The Elliptic Curve Digital Signature Algorithm

learn more… | top users | synonyms

0
votes
0answers
17 views

Troubleshooting pybitcointools transaction signing/verification

I'm having several problems getting tests to successfully run under my fork (or vbuterin's pybitcointools, and I'm hoping someone with a combined Python / Bitcoin knowledge can provide some insight. ...
1
vote
1answer
55 views

How can I convert a bitcoin private key (hex) into a Bitcoin public key? [duplicate]

How can I take a bitcoin private key encoded in hex: d1d9a2e9fd3da7e7710310ea17a9edff9e08845c7a6f2ea3d650ba4ae7ee0d3b and convert it to the corresponding public key: ...
5
votes
1answer
47 views

Bitcoin safe if ECDSA is broken?

I've read that one reason to use a new address for each transaction is because it hides the pubkey behind a hash, so that even if ECDSA is broken and someone is able to derive my privkey from my ...
0
votes
0answers
8 views

in ecdsa why by replacing (r',s') by (r,s)[r'=r & s'= -s], the signature still remain valid? [duplicate]

please explain the malleability of ecdsa in case that by replacing (r',s') by (r,s)[r'=r & s'= -s], the signature still remain valid. I can't understand why it remains valid!
0
votes
2answers
35 views

Signing data with ECDSA

I was reading about the math behind bitcoins in this article, and one thing I can't seem to wrap my head around is how the said algorithm is used to sign "data". What exactly is this "data"? Is it my ...
2
votes
1answer
100 views

Can't find correct z1 & z2 for transaction

I've been trying to understand the issue and repeat Willem Hengeveld's answer, but I think I'm failing at getting correct script for hash. I'm looking for this transaction, my scripts are: ...
1
vote
1answer
36 views

how base point of bitcoin public key x , y formed

n = FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364140 p = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F base point of bitcoin public key x , y Gx = ...
0
votes
3answers
102 views

How Bitcoin handles addresses collisions?

Since the addresses are hashes of a public portion of a public/private ECDSA keypair, what would happen to two different people with different keys that hashes into the same address? How would ...
1
vote
1answer
80 views

ECKey.ECDSASignature creation

I have my ECKey key. In order to create an ECDSASignature object with BitcoinJ, we have to call ECDSASignature mySignature = key.sign(Sha256Hash input). Is the Sha256Hash input my message? Or is it ...
1
vote
1answer
48 views

Verifing the given R/S pair (signature) against a hash using the public key

According to this function: public boolean verify(Sha256Hash sigHash, ECDSASignature signature) { return ECKey.verify(sigHash.getBytes(), signature, getPubKey()); } I do not understand ...
1
vote
1answer
297 views

PEM format for ECDSA

I have been looking at Coinapult's API documentation which details the use of PEM format in python-ecdsa. Specifically, private keys and public keys need to be formatted using PEM. Let's take ...
1
vote
0answers
62 views

Cryptocurrencies based on RSA instead of ECDSA

Bitcoin is based on ECDSA. Does anyone know of cryptocurrencies based on RSA for authentication?
4
votes
1answer
103 views

Why isn't Bitcoin using public key extraction from signature to reduce the blockchain size?

Why doesn't Bitcoin use public key recovering from the signature in order to reduce the Blockchain size? This would save 32 bytes per transaction input.
1
vote
1answer
53 views

How does ripple verify the signature?

As I understand, the client send the following information to server 1.the hash of the message, 2. public key 3. signature made by private key And the server verified the signature with the ...
2
votes
1answer
31 views

Are there any signatures where the recid (v) is equal to 29,30 (or 33,34 compressed)?

Peter Wuille recently explained how ECDSA pubkey recovery is done, in response to my question. So it's basically that for a given base64 signature, the value v in v,r,s provides the specific ...
9
votes
1answer
258 views

Why was the Oct 2015 Transaction Malleability event possible in spite of BIP62/66?

The recent re-emergence of transaction malleability has been responsible for a large number of Txs which are being double spent (October 2015). /r/Bitcoin has posted some C++ code which @amaclin has ...
0
votes
1answer
80 views

How do I add two secp256k1 keys together?

