How many times and where exactly is ECDSA used in Bitcoin?

Question

I'm currently a little confused about where exactly ECDSA is used in the transaction process... some resources seem to say it's used once, whereas others seem to say it's used three times.

Which is correct here?

A: ECDSA is just used to generate the public key, which is then used in the creation of the digital signature (thus ECDSA is indirectly used to create the signature). Verification then only requires the public key of the recipient.

or, B: ECDSA is used to generate the public key, then again to create the digital signature together with the public key and some hashing, then a third time to verify the signature.

I don't have a programming / computer science background, so am looking for a general description of the process as opposed to a code-based explanation (although if it really helps clarify, I don't mind!). I do know the basics of how ECDSA works.

Answer 1

A digital signature scheme, like ECDSA, is formally defined as a collection of three algorithms:

• A key generation algorithm which creates a (private key, public key) pair.
• A signing algorithm which given a message and a private key, computes a signature.
• A verification algorithm which given a message and a public key, verifies that the signature was created by the corresponding private key.

These three algorithms are used at distinct times in the lifetime of a Bitcoin transaction:

• The ECDSA key generation algorithm (*) is used when a receiver wants to create an address. The private and public key are stored in the wallet, and the public key is transformed into an address, which is then handed to the sender. The sender then constructs a transaction crediting that address.
• When the receiver wants to spend the received coins, they need to construct a transaction which "redeems" them. This involves the ECDSA signing algorithm to authorize the transaction to spend those coins, showing the owner of the coins consents to it.
• When that transactions is broadcast to the network, Bitcoin nodes and wallets will verify the transaction, as invalid transactions are not allowed. This involves the use of the ECDSA verification algorithm.

So to answer your question: it depends which algorithm you're talking about. The key generation algorithm is used once per address. The signing algorithm is used once per transaction input. The verification algorithm is performed by every node once for every transaction input.

(*) = In modern Bitcoin wallets, the addresses are not actually randomly generated anymore, but derived from a seed instead. This could be seen as choosing to use a distinct, but compatible, key generation algorithm. It's also worth noting that key generation for ECDSA isn't actually ECDSA-specific, as every 256-bit number is a valid private key, and the conversion algorithm from private key to public key is (mostly) shared across all EC-based algorithms (e.g. it is compatible with BIP340 Schnorr signatures, and the ECDH key agreement protocol).