	return 1;
 }
 
-int secp256r1_ecdsa_sign(const SECP256R1_KEY *key, const uint8_t dgst[32], uint8_t *sigbuf, size_t *siglen)
+int secp256r1_ecdsa_sign(const SECP256R1_KEY *key,
+	const uint8_t *dgst, size_t dgstlen, uint8_t *sigbuf, size_t *siglen)
 {
 	SECP256R1_ECDSA_SIGNATURE sig;
 
-	if (secp256r1_ecdsa_do_sign(key, dgst, &sig) != 1) {
+	if (secp256r1_ecdsa_do_sign(key, dgst, dgstlen, &sig) != 1) {
 		error_print();
 		return -1;
 	}
@@ -249,7 +274,8 @@ int secp256r1_ecdsa_sign(const SECP256R1_KEY *key, const uint8_t dgst[32], uint8
 	return 1;
 }
 
-int secp256r1_ecdsa_sign_fixlen(const SECP256R1_KEY *key, const uint8_t dgst[32], size_t siglen, uint8_t *sig)
+int secp256r1_ecdsa_sign_fixlen(const SECP256R1_KEY *key,
+	const uint8_t *dgst, size_t dgstlen, size_t siglen, uint8_t *sig)
 {
 	unsigned int trys = 200;
 	uint8_t buf[SECP256R1_ECDSA_SIGNATURE_MAX_SIZE];
@@ -266,7 +292,7 @@ int secp256r1_ecdsa_sign_fixlen(const SECP256R1_KEY *key, const uint8_t dgst[32]
 	}
 
 	while (trys--) {
-		if (secp256r1_ecdsa_sign(key, dgst, buf, &len) != 1) {
+		if (secp256r1_ecdsa_sign(key, dgst, dgstlen, buf, &len) != 1) {
 			error_print();
 			return -1;
 		}
@@ -282,7 +308,8 @@ int secp256r1_ecdsa_sign_fixlen(const SECP256R1_KEY *key, const uint8_t dgst[32]
 }
 
 
-int secp256r1_ecdsa_verify(const SECP256R1_KEY *key, const uint8_t dgst[32], const uint8_t *sigbuf, size_t siglen)
+int secp256r1_ecdsa_verify(const SECP256R1_KEY *key,
+	const uint8_t *dgst, size_t dgstlen, const uint8_t *sigbuf, size_t siglen)
 {
 	int ret;
 	SECP256R1_ECDSA_SIGNATURE sig;
@@ -295,7 +322,7 @@ int secp256r1_ecdsa_verify(const SECP256R1_KEY *key, const uint8_t dgst[32], con
 		error_print();
 		return -1;
 	}
-	if ((ret = secp256r1_ecdsa_do_verify(key, dgst, &sig)) < 0) {
+	if ((ret = secp256r1_ecdsa_do_verify(key, dgst, dgstlen, &sig)) < 0) {
 		error_print();
 		return -1;
 	}
@@ -346,13 +373,12 @@ int secp256r1_ecdsa_sign_finish(SECP256R1_ECDSA_SIGN_CTX *ctx, uint8_t *sig, siz
 		return -1;
 	}
 
-	if (digest_finish(&ctx->digest_ctx, dgst, &dgstlen) != 1
-		|| dgstlen < 32) {
+	if (digest_finish(&ctx->digest_ctx, dgst, &dgstlen) != 1) {
 		error_print();
 		return -1;
 	}
 
-	if (secp256r1_ecdsa_sign(&ctx->key, dgst, sig, siglen) != 1) {
+	if (secp256r1_ecdsa_sign(&ctx->key, dgst, dgstlen, sig, siglen) != 1) {
 		error_print();
 		return -1;
 	}
@@ -369,13 +395,12 @@ int secp256r1_ecdsa_sign_finish_fixlen(SECP256R1_ECDSA_SIGN_CTX *ctx, size_t sig
 		return -1;
 	}
 
-	if (digest_finish(&ctx->digest_ctx, dgst, &dgstlen) != 1
-		|| dgstlen < 32) {
+	if (digest_finish(&ctx->digest_ctx, dgst, &dgstlen) != 1) {
 		error_print();
 		return -1;
 	}
 