I have two public/private keypairs, A and B. I want to add them together to get a new keypair AB. I'd also like to be able to add the public keys of A and B to get the public key of AB. How do I do ...
1
vote
2answers
82 views

Why are r and s modulo N? (not P)

As Peter Wuille mentions here, the ECDSA signature values (r, s) are modulo N (eg verifying ECDSA signatures, where u1 = z * w % N), whereas the rest of the ECDSA functionality in Bitcoin seems to be ...
2
votes
1answer
150 views

Bitcoin how to get X value from Y

How to get X value from Y? ECDSA x,y coordinate validity verification doesn't seem to work X = 0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798 Python code, p = ...
2
votes
1answer
191 views

The shortest ECDSA signature

I want to create ECDSA signature {r,s} where r is very low (for example 1) and can be encoded in DER-format in one byte. How to calculate k value? Seems to me that it does not depend of anything. ...
5
votes
2answers
248 views

ECDSA: (v, r, s), what is v?

Deterministically signing a Tx with RFC6979 returns v, r, s, where r and s are the 2 values used in standard ECDSA signatures. v = 27 + (y % 2), so 27 + the parity of r, as pybitcointools indicates. ...
3
votes
2answers
116 views

The complement of s (when s < curve order / 2)

Bitcoinlib refers to the requirement that if s > ORDER / 2, then the complement of s should be used instead since it's one byte shorter This sounds like it's referring to the inverse or negative s ...
0
votes
0answers
220 views

Any bitcoin transaction to get S1 and Z1 and R value script need

bitcoin transaction to get S1 and Z1 and R value script need Need script that gives bitcoin translation to S1 and Z1 and R value like below link http://2coin.org/txinfo.aspx?txid=...
-1
votes
1answer
252 views

converting RUBY script into PYTHON ( Recovering private key when someone uses the same k twice )

require 'ecdsa' public_key_hex = '02a50eb66887d03fe186b608f477d99bc7631c56e64bb3af7dc97e71b917c5b364' msghash1_hex = '01b125d18422cdfa7b153f5bcf5b01927cf59791d1d9810009c70cd37b14f4e6' msghash2_hex = '...
1
vote
0answers
351 views

Same identical R value of all transaction not provide corresponding privatekey

ECDSA Signature and the “z” value from above link learn calculation of z value and to get private key https://blockchain.info/tx/9ec4bc49e828d924af1d1029cacf709431abbde46d59554b62bc270e3b29c4b1 ...
0
votes
1answer
289 views

Two identical R value finding z value from two transaction

tx1 from the trans1 i got Input Scripts 30450220262e481b6d8905b5adba67aff05eb8261501b0a9434c0b7f043d00cf8d23c91b022100bf82c0d212f30d3a0599e9b879516d762eaf5688ab83787cf470e99af5a6917101 ...
0
votes
1answer
276 views

same R value is used for two different addresses? finding z1 and z2 value and privatekey

txid1 txid2 input script 1 304502206bcc247f1259262b4035bfa84f0397a69f69baa01659daaf94fe1164b650c86a022100a044b38e8264a1c928ddd28b4657aa7109d1ea30e911208c7ce57abcb1451fe601 ...
4
votes
1answer
122 views

bitcoin two identical R

Blockchain transaction id 30440220d47ce4c025c35ec440bc81d99834a624875161a26bf56ef7fdc0f5d52f843ad1022044e1ff2dfd8102cf7a47c21d5c9fd5701610d04953c6836596b4fe9dd2f53e3e01 ...
1
vote
3answers
115 views

In Elliptic Curve Addition, where does the second point come from?

I have a limited understanding of elliptic curve terminology, but if you can bear with me I'd like to ask this question anyway. I'll start with what I understand... You do EC multiplication with the ...
2
votes
1answer
96 views

Signature: encoding a message - transaction to a point of curve y^2=x^3+7 and Bitcoin Core

Where should I look at in Bitcoin Core source code to figure out how the signature process trasform a message in a curve point? To sign a transaction (message) in Bitcoin system, you need to encode ...
3
votes
1answer
1k views

Signing a raw transaction with Python ECDSA (or OpenSSL)

I'm looking for specifics of Step15-17 from Redeeming a raw Tx Step By Step, which is essentially the step where the concatenated raw Tx structure is double sha256 hashed, and then signed with an ...
5
votes
1answer
152 views

How do you invert an ECDSA multiplication to get the generator?

Pieter Wuille said: [...](people often assume that no inverse for EC multiplication exists, which is true, but only to solve for k in k*P = Q; solving for P is possible). When you multiply a ...
1
vote
0answers
104 views

How do I get hash to verify transaction?

If I have the public key and signature for a transaction how do I get the hash value that is used in verify(hash, sig, pubkey). I want to know how to work backwards from a raw transaction to get it, ...
3
votes
2answers
296 views

How can someone verify the signature of a Bitcoin ECDSA signature without knowing the signer's public key?

