Elliptic Curve Signature Verify

ECVerify is the payoff node of the pack's ECDSA signing chain: it takes a public key, a signature, and some data, and answers the only question that matters - did this really get signed by the matching private key? - with a single BOOLEAN. It's "Elliptic Curve Signature Verify," and if you've built a signing workflow with ECPrivateKey + ECSign, this is how you close the loop on the receiving side.

What it needs

Three required inputs, all forced-input types, so it only works when you wire things in:

• public_key (KEYOBJ) - the parsed public key. Feed it ECPublicKey's public_key output, or a key you loaded via DERPublicKey/PEMPublicKey. Remember it's the pack's KEYOBJ type, not serialized bytes - paste in public_bytes and it won't connect.
• signature (BYTESLIKE) - the signature blob from ECSign.
• data (BYTESLIKE) - the exact bytes that were signed. "Exact" is doing a lot of work here: a trailing newline, a space, a different encoding, and verification silently fails. Both sides must be signing the same byte sequence.
• signature_algorithm - must match the signer's choice exactly (SHA256, SHA384, SHA-3, BLAKE2, all 15 of them). The verify side re-hashes the data with this and compares against the ECDSA signature.
• prehashed (optional) - mirror ECSign's setting. If the signer had prehashed on, so must you.

The output

• verification (BOOLEAN) - True if the signature checks out, False if not. That's the entire output, so wire it into a BooleanOutputter (same pack) or any node that takes a boolean. ComfyUI will show you the value in the node's output widget too, which is usually enough for debugging.

The mechanism, briefly

ECDSA signs a hash of the data, not the data itself. On verify, the node re-hashes data with your chosen signature_algorithm (via ec.ECDSA(algorithm)), runs public_key.verify(signature, data, alg), and catches InvalidSignature/ValueError to return False instead of crashing. Which means the failure modes are mostly boring and correct: wrong key, wrong hash, or tampered data all just return False. No loud errors, just a "no."

Installing it

Same pack, same install:

cd ComfyUI/custom_nodes
git clone https://github.com/AzelusLightvale/ComfyUI-ARG-Toolkit

Restart ComfyUI. ComfyUI Manager can do it too - search "ComfyUI ARG Toolkit" - and it'll grab the pip deps (cryptography is the verifier's engine) automatically.

Where people get burned

• Verifying bytes that don't match. This is the big one. If the message went through a ByteslikeEncode/decode round trip, or text got case-normalized somewhere, the signature won't verify. Sign and verify the exact same bytes.
• Algorithm drift. SHA256 on the sign side, SHA384 on the verify side → permanent False. Keep them locked together.
• Wrong key. A public key derived from a different private key - or a different curve - returns False every time, and there's no message explaining why. Check your key_source wiring in ECPublicKey if you're using Fresh Key on the wrong node.
• Reading too much into it. A True proves the holder of the matching private key signed those exact bytes. It does not prove the data is true, useful, or from a person you'd trust - that's the standard caveat with signatures.

For an ARG, this is where "is this real?" gets a mechanical answer. Embed a signature in a watermark, and this node is the automated proof-checker at the end of the trail.