-	if (secp256r1_ecdsa_sign_fixlen(&ctx->key, dgst, siglen, sig) != 1) {
+	if (secp256r1_ecdsa_sign_fixlen(&ctx->key, dgst, dgstlen, siglen, sig) != 1) {
 		error_print();
 		return -1;
 	}
@@ -443,13 +468,12 @@ int secp256r1_ecdsa_verify_finish(SECP256R1_ECDSA_SIGN_CTX *ctx)
 		return -1;
 	}
 
-	if (digest_finish(&ctx->digest_ctx, dgst, &dgstlen) != 1
-		|| dgstlen < 32) {
+	if (digest_finish(&ctx->digest_ctx, dgst, &dgstlen) != 1) {
 		error_print();
 		return -1;
 	}
 
-	if ((ret = secp256r1_ecdsa_do_verify(&ctx->key, dgst, &ctx->sig)) < 0) {
+	if ((ret = secp256r1_ecdsa_do_verify(&ctx->key, dgst, dgstlen, &ctx->sig)) < 0) {
 		error_print();
 		return -1;
 	}
diff --git a/src/secp384r1_ecdsa.c b/src/secp384r1_ecdsa.c
index 03f64206..6e89f097 100644
--- a/src/secp384r1_ecdsa.c
+++ b/src/secp384r1_ecdsa.c
@@ -12,6 +12,7 @@
 #include <stdlib.h>
 #include <gmssl/asn1.h>
 #include <gmssl/digest.h>
+#include <gmssl/sha2.h>
 #include <gmssl/rand.h>
 #include <gmssl/error.h>
 #include <gmssl/secp384r1_ecdsa.h>
@@ -47,7 +48,34 @@ int secp384r1_ecdsa_signature_print(FILE *fp, int fmt, int ind, const char *labe
 	return 1;
 }
 
-int secp384r1_ecdsa_do_sign_ex(const SECP384R1_KEY *key, const secp384r1_t k, const uint8_t dgst[48], SECP384R1_ECDSA_SIGNATURE *sig)
+static int secp384r1_ecdsa_digest_to_e(secp384r1_t e, const uint8_t *dgst, size_t dgstlen)
+{
+	uint8_t buf[SHA384_DIGEST_SIZE];
+
+	if (!dgst) {
+		error_print();
+		return -1;
+	}
+	if (dgstlen == SHA256_DIGEST_SIZE) {
+		memset(buf, 0, SHA384_DIGEST_SIZE - SHA256_DIGEST_SIZE);
+		memcpy(buf + SHA384_DIGEST_SIZE - SHA256_DIGEST_SIZE, dgst, SHA256_DIGEST_SIZE);
+	} else if (dgstlen == SHA384_DIGEST_SIZE) {
+		memcpy(buf, dgst, sizeof(buf));
+	} else {
+		error_print();
+		return -1;
+	}
+
+	if (secp384r1_from_48bytes(e, buf) != 1
+		|| secp384r1_modn(e, e) != 1) {
+		error_print();
+		return -1;
+	}
+	return 1;
+}
+
+int secp384r1_ecdsa_do_sign_ex(const SECP384R1_KEY *key, const secp384r1_t k,
+	const uint8_t *dgst, size_t dgstlen, SECP384R1_ECDSA_SIGNATURE *sig)
 {
 	secp384r1_t e;
 	secp384r1_t x1;
@@ -56,8 +84,7 @@ int secp384r1_ecdsa_do_sign_ex(const SECP384R1_KEY *key, const secp384r1_t k, co
 	SECP384R1_POINT P;
 
 	// e = hash(m)
-	if (secp384r1_from_48bytes(e, dgst) != 1
-		|| secp384r1_modn(e, e) != 1) {
+	if (secp384r1_ecdsa_digest_to_e(e, dgst, dgstlen) != 1) {
 		error_print();
 		return -1;
 	}
@@ -87,7 +114,8 @@ int secp384r1_ecdsa_do_sign_ex(const SECP384R1_KEY *key, const secp384r1_t k, co
 	return 1;
 }
 
