The Elliptic Curve Digital Signature Algorithm

learn more… | top users | synonyms

3
votes
1answer
51 views

Signing a raw transaction with Python ECDSA (or OpenSSL)

I'm looking for specifics of Step15-17 from Redeeming a raw Tx Step By Step, which is essentially the step where the concatenated raw Tx structure is double sha256 hashed, and then signed with an ...
3
votes
0answers
69 views

HD wallets with an exposed child private key

HD wallets as described here are built based on a master seed and a master public key as follows: PK.b = PK.a + sG SK.b = SK.a + s I just got a little confused about this. Is s the mnemonic seed ...
4
votes
1answer
41 views

How do you invert an ECDSA multiplication to get the generator?

Pieter Wuille said: [...](people often assume that no inverse for EC multiplication exists, which is true, but only to solve for k in k*P = Q; solving for P is possible). When you multiply a ...
1
vote
0answers
30 views

How do I get hash to verify transaction?

If I have the public key and signature for a transaction how do I get the hash value that is used in verify(hash, sig, pubkey). I want to know how to work backwards from a raw transaction to get it, ...
1
vote
2answers
51 views

How can someone verify the signature of a Bitcoin ECDSA signature without knowing the signer's public key?

I understand how ECDSA exactly works and for verification of a signature, the public key of the signer is required. But in Bitcoin, public key is double hashed and the only information the receiver ...
2
votes
1answer
161 views

Is libsecp256k1 faster than OpenSSL?

Bitcoin Core is eventually going to replace OpenSSL with libsecp256k1 for all ECDSA operations. As I understand it, this is motivated by wanting consensus-critical rules to not depend on OpenSSL. Is ...
2
votes
1answer
97 views

Problems with deterministic ECDSA based on RFC6979 in Bitcoin

Generating random number k in elliptic curve is crucial and in any transactions signature in Bitcoin, random number k is required to compute a point k*G. If this k is chosen not randomly, it instantly ...
4
votes
1answer
154 views

Recovering private key when someone uses the same k twice in ECDSA signatures

In this blog: http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html the author showed a case that using same k twice will leak private key. Many people know this method. But I ...
3
votes
2answers
63 views

How do you derive the lambda and beta values for endomorphism on the secp256k1 curve?

You can see a little background about this on this bitcointalk post by the late Hal Finney. Beta and lambda are the values on the secp256k1 curve where: λ^3 (mod N) = 1 β^3 (mod P) = 1 As seen ...
1
vote
1answer
63 views

Where can I find code that allows me to calculate Z1 and Z2 from an ECDSA signature?

By following Recovering Bitcoin private keys using weak signatures from the blockchain, I am able to do other calculations, but I have no idea how to calculate Z1 or Z2. There was a public code ...
2
votes
1answer
61 views

Is normal ECDSA verification slower than a verification method based on Public Key Recovery?

Background info: This post on the Cryptography stack exchange shows how to almost uniquely recover the public key from the signature, hash of the signed data, and knowledge of the curve: ...
1
vote
3answers
160 views

ECDSA x,y coordinate validity verification doesn't seem to work

The ECDSA algorithm, secp256k1 for Bitcoin allegedly uses the equation y ^ 2 = x ^ 3 + 7 mod P to determine the validity of an alleged point upon the elliptical curve. Utilizing ...
2
votes
2answers
236 views

How does the ECDSA verification algorithm work during transaction

I understand the basic concept ECDSA where if Bob wants to sign a message it generates a random number n, multiply it with the secp256k1, r = the x value , s = (H(x)dr)*n^-1 mod q. Also the ...
1
vote
2answers
79 views

How are transactions secured?

I'm a programmer and want to get to know more about encryption and how Bitcoin works, but there is not much on the web describing how all this code works. It would help if there was some visual way to ...
1
vote
1answer
139 views

How to verify ECDSA of a sample litecoin tx using pycoin?

