-3

I want to forge a signature with a fixed z value, what is the formula to do that

5
  • Hi! What do you mean by the z value? Do you mean the hash of the message being signed? It would be helpful to have a bit more info
    – meshcollider
    Dec 13 '21 at 7:19
  • Yes hash of the message being signed
    – Gwer
    Dec 13 '21 at 8:17
  • 1
    And when you say "forge", do you want to forge a signature on a given z under a specific public key (for which you don't know the secret)? Or just create a signature under any key on that given z
    – meshcollider
    Dec 13 '21 at 10:00
  • I think he wants to know if it is possible to forge a signature for a fixed z or double sha256 of the unsigned transaction, without knowing the private key.
    – T M
    Dec 13 '21 at 13:49
  • 3
    To the best of my knowledge, the only way to produce a "forged" signature that passes basic scrutiny is to successfully guess the actual private key and sign the message…—@TM: You showed up as an "interpreter" both on that related question by Guest34122123 and now this one again. If you know these people, could you please explain to them that they're wasting our time, and perchance suggest that they come up with a more fruitful pastime?
    – Murch
    Dec 13 '21 at 14:48
3

Try applying Occam's Razor. People are storing immense wealth on the Bitcoin network. If it were possible to create a valid-appearing signature for a given message without knowing the private key, any attacker using this technique would be able to steal any funds in bitcoin at will.

Which is the more likely explanation: a) ECDSA is not susceptible to the attack you propose, or b) such an attack exists, knowledge is widespread enough that you can just ask on a Q&A platform to learn about it, but people still keep piling more and more value into Bitcoin, and yet there are no reports of any thefts that fit the characteristics?

2

To add to the other answers...

It is obvious that you can't actually forge a signature on a message of your choice, under a public key you don't own. Otherwise the signature scheme is broken and useless.

However, there are some things you can do with ECDSA.

Firstly, given a public key Y for which you do not know the secret, you can choose two random numbers a,b and compute R = [a]G + [b]Y. I'll denote the x-coordinate of R as R.x. Then let s = R.x/b, and you have a valid signature (R.x, s) under public key Y on a z value z = R.x * a/b. Obviously, though, you won't feasibly be able to find a preimage for z under SHA-256 or whichever hash function used, so you haven't really found the message itself, just the hash of it. That is why the hash function is an important part of the scheme, and why you can't trust signatures on random hashes. This was described by Pieter Wuille here.

Secondly, given a valid signature (R.x, s) on a message under a public key Y, you can malleate that signature in certain ways so it is still valid but isn't the same as the original signature. The most obvious way to do this is by simply negating s modulo the order of G, because (R.x, -s) will also be a valid signature. BIP-66 and BIP-141 both discuss malleability of Bitcoin transaction signatures.

1
  • 1
    There is a generalization of the s negation: if you have a valid signature (r,s) for pubkey P and message z and r=R.x, then for every value a, if r'=(aR).x, it holds that (r',r's/(r'a)) is a valid signature for P and message hash z'=r'z/r. With a=-1 this gives the normal malleability formula. For other values of a, this gives signatures "valid" for message hash without known preimage. Dec 14 '21 at 4:22
1

When third party C wishes to forge A's signature and sign the message m with it, they should follow these steps. First, it must select an integer k ∈ [1, n - 1] and compute the integer r, as described in the ECDSA algorithm. Next, it must solve for s the parity s ≡ k − 1 (h (m) + xr) mod n. However, to achieve this it is absolutely necessary to know the x and the discrete logarithm point Q based on the point P.

The hash function h must be one-way. Alternatively, an attacking C user could forge a digital signature in the following way: (A) User C selects an arbitrary integer l and calculates r from the x-coordinate of Q + lP (mod n).

(B) User C sets s = r and calculates e = rl (mod n). If C can find the message m such that e = h (m), then (r, s) is a valid signature for m. In addition, the hash function h must be free of coincidence. Otherwise, user C is forged as follows:

(A) First finds two messages m and m ′ such that h (m) = h(m′).

(B)) Next, Ask user A to sign the message m and so this signature will be valid for m ′.

Your question is unclear.

-2

z/s • G + r/s • P = r(x)

This is the magic formula above, imo. G is generator. P is the public key. R(x,y) is the point on the curve of the signature. For fixed R and z values, you have to find discrete log of s with respect to R(x,y). In other words, (G * z) + (P * r) = s*R(x,y)

3
  • 2
    This is just the ECDSA verification equation and doesn't make sense in the context of this question.
    – meshcollider
    Dec 17 '21 at 12:59
  • I do not agree with you, the second equation isn't the verification equation and he asked how to forge a transaction with a fixed z value. I specifically answered his question and provided the second formula for the discrete log to do it, possibly in sage math and or python.
    – T M
    Dec 17 '21 at 13:50
  • 2
    @T M are you suggesting that he just simply break the ECDLP?
    – meshcollider
    Dec 17 '21 at 13:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.