-int secp384r1_ecdsa_do_sign(const SECP384R1_KEY *key, const uint8_t dgst[48], SECP384R1_ECDSA_SIGNATURE *sig)
+int secp384r1_ecdsa_do_sign(const SECP384R1_KEY *key,
+	const uint8_t *dgst, size_t dgstlen, SECP384R1_ECDSA_SIGNATURE *sig)
 {
 	secp384r1_t k;
 
@@ -99,7 +127,7 @@ int secp384r1_ecdsa_do_sign(const SECP384R1_KEY *key, const uint8_t dgst[48], SE
 		}
 	} while (secp384r1_is_zero(k) || secp384r1_cmp(k, SECP384R1_N) >= 0);
 
-	if (secp384r1_ecdsa_do_sign_ex(key, k, dgst, sig) != 1) {
+	if (secp384r1_ecdsa_do_sign_ex(key, k, dgst, dgstlen, sig) != 1) {
 		error_print();
 		return -1;
 	}
@@ -107,7 +135,8 @@ int secp384r1_ecdsa_do_sign(const SECP384R1_KEY *key, const uint8_t dgst[48], SE
 }
 
 
-int secp384r1_ecdsa_do_verify(const SECP384R1_KEY *key, const uint8_t dgst[48], const SECP384R1_ECDSA_SIGNATURE *sig)
+int secp384r1_ecdsa_do_verify(const SECP384R1_KEY *key,
+	const uint8_t *dgst, size_t dgstlen, const SECP384R1_ECDSA_SIGNATURE *sig)
 {
 	secp384r1_t e;
 	secp384r1_t w;
@@ -129,8 +158,7 @@ int secp384r1_ecdsa_do_verify(const SECP384R1_KEY *key, const uint8_t dgst[48],
 	}
 
 	// e = hash(m)
-	if (secp384r1_from_48bytes(e, dgst) != 1
-		|| secp384r1_modn(e, e) != 1) {
+	if (secp384r1_ecdsa_digest_to_e(e, dgst, dgstlen) != 1) {
 		error_print();
 		return -1;
 	}
@@ -237,11 +265,12 @@ int secp384r1_ecdsa_signature_from_der(SECP384R1_ECDSA_SIGNATURE *sig, const uin
 	return 1;
 }
 
-int secp384r1_ecdsa_sign(const SECP384R1_KEY *key, const uint8_t dgst[48], uint8_t *sigbuf, size_t *siglen)
+int secp384r1_ecdsa_sign(const SECP384R1_KEY *key,
+	const uint8_t *dgst, size_t dgstlen, uint8_t *sigbuf, size_t *siglen)
 {
 	SECP384R1_ECDSA_SIGNATURE sig;
 
-	if (secp384r1_ecdsa_do_sign(key, dgst, &sig) != 1) {
+	if (secp384r1_ecdsa_do_sign(key, dgst, dgstlen, &sig) != 1) {
 		error_print();
 		return -1;
 	}
@@ -253,7 +282,8 @@ int secp384r1_ecdsa_sign(const SECP384R1_KEY *key, const uint8_t dgst[48], uint8
 	return 1;
 }
 
-int secp384r1_ecdsa_sign_fixlen(const SECP384R1_KEY *key, const uint8_t dgst[48], size_t siglen, uint8_t *sig)
+int secp384r1_ecdsa_sign_fixlen(const SECP384R1_KEY *key,
+	const uint8_t *dgst, size_t dgstlen, size_t siglen, uint8_t *sig)
 {
 	unsigned int trys = 200;
 	uint8_t buf[SECP384R1_ECDSA_SIGNATURE_MAX_SIZE];
@@ -270,7 +300,7 @@ int secp384r1_ecdsa_sign_fixlen(const SECP384R1_KEY *key, const uint8_t dgst[48]
 	}
 
 	while (trys--) {
-		if (secp384r1_ecdsa_sign(key, dgst, buf, &len) != 1) {
+		if (secp384r1_ecdsa_sign(key, dgst, dgstlen, buf, &len) != 1) {
 			error_print();
 			return -1;
 		}
@@ -286,7 +316,8 @@ int secp384r1_ecdsa_sign_fixlen(const SECP384R1_KEY *key, const uint8_t dgst[48]
 }
 
