I want to forge a signature with a fixed z value, what is the formula to do that

  • Hi! What do you mean by the z value? Do you mean the hash of the message being signed? It would be helpful to have a bit more info Commented Dec 13, 2021 at 7:19
  • Yes hash of the message being signed
    – Gwer
    Commented Dec 13, 2021 at 8:17
  • 1
    And when you say "forge", do you want to forge a signature on a given z under a specific public key (for which you don't know the secret)? Or just create a signature under any key on that given z Commented Dec 13, 2021 at 10:00
  • I think he wants to know if it is possible to forge a signature for a fixed z or double sha256 of the unsigned transaction, without knowing the private key.
    – T M
    Commented Dec 13, 2021 at 13:49
  • 3
    To the best of my knowledge, the only way to produce a "forged" signature that passes basic scrutiny is to successfully guess the actual private key and sign the message…—@TM: You showed up as an "interpreter" both on that related question by Guest34122123 and now this one again. If you know these people, could you please explain to them that they're wasting our time, and perchance suggest that they come up with a more fruitful pastime?
    – Murch
    Commented Dec 13, 2021 at 14:48

3 Answers 3


Try applying Occam's Razor. People are storing immense wealth on the Bitcoin network. If it were possible to create a valid-appearing signature for a given message without knowing the private key, any attacker using this technique would be able to steal any funds in bitcoin at will.

Which is the more likely explanation: a) ECDSA is not susceptible to the attack you propose, or b) such an attack exists, knowledge is widespread enough that you can just ask on a Q&A platform to learn about it, but people still keep piling more and more value into Bitcoin, and yet there are no reports of any thefts that fit the characteristics?


To add to the other answers...

It is obvious that you can't actually forge a signature on a message of your choice, under a public key you don't own. Otherwise the signature scheme is broken and useless.

However, there are some things you can do with ECDSA.

Firstly, given a public key Y for which you do not know the secret, you can choose two random numbers a,b and compute R = [a]G + [b]Y. I'll denote the x-coordinate of R as R.x. Then let s = R.x/b, and you have a valid signature (R.x, s) under public key Y on a z value z = R.x * a/b. Obviously, though, you won't feasibly be able to find a preimage for z under SHA-256 or whichever hash function used, so you haven't really found the message itself, just the hash of it. That is why the hash function is an important part of the scheme, and why you can't trust signatures on random hashes. This was described by Pieter Wuille here.

Secondly, given a valid signature (R.x, s) on a message under a public key Y, you can malleate that signature in certain ways so it is still valid but isn't the same as the original signature. The most obvious way to do this is by simply negating s modulo the order of G, because (R.x, -s) will also be a valid signature. BIP-66 and BIP-141 both discuss malleability of Bitcoin transaction signatures.

  • 1
    There is a generalization of the s negation: if you have a valid signature (r,s) for pubkey P and message z and r=R.x, then for every value a, if r'=(aR).x, it holds that (r',r's/(r'a)) is a valid signature for P and message hash z'=r'z/r. With a=-1 this gives the normal malleability formula. For other values of a, this gives signatures "valid" for message hash without known preimage. Commented Dec 14, 2021 at 4:22

When third party C wishes to forge A's signature and sign the message m with it, they should follow these steps. First, it must select an integer k ∈ [1, n - 1] and compute the integer r, as described in the ECDSA algorithm. Next, it must solve for s the parity s ≡ k − 1 (h (m) + xr) mod n. However, to achieve this it is absolutely necessary to know the x and the discrete logarithm point Q based on the point P.

The hash function h must be one-way. Alternatively, an attacking C user could forge a digital signature in the following way: (A) User C selects an arbitrary integer l and calculates r from the x-coordinate of Q + lP (mod n).

(B) User C sets s = r and calculates e = rl (mod n). If C can find the message m such that e = h (m), then (r, s) is a valid signature for m. In addition, the hash function h must be free of coincidence. Otherwise, user C is forged as follows:

(A) First finds two messages m and m ′ such that h (m) = h(m′).

(B)) Next, Ask user A to sign the message m and so this signature will be valid for m ′.

Your question is unclear.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.