Elliptic Curve Signature Sign

If you want to hand someone a message and have them prove it came from you - not guess, prove - this is the node. ECSign takes a private key and some data and produces an ECDSA signature, the mathematical stamp that ECVerify can later check against your public key. It's the "sign" half of a real public-key-signature loop living inside ComfyUI, and it's about as close to actual production crypto as this pack gets.

What it needs

• private_key (KEYOBJ) - from ECPrivateKey's private_key output. Note it's a key object, not bytes; a beginner tries to feed it the serialized keyfile and gets a type error. The KEYOBJ type is this pack's own thing.
• data (BYTESLIKE) - the bytes you're signing. Again the pack's type: run your text through a ByteslikeEncode/String2Binary-style node first. You sign bytes, not strings.
• signature_algorithm - the hash used in the ECDSA scheme. The dropdown has 15 entries: the SHA-2 family (SHA256, SHA384, SHA512, the truncated SHA512_224/SHA512_256), SHA-3 (SHA3_256 and friends), BLAKE2b/s, plus SHA1, MD5, and SM3 for completeness. SHA256 is the sane default; MD5 and SHA1 exist because the pack covers everything, not because you should use them for anything real.
• prehashed (optional) - set this if your data is already the output of a hash, not the raw message. It wraps the hash in Prehashed, so the node signs your digest directly. Leave it off unless you know what you're doing; signing an un-hashed message with this on produces a signature nobody can verify normally.

The output

• signature (BYTESLIKE) - the signature bytes, wire them into ECVerify's signature input on the checking side. They're not readable as text; treat them as a blob to transport or embed.

How the pieces fit

A complete loop is three nodes: ECPrivateKey generates the keypair, ECSign stamps your data with the private half, and ECVerify + ECPublicKey on the other side confirm it. The signature is deterministic given the same key, hash, and data - ECDSA signs the hash of the data, so the receiver hashes the same way and compares. That's why signature_algorithm and prehashed must match exactly between signer and verifier; SHA256 on one side and SHA384 on the other silently fails.

Installing it

It's part of the ComfyUI ARG Toolkit, so one install covers it:

cd ComfyUI/custom_nodes
git clone https://github.com/AzelusLightvale/ComfyUI-ARG-Toolkit

Restart ComfyUI afterward. ComfyUI Manager also has it under "ComfyUI ARG Toolkit" and will pull cryptography (the actual signing engine) plus the rest of the pack's dependencies for you.

Where people get burned

• Signing strings instead of bytes. data is BYTESLIKE. Route text through the pack's converters or you'll be stuck at the cable.
• Hash mismatch. The verifier must pick the same signature_algorithm. This is the single most common failure in real signature workflows.
• Fresh keys. If your ECPrivateKey is set to generate a new key every run, the signature changes too, and the public key the verifier holds is useless. Save and reuse the key for a stable identity.

ECSign is the node you reach for when a puzzle demands authenticity rather than secrecy - anyone can encrypt, but only the key holder can sign.