3

I have some RFC6979 test vectors, but they do not simply give me the (r,s) values before DER encoding (or so it looks?), and I haven't reached that point yet. Where could I find some (r,s) values to test against? My "expected k" values are passing tests. Perhaps the (r,s) values are in the "expected signatures" in those tests, but from my brief and naive overview, those "expected signatures" don't look like they are DER encoded, making it harder to find the (r,s) values if they are in there, and if they are not DER encoded (or are simply concatenated r,s values), they definitely are not matching my (r,s) values.

# Test Vectors for RFC 6979 ECDSA, secp256k1, SHA-256
# (private key, message, expected k, expected signature)
test_vectors = [
(0x1, "Satoshi Nakamoto", 0x8F8A276C19F4149656B280621E358CCE24F5F52542772691EE69063B74F15D15, "934b1ea10a4b3c1757e2b0c017d0b6143ce3c9a7e6a4a49860d7a6ab210ee3d82442ce9d2b916064108014783e923ec36b49743e2ffa1c4496f01a512aafd9e5"),
(0x1, "All those moments will be lost in time, like tears in rain. Time to die...", 0x38AA22D72376B4DBC472E06C3BA403EE0A394DA63FC58D88686C611ABA98D6B3, "8600dbd41e348fe5c9465ab92d23e3db8b98b873beecd930736488696438cb6b547fe64427496db33bf66019dacbf0039c04199abb0122918601db38a72cfc21"),
(0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364140, "Satoshi Nakamoto", 0x33A19B60E25FB6F4435AF53A3D42D493644827367E6453928554F43E49AA6F90, "fd567d121db66e382991534ada77a6bd3106f0a1098c231e47993447cd6af2d06b39cd0eb1bc8603e159ef5c20a5c8ad685a45b06ce9bebed3f153d10d93bed5"),
(0xf8b8af8ce3c7cca5e300d33939540c10d45ce001b8f252bfbc57ba0342904181, "Alan Turing", 0x525A82B70E67874398067543FD84C83D30C175FDC45FDEEE082FE13B1D7CFDF1, "7063ae83e7f62bbb171798131b4a0564b956930092b33b07b395615d9ec7e15c58dfcc1e00a35e1572f366ffe34ba0fc47db1e7189759b9fb233c5b05ab388ea"),
(0xe91671c46231f833a6406ccbea0e3e392c76c167bac1cb013f6f1013980455c2, "There is a computer disease that anybody who works with computers knows about. It's a very serious disease and it interferes completely with the work. The trouble with computers is that you 'play' with them!", 0x1F4B84C23A86A221D233F2521BE018D9318639D5B8BBD6374A8A59232D16AD3D, "b552edd27580141f3b2a5463048cb7cd3e047b97c9f98076c32dbdf85a68718b279fa72dd19bfae05577e06c7c0c1900c371fcd5893f7e1d56a37d30174671f6")

UPDATED: The simple question that should have been asked here is whether the expected signature values in the test vectors is a concatenation of the (r,s) values?

Improve this question
2
  • 1
    RFC6979 is just an algorithm for determining k for use in signatures. It doesn't standardize those signatures.
    – Pieter Wuille
    Commented Jan 25, 2017 at 17:39
  • Thanks for the clarification. Any idea what the (r,s) values are for these test vectors, or where I could find them?
    – user31364
    Commented Jan 25, 2017 at 17:46

1 Answer 1

Reset to default
2

I got the code at the link working. I changed it to print out the r and s values, as integers. Here's the output:

Satoshi Nakamoto
Chosen k: 8F8A276C19F4149656B280621E358CCE24F5F52542772691EE69063B74F15D15
moop
r: 66622713665624427733710315200720396955896638749566533714623508373930515555288 s:16401300452320261922100688354512281705028622471755817586694009013603023182309
934b1ea10a4b3c1757e2b0c017d0b6143ce3c9a7e6a4a49860d7a6ab210ee3d82442ce9d2b916064108014783e923ec36b49743e2ffa1c4496f01a512aafd9e5

All those moments will be lost in time, like tears in rain. Time to die...
Chosen k: 38AA22D72376B4DBC472E06C3BA403EE0A394DA63FC58D88686C611ABA98D6B3
moop
r: 60611438911297328155264284136120185534961497394771823148199442423678177430379 s:38220258097294752743694075290588542165294424403629339082999643400395224316961
8600dbd41e348fe5c9465ab92d23e3db8b98b873beecd930736488696438cb6b547fe64427496db33bf66019dacbf0039c04199abb0122918601db38a72cfc21

Satoshi Nakamoto
Chosen k: 33A19B60E25FB6F4435AF53A3D42D493644827367E6453928554F43E49AA6F90
moop
r: 114587962745838830171448197200444659591387908870320524443108372009107275313872 s:48499600335260046562000866997276068009819539503968508603040685330893406191317
fd567d121db66e382991534ada77a6bd3106f0a1098c231e47993447cd6af2d06b39cd0eb1bc8603e159ef5c20a5c8ad685a45b06ce9bebed3f153d10d93bed5

Alan Turing
Chosen k: 525A82B70E67874398067543FD84C83D30C175FDC45FDEEE082FE13B1D7CFDF1
moop
r: 50835161360784658679705989314730945582474852067950813193648029527990723928412 s:40198946335893372669406153083310089209828282845073389510128517794926842579178
7063ae83e7f62bbb171798131b4a0564b956930092b33b07b395615d9ec7e15c58dfcc1e00a35e1572f366ffe34ba0fc47db1e7189759b9fb233c5b05ab388ea

There is a computer disease that anybody who works with computers knows about. It's a very serious disease and it interferes completely with the work. The trouble with computers is that you 'play' with them!
Chosen k: 1F4B84C23A86A221D233F2521BE018D9318639D5B8BBD6374A8A59232D16AD3D
r: 82015148440730259881706720884713319746656362638681409313456646334089680941451 s:17922283604959101703896856980526902590000569471101320808251512455147251200502
b552edd27580141f3b2a5463048cb7cd3e047b97c9f98076c32dbdf85a68718b279fa72dd19bfae05577e06c7c0c1900c371fcd5893f7e1d56a37d30174671f6
Improve this answer
8
  • So it seems that the 'expected signature' field is indeed the concatenation (of the hex encoding) of r and s. From Pieter's answer I am guessing this is prior to any 'standardization'.
    – Sven Williamson
    Commented Jan 25, 2017 at 19:02
  • Indeed. I just needed verification that the (r,s) values were concatenated for these test vectors, which this answer seems to verify.
    – user31364
    Commented Jan 25, 2017 at 19:20
  • So, my r is fine, but I can't seem to get s. It may be a little off topic for this post, so I'll just ask one question. Currently I am hashing the message with SHA256 and doing nothing with the private key before I run them through my operations. Does this sound correct?
    – user31364
    Commented Jan 26, 2017 at 2:10
  • 3
    @BrettDoffing Contrary to what we assumed, it turns out that these signatures have been standardized. Unless you 'standardize' your number s yourself, you will not be able to match (except for the 5th signature). Standardizing means replacing s by -s (mod q) whenever s is greater than q/2, where q is the order of the group underlying secp256k1.
    – Sven Williamson
    Commented Jan 26, 2017 at 12:50
  • 1
    @SvenWilliamson Thank you so much for pointing that out! In being so naive, I have been looking at my other resources, and didn't, or probably wouldn't, have recognized what the post was saying. I was just interested in the test vectors. This has indeed allowed me to produce s!!
    – user31364
    Commented Jan 26, 2017 at 13:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.