 
-int secp384r1_ecdsa_verify(const SECP384R1_KEY *key, const uint8_t dgst[48], const uint8_t *sigbuf, size_t siglen)
+int secp384r1_ecdsa_verify(const SECP384R1_KEY *key,
+	const uint8_t *dgst, size_t dgstlen, const uint8_t *sigbuf, size_t siglen)
 {
 	int ret;
 	SECP384R1_ECDSA_SIGNATURE sig;
@@ -299,7 +330,7 @@ int secp384r1_ecdsa_verify(const SECP384R1_KEY *key, const uint8_t dgst[48], con
 		error_print();
 		return -1;
 	}
-	if ((ret = secp384r1_ecdsa_do_verify(key, dgst, &sig)) < 0) {
+	if ((ret = secp384r1_ecdsa_do_verify(key, dgst, dgstlen, &sig)) < 0) {
 		error_print();
 		return -1;
 	}
@@ -350,13 +381,12 @@ int secp384r1_ecdsa_sign_finish(SECP384R1_ECDSA_SIGN_CTX *ctx, uint8_t *sig, siz
 		return -1;
 	}
 
-	if (digest_finish(&ctx->digest_ctx, dgst, &dgstlen) != 1
-		|| dgstlen < 48) {
+	if (digest_finish(&ctx->digest_ctx, dgst, &dgstlen) != 1) {
 		error_print();
 		return -1;
 	}
 
-	if (secp384r1_ecdsa_sign(&ctx->key, dgst, sig, siglen) != 1) {
+	if (secp384r1_ecdsa_sign(&ctx->key, dgst, dgstlen, sig, siglen) != 1) {
 		error_print();
 		return -1;
 	}
@@ -373,13 +403,12 @@ int secp384r1_ecdsa_sign_finish_fixlen(SECP384R1_ECDSA_SIGN_CTX *ctx, size_t sig
 		return -1;
 	}
 
-	if (digest_finish(&ctx->digest_ctx, dgst, &dgstlen) != 1
-		|| dgstlen < 48) {
+	if (digest_finish(&ctx->digest_ctx, dgst, &dgstlen) != 1) {
 		error_print();
 		return -1;
 	}
 
-	if (secp384r1_ecdsa_sign_fixlen(&ctx->key, dgst, siglen, sig) != 1) {
+	if (secp384r1_ecdsa_sign_fixlen(&ctx->key, dgst, dgstlen, siglen, sig) != 1) {
 		error_print();
 		return -1;
 	}
@@ -447,13 +476,12 @@ int secp384r1_ecdsa_verify_finish(SECP384R1_ECDSA_SIGN_CTX *ctx)
 		return -1;
 	}
 
-	if (digest_finish(&ctx->digest_ctx, dgst, &dgstlen) != 1
-		|| dgstlen < 48) {
+	if (digest_finish(&ctx->digest_ctx, dgst, &dgstlen) != 1) {
 		error_print();
 		return -1;
 	}
 
-	if ((ret = secp384r1_ecdsa_do_verify(&ctx->key, dgst, &ctx->sig)) < 0) {
+	if ((ret = secp384r1_ecdsa_do_verify(&ctx->key, dgst, dgstlen, &ctx->sig)) < 0) {
 		error_print();
 		return -1;
 	}
diff --git a/tests/ecdsatest.c b/tests/ecdsatest.c
index ee27da42..449defac 100644
--- a/tests/ecdsatest.c
+++ b/tests/ecdsatest.c
@@ -55,13 +55,13 @@ static int test_ecdsa(void)
 	dgst[31] = 2;
 
 	/*
-	if (secp256r1_ecdsa_do_sign_ex(&key, k, dgst, &sig) != 1) {
+	if (secp256r1_ecdsa_do_sign_ex(&key, k, dgst, sizeof(dgst), &sig) != 1) {
 		error_print();
 		return -1;
 	}
 	*/
 