I'm using the litecoin testnet network for testing. I have a UTXO at 053baee857adfdc16959e9dbc9618e0e935f0a1e51e226e651fcd67242f1f462 with a vout of 0. I make a raw transaction sending the coins to ...
3
votes
1answer
126 views

How to generate a public key from a private key using Elliptic Curve Digital Signature Algorithm

I'm trying to understand the graphical basis that underlies the discreet logarithmic Elliptic Curve Digital Signature Algorithm (ECDSA) introduced in Chapter 4 of "Mastering Bitcoin" by Andreas ...
1
vote
0answers
45 views

Other ways to determine the validity of a public key

Public key 3, 4 fits the equation of y^2 = x^2 + 7 Yet this comes up as an "invalid public key". How is that invalid? Sure, it deviates extremely from other numbers, but what other equations are ...
0
votes
1answer
94 views

Modular Inverse for ECDSA in C++

I've seen several variations on "modular inverse" but I can't seem to identify the proper way of utilizing it for C++. I'm not sure how this python code translates into c++: def inverse(x, p): """ ...
0
votes
1answer
150 views

Programming and the ECDSA equation

I've been implementing point addition into a c++ program I've written but I don't see how this can be done right. When I do slope = (y1 - y2)/(x1 - x2) I get a freaking decimal, which doesn't produce ...
3
votes
3answers
1k views

ECDSA Signature and the “z” value

The following link contains details on how to reverse the ECDSA signature if given two identical "R" values. http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html I have read ...
1
vote
1answer
172 views

How to get the Z value aka Hash of the outputs to be signed

I get it that the "OP_CHECKSIG" does this, but I can't see how to recreate it. I tried SHA1 and SHA256 of some of the info in a given bitcoin transaction but it didn't give me confirmed values of Z. ...
3
votes
2answers
280 views

Bitcoin private key, location on ECC curve

In the ECDSA algorithm, the Bitcoin private key is supposedly a point on the graph (or is it?). But the private key is a single integer, and not x,y coordinates. Is the integer, by itself, the x ...
0
votes
0answers
100 views

How do you do point multiplication in bitcoin associated with the ecdsa algorithm?

I have posted a similar question recently, but not this specific. I have found that a lot may ride on the idea of "point multiplication" yet all explanations I have found lack explanation or are in ...
3
votes
2answers
654 views

How do you get a Bitcoin Public Key from a Private Key (this is a NEW question)

How do I, in extreme specificity, convert a given private bitcoin key into a public bitcoin key (Talk to me like I'm 5 and I have to do this step by step or the evil witch will cook me alive in her ...
2
votes
2answers
68 views

In ScriptSig, which form of the public key is considered canonical?

In the standard pay-to-pubKeyHash scriptSig, which form of the public key should be used. My understanding is that both the compressed (33 bytes) and the expanded (64 bytes) are both valid. Is there ...
6
votes
1answer
383 views

What's the rationale of using ECDSA instead of RSA?

One major drawback of (EC)DSA is that it requires a good RNG, otherwise the private key may be accidentally exposed. This is also one of the major reasons (I found so far) why no(?) smartcard supports ...
0
votes
1answer
740 views

Public key from private key generation problem

I met some problems, when I was trying to write function able to create Bitcoin public key from private key. I was using the tutorial: ...
1
vote
2answers
462 views

How to find out the ECDSA private key perfix version for Altcoins?

I want to create a paperwallet for an altcoin (Protoshares). I know the public key version byte is 0x38 (56) and the addresses start with P... But how do I find out the ECDSA private key prefix? For ...
2
votes
1answer
163 views

Why do keys need both X and Y coordinates, if X can be solved for Y using the curve equation?

Reference: https://en.bitcoin.it/wiki/File:PubKeyToAddr.png and https://en.bitcoin.it/wiki/Secp256k1 Why do we need both X and Y to make a private key?
5
votes
1answer
248 views

Why use DER encoding for signatures?