I understand how ECDSA exactly works and for verification of a signature, the public key of the signer is required. But in Bitcoin, public key is double hashed and the only information the receiver ...
6
votes
1answer
541 views

Is libsecp256k1 faster than OpenSSL?

Bitcoin Core is eventually going to replace OpenSSL with libsecp256k1 for all ECDSA operations. As I understand it, this is motivated by wanting consensus-critical rules to not depend on OpenSSL. Is ...
6
votes
1answer
461 views

Problems with deterministic ECDSA based on RFC6979 in Bitcoin

Generating random number k in elliptic curve is crucial and in any transactions signature in Bitcoin, random number k is required to compute a point k*G. If this k is chosen not randomly, it instantly ...
6
votes
1answer
2k views

Recovering private key when someone uses the same k twice in ECDSA signatures

In this blog: http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html the author showed a case that using same k twice will leak private key. Many people know this method. But I ...
5
votes
3answers
272 views

How do you derive the lambda and beta values for endomorphism on the secp256k1 curve?

You can see a little background about this on this bitcointalk post by the late Hal Finney. Beta and lambda are the values on the secp256k1 curve where: λ^3 (mod N) = 1 β^3 (mod P) = 1 As seen ...
1
vote
1answer
330 views

Where can I find code that allows me to calculate Z1 and Z2 from an ECDSA signature?

By following Recovering Bitcoin private keys using weak signatures from the blockchain, I am able to do other calculations, but I have no idea how to calculate Z1 or Z2. There was a public code ...
4
votes
1answer
135 views

Is normal ECDSA verification slower than a verification method based on Public Key Recovery?

Background info: This post on the Cryptography stack exchange shows how to almost uniquely recover the public key from the signature, hash of the signed data, and knowledge of the curve: http://...
1
vote
3answers
369 views

ECDSA x,y coordinate validity verification doesn't seem to work

The ECDSA algorithm, secp256k1 for Bitcoin allegedly uses the equation y ^ 2 = x ^ 3 + 7 mod P to determine the validity of an alleged point upon the elliptical curve. Utilizing http://web2.0calc....
5
votes
2answers
834 views

How does the ECDSA verification algorithm work during transaction?

I understand the basic concept ECDSA where if Bob wants to sign a message it generates a random number n, multiply it with the secp256k1, r = the x value , s = (H(x)dr)*n^-1 mod q. Also the ...
1
vote
2answers
118 views

How are transactions secured?

I'm a programmer and want to get to know more about encryption and how Bitcoin works, but there is not much on the web describing how all this code works. It would help if there was some visual way to ...
1
vote
1answer
345 views

How to verify ECDSA of a sample litecoin tx using pycoin?

I'm using the litecoin testnet network for testing. I have a UTXO at 053baee857adfdc16959e9dbc9618e0e935f0a1e51e226e651fcd67242f1f462 with a vout of 0. I make a raw transaction sending the coins to ...
3
votes
1answer
551 views

How to generate a public key from a private key using Elliptic Curve Digital Signature Algorithm

I'm trying to understand the graphical basis that underlies the discreet logarithmic Elliptic Curve Digital Signature Algorithm (ECDSA) introduced in Chapter 4 of "Mastering Bitcoin" by Andreas ...
0
votes
0answers
64 views

Other ways to determine the validity of a public key

Public key 3, 4 fits the equation of y^2 = x^2 + 7 Yet this comes up as an "invalid public key". How is that invalid? Sure, it deviates extremely from other numbers, but what other equations are ...
0
votes
1answer
156 views

Modular Inverse for ECDSA in C++

I've seen several variations on "modular inverse" but I can't seem to identify the proper way of utilizing it for C++. I'm not sure how this python code translates into c++: def inverse(x, p): """ ...
0
votes
1answer
181 views

Programming and the ECDSA equation

I've been implementing point addition into a c++ program I've written but I don't see how this can be done right. When I do slope = (y1 - y2)/(x1 - x2) I get a freaking decimal, which doesn't produce ...
4
votes
3answers
3k views

ECDSA Signature and the “z” value

The following link contains details on how to reverse the ECDSA signature if given two identical "R" values. http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html I have read ...
1
vote
1answer
403 views

How to get the Z value aka Hash of the outputs to be signed

I get it that the "OP_CHECKSIG" does this, but I can't see how to recreate it. I tried SHA1 and SHA256 of some of the info in a given bitcoin transaction but it didn't give me confirmed values of Z. ...