-	if (secp256r1_ecdsa_do_sign(&key, dgst, &sig) != 1) {
+	if (secp256r1_ecdsa_do_sign(&key, dgst, sizeof(dgst), &sig) != 1) {
 		error_print();
 		return -1;
 	}
@@ -72,7 +72,7 @@ static int test_ecdsa(void)
 	secp256r1_print(stderr, 0, 0, "s", sig.s);
 
 
-	if (secp256r1_ecdsa_do_verify(&key, dgst, &sig) != 1) {
+	if (secp256r1_ecdsa_do_verify(&key, dgst, sizeof(dgst), &sig) != 1) {
 		error_print();
 		return -1;
 	}
@@ -104,7 +104,48 @@ static int test_ecdsa_verify_infinity(void)
 		error_print();
 		return -1;
 	}
-	if (secp256r1_ecdsa_do_verify(&key, dgst, &sig) != 0) {
+	if (secp256r1_ecdsa_do_verify(&key, dgst, sizeof(dgst), &sig) != 0) {
+		error_print();
+		return -1;
+	}
+
+	printf("%s() ok\n", __FUNCTION__);
+	return 1;
+}
+
+static int test_ecdsa_digest_lengths(void)
+{
+	SECP256R1_KEY key;
+	uint8_t dgst32[32];
+	uint8_t dgst48[48];
+	uint8_t dgst31[31];
+	uint8_t sig[SECP256R1_ECDSA_SIGNATURE_MAX_SIZE];
+	size_t siglen;
+
+	if (secp256r1_key_generate(&key) != 1) {
+		error_print();
+		return -1;
+	}
+	memset(dgst32, 0x32, sizeof(dgst32));
+	memset(dgst48, 0x48, sizeof(dgst48));
+	memset(dgst31, 0x31, sizeof(dgst31));
+
+	if (secp256r1_ecdsa_sign(&key, dgst32, sizeof(dgst32), sig, &siglen) != 1
+		|| siglen > sizeof(sig)
+		|| secp256r1_ecdsa_verify(&key, dgst32, sizeof(dgst32), sig, siglen) != 1) {
+		error_print();
+		return -1;
+	}
+	if (secp256r1_ecdsa_sign(&key, dgst48, sizeof(dgst48), sig, &siglen) != 1
+		|| siglen > sizeof(sig)
+		|| secp256r1_ecdsa_verify(&key, dgst48, sizeof(dgst48), sig, siglen) != 1
+		|| secp256r1_ecdsa_sign_fixlen(&key, dgst48, sizeof(dgst48), siglen, sig) != 1
+		|| secp256r1_ecdsa_verify(&key, dgst48, sizeof(dgst48), sig, siglen) != 1) {
+		error_print();
+		return -1;
+	}
+	if (secp256r1_ecdsa_sign(&key, dgst31, sizeof(dgst31), sig, &siglen) >= 0
+		|| secp256r1_ecdsa_verify(&key, dgst31, sizeof(dgst31), sig, siglen) >= 0) {
 		error_print();
 		return -1;
 	}
@@ -152,6 +193,10 @@ static int test_ecdsa_generic(void)
 		error_print();
 		return -1;
 	}
+	if (ecdsa_sign(&key, dgst32, 31, sig, &siglen) >= 0) {
+		error_print();
+		return -1;
+	}
 
 	printf("%s() ok\n", __FUNCTION__);
 	return 1;
@@ -161,6 +206,7 @@ int main(void)
 {
 	if (test_ecdsa() != 1) goto err;
 	if (test_ecdsa_verify_infinity() != 1) goto err;
+	if (test_ecdsa_digest_lengths() != 1) goto err;
 	if (test_ecdsa_generic() != 1) goto err;
 
 	printf("%s all tests passed\n", __FILE__);
diff --git a/tests/secp384r1_ecdsatest.c b/tests/secp384r1_ecdsatest.c
index 82bf622c..04611b76 100644
--- a/tests/secp384r1_ecdsatest.c
+++ b/tests/secp384r1_ecdsatest.c
@@ -40,7 +40,7 @@ static int test_secp384r1_ecdsa_do_sign(void)
 	memset(dgst, 0, sizeof(dgst));
 	dgst[47] = 2;
 