A signature in secp256k1 is two 32 byte numbers. DER encoding a signature adds about 6-7 bytes. It also needlessly complicates things (is DER encoding used anywhere else?). In a transaction format ...
1
vote
2answers
408 views

How are brain wallets generated?

How do sites like blockchain.info and bitaddress.org generate private keys by simply hashing a string? (the passphrase?) In this wiki article, ...
3
votes
1answer
331 views

What are the advantages of using Secp256k1?

Bitcoin uses secp256k1 as the specification for it's address system (https://en.bitcoin.it/wiki/Secp256k1). What are the advantages (and disadvantages) of using this over other specifications such as ...
1
vote
1answer
127 views

Would a transition to a different signature scheme be feasible?

The recent problem with Android's SecureRandom PRNG once again shows that using (EC)DSA can go horribly wrong if the signature nonce is ever reused. There is an elliptic curve signature scheme that ...
4
votes
1answer
1k views

Why the signature is always 65 (1+32+32) bytes long?

A signature created by the Bitcoin-Qt client can always be decoded (base64) to a 65-byte array. This array seems (according to https://github.com/bitcoin/bitcoin/blob/master/src/key.cpp#L217) to ...
8
votes
2answers
1k views

How vulnerable is bitcoin to quantum algorithms? [duplicate]

Assuming that quantum computers are implemented some time in the near-ish future, how vulnerable is Bitcoin to decryption via quantum algorithms? For example, Shor's algorithm enables a quantum ...
7
votes
2answers
1k views

If SHA256 and/or RIPEMD-160 were broken, would all bitcoin addresses be compromised?

If not, what else would be needed to steal all funds from all people and completely break bitcoin? I bet some will say ECSDA gives bitcoin an additional layer of protection. I counter this by saying ...
1
vote
3answers
68 views

Is the generator G of the keypair always the same number for all different tx messages in Bitcoin?

If so, what is that number and why can't you divide the public key by G to obtain the private key?
4
votes
2answers
252 views

How much time it takes to verify a Bitcoin signature in the Satoshi client?

Assuming: An average modern computer Using a single thread, as the current Satoshi client does Using the OpenSSL library, as the Satoshi Bitcoin client does The signature is not in the signature ...
4
votes
1answer
384 views

ECDSA transaction signing on a smartcard?

I know that the underlying digitial signing method Bitcoin uses for transactions is ECDSA (sep256k1 if memory serves). I've also read a few papers about performing ECDSA signing on certain kinds of ...
3
votes
2answers
3k views

For a non-technical person, how do I generate a ECDSA key pair easily?

I want to know because I would like to generate a vanity address at Vanity Pool.
4
votes
2answers
405 views

Storage of Private Keys

Most web apps that accept bitcoin (whether it's an exchange, a gambling site, etc) provide the user with a public address for depositing bitcoins into their account. How are these web applications ...
5
votes
4answers
931 views

Which programming languages support secp256k1?

Which programming languages have some ready libraries that support Bitcoin's ECDSA curve - secp256k1?
4
votes
1answer
324 views

What can a person do with special private keys?

The Alert message in the Standard Client will only be displayed if it is signed with a correct ECDSA private key. Should anyone get that private key, they would be able to propagate any alert through ...
3
votes
1answer
626 views

Transaction signature generation

When one sets up a transaction, the input of the transaction needs to have a script with a signature to show that you can spend those coins. Which fields of the previous and current transactions need ...
2
votes
1answer
136 views

What is the “wallet export format”?

The "wallet export format" is mentioned at the Wiki page for Mini private key format, but it doesn't seem to be explained on the Wiki. How does one convert the export format to and from corresponding ...
5
votes
2answers
2k views

ECDSA r, s encoding as a signature

An ECDSA algorithm when signing a given messages produces a pair of outputs, r and s. How, given a sigStr from a Tx can one extract r and s? Are they just concatenated byte arrays of a specific ...