How to forge a signature with fixed Z value

Question

I want to forge a signature with a fixed z value, what is the formula to do that

Answer 1

Try applying Occam's Razor. People are storing immense wealth on the Bitcoin network. If it were possible to create a valid-appearing signature for a given message without knowing the private key, any attacker using this technique would be able to steal any funds in bitcoin at will.

Which is the more likely explanation: a) ECDSA is not susceptible to the attack you propose, or b) such an attack exists, knowledge is widespread enough that you can just ask on a Q&A platform to learn about it, but people still keep piling more and more value into Bitcoin, and yet there are no reports of any thefts that fit the characteristics?

Answer 2

To add to the other answers...

It is obvious that you can't actually forge a signature on a message of your choice, under a public key you don't own. Otherwise the signature scheme is broken and useless.

However, there are some things you can do with ECDSA.

Firstly, given a public key Y for which you do not know the secret, you can choose two random numbers a,b and compute R = [a]G + [b]Y. I'll denote the x-coordinate of R as R.x. Then let s = R.x/b, and you have a valid signature (R.x, s) under public key Y on a z value z = R.x * a/b. Obviously, though, you won't feasibly be able to find a preimage for z under SHA-256 or whichever hash function used, so you haven't really found the message itself, just the hash of it. That is why the hash function is an important part of the scheme, and why you can't trust signatures on random hashes. This was described by Pieter Wuille here.

Secondly, given a valid signature (R.x, s) on a message under a public key Y, you can malleate that signature in certain ways so it is still valid but isn't the same as the original signature. The most obvious way to do this is by simply negating s modulo the order of G, because (R.x, -s) will also be a valid signature. BIP-66 and BIP-141 both discuss malleability of Bitcoin transaction signatures.

Answer 3

When third party C wishes to forge A's signature and sign the message m with it, they should follow these steps. First, it must select an integer k ∈ [1, n - 1] and compute the integer r, as described in the ECDSA algorithm. Next, it must solve for s the parity s ≡ k − 1 (h (m) + xr) mod n. However, to achieve this it is absolutely necessary to know the x and the discrete logarithm point Q based on the point P.

The hash function h must be one-way. Alternatively, an attacking C user could forge a digital signature in the following way: (A) User C selects an arbitrary integer l and calculates r from the x-coordinate of Q + lP (mod n).

(B) User C sets s = r and calculates e = rl (mod n). If C can find the message m such that e = h (m), then (r, s) is a valid signature for m. In addition, the hash function h must be free of coincidence. Otherwise, user C is forged as follows:

(A) First finds two messages m and m ′ such that h (m) = h(m′).

(B)) Next, Ask user A to sign the message m and so this signature will be valid for m ′.

Your question is unclear.