-	if (secp384r1_ecdsa_do_sign_ex(&key, k, dgst, &sig) != 1) {
+	if (secp384r1_ecdsa_do_sign_ex(&key, k, dgst, sizeof(dgst), &sig) != 1) {
 		error_print();
 		return -1;
 	}
@@ -49,7 +49,7 @@ static int test_secp384r1_ecdsa_do_sign(void)
 	secp384r1_print(stderr, 0, 0, "s", sig.s);
 
 
-	if (secp384r1_ecdsa_do_verify(&key, dgst, &sig) != 1) {
+	if (secp384r1_ecdsa_do_verify(&key, dgst, sizeof(dgst), &sig) != 1) {
 		error_print();
 		return -1;
 	}
@@ -61,7 +61,9 @@ static int test_secp384r1_ecdsa_do_sign(void)
 static int test_secp384r1_ecdsa_sign(void)
 {
 	SECP384R1_KEY key;
-	uint8_t dgst[48];
+	uint8_t dgst32[32];
+	uint8_t dgst48[48];
+	uint8_t dgst31[31];
 	uint8_t sig[SECP384R1_ECDSA_SIGNATURE_MAX_SIZE];
 	size_t siglen;
 
@@ -69,19 +71,34 @@ static int test_secp384r1_ecdsa_sign(void)
 		error_print();
 		return -1;
 	}
-	memset(dgst, 0x5a, sizeof(dgst));
+	memset(dgst32, 0x32, sizeof(dgst32));
+	memset(dgst48, 0x48, sizeof(dgst48));
+	memset(dgst31, 0x31, sizeof(dgst31));
 
-	if (secp384r1_ecdsa_sign(&key, dgst, sig, &siglen) != 1
+	if (secp384r1_ecdsa_sign(&key, dgst48, sizeof(dgst48), sig, &siglen) != 1
 		|| siglen > sizeof(sig)) {
 		error_print();
 		return -1;
 	}
-	if (secp384r1_ecdsa_verify(&key, dgst, sig, siglen) != 1) {
+	if (secp384r1_ecdsa_verify(&key, dgst48, sizeof(dgst48), sig, siglen) != 1) {
 		error_print();
 		return -1;
 	}
-	dgst[0] ^= 0x01;
-	if (secp384r1_ecdsa_verify(&key, dgst, sig, siglen) != 0) {
+	dgst48[0] ^= 0x01;
+	if (secp384r1_ecdsa_verify(&key, dgst48, sizeof(dgst48), sig, siglen) != 0) {
+		error_print();
+		return -1;
+	}
+	if (secp384r1_ecdsa_sign(&key, dgst32, sizeof(dgst32), sig, &siglen) != 1
+		|| siglen > sizeof(sig)
+		|| secp384r1_ecdsa_verify(&key, dgst32, sizeof(dgst32), sig, siglen) != 1
+		|| secp384r1_ecdsa_sign_fixlen(&key, dgst32, sizeof(dgst32), siglen, sig) != 1
+		|| secp384r1_ecdsa_verify(&key, dgst32, sizeof(dgst32), sig, siglen) != 1) {
+		error_print();
+		return -1;
+	}
+	if (secp384r1_ecdsa_sign(&key, dgst31, sizeof(dgst31), sig, &siglen) >= 0
+		|| secp384r1_ecdsa_verify(&key, dgst31, sizeof(dgst31), sig, siglen) >= 0) {
 		error_print();
 		return -1;
 	}
@@ -144,7 +161,7 @@ static int test_secp384r1_ecdsa_verify_infinity(void)
 		error_print();
 		return -1;
 	}
-	if (secp384r1_ecdsa_do_verify(&key, dgst, &sig) != 0) {
+	if (secp384r1_ecdsa_do_verify(&key, dgst, sizeof(dgst), &sig) != 0) {
 		error_print();
 		return -1;
 	}
@@ -192,6 +209,10 @@ static int test_secp384r1_ecdsa_generic(void)
 		error_print();
 		return -1;
 	}
+	if (ecdsa_sign(&key, dgst32, 31, sig, &siglen) >= 0) {
+		error_print();
+		return -1;
+	}
 
 	printf("%s() ok\n", __FUNCTION__);
 	return 1;