I have some RFC6979 test vectors, but they do not simply give me the (r,s) values before DER encoding (or so it looks?), and I haven't reached that point yet. Where could I find some (r,s) values to test against? My "expected k" values are passing tests. Perhaps the (r,s) values are in the "expected signatures" in those tests, but from my brief and naive overview, those "expected signatures" don't look like they are DER encoded, making it harder to find the (r,s) values if they are in there, and if they are not DER encoded (or are simply concatenated r,s values), they definitely are not matching my (r,s) values.

# Test Vectors for RFC 6979 ECDSA, secp256k1, SHA-256
# (private key, message, expected k, expected signature)
test_vectors = [
(0x1, "Satoshi Nakamoto", 0x8F8A276C19F4149656B280621E358CCE24F5F52542772691EE69063B74F15D15, "934b1ea10a4b3c1757e2b0c017d0b6143ce3c9a7e6a4a49860d7a6ab210ee3d82442ce9d2b916064108014783e923ec36b49743e2ffa1c4496f01a512aafd9e5"),
(0x1, "All those moments will be lost in time, like tears in rain. Time to die...", 0x38AA22D72376B4DBC472E06C3BA403EE0A394DA63FC58D88686C611ABA98D6B3, "8600dbd41e348fe5c9465ab92d23e3db8b98b873beecd930736488696438cb6b547fe64427496db33bf66019dacbf0039c04199abb0122918601db38a72cfc21"),
(0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364140, "Satoshi Nakamoto", 0x33A19B60E25FB6F4435AF53A3D42D493644827367E6453928554F43E49AA6F90, "fd567d121db66e382991534ada77a6bd3106f0a1098c231e47993447cd6af2d06b39cd0eb1bc8603e159ef5c20a5c8ad685a45b06ce9bebed3f153d10d93bed5"),
(0xf8b8af8ce3c7cca5e300d33939540c10d45ce001b8f252bfbc57ba0342904181, "Alan Turing", 0x525A82B70E67874398067543FD84C83D30C175FDC45FDEEE082FE13B1D7CFDF1, "7063ae83e7f62bbb171798131b4a0564b956930092b33b07b395615d9ec7e15c58dfcc1e00a35e1572f366ffe34ba0fc47db1e7189759b9fb233c5b05ab388ea"),
(0xe91671c46231f833a6406ccbea0e3e392c76c167bac1cb013f6f1013980455c2, "There is a computer disease that anybody who works with computers knows about. It's a very serious disease and it interferes completely with the work. The trouble with computers is that you 'play' with them!", 0x1F4B84C23A86A221D233F2521BE018D9318639D5B8BBD6374A8A59232D16AD3D, "b552edd27580141f3b2a5463048cb7cd3e047b97c9f98076c32dbdf85a68718b279fa72dd19bfae05577e06c7c0c1900c371fcd5893f7e1d56a37d30174671f6")

UPDATED: The simple question that should have been asked here is whether the expected signature values in the test vectors is a concatenation of the (r,s) values?

  • 1
    RFC6979 is just an algorithm for determining k for use in signatures. It doesn't standardize those signatures. Jan 25, 2017 at 17:39
  • Thanks for the clarification. Any idea what the (r,s) values are for these test vectors, or where I could find them?
    – user31364
    Jan 25, 2017 at 17:46

1 Answer 1


I got the code at the link working. I changed it to print out the r and s values, as integers. Here's the output:

Satoshi Nakamoto
Chosen k: 8F8A276C19F4149656B280621E358CCE24F5F52542772691EE69063B74F15D15
r: 66622713665624427733710315200720396955896638749566533714623508373930515555288 s:16401300452320261922100688354512281705028622471755817586694009013603023182309

All those moments will be lost in time, like tears in rain. Time to die...
Chosen k: 38AA22D72376B4DBC472E06C3BA403EE0A394DA63FC58D88686C611ABA98D6B3
r: 60611438911297328155264284136120185534961497394771823148199442423678177430379 s:38220258097294752743694075290588542165294424403629339082999643400395224316961

Satoshi Nakamoto
Chosen k: 33A19B60E25FB6F4435AF53A3D42D493644827367E6453928554F43E49AA6F90
r: 114587962745838830171448197200444659591387908870320524443108372009107275313872 s:48499600335260046562000866997276068009819539503968508603040685330893406191317

Alan Turing
Chosen k: 525A82B70E67874398067543FD84C83D30C175FDC45FDEEE082FE13B1D7CFDF1
r: 50835161360784658679705989314730945582474852067950813193648029527990723928412 s:40198946335893372669406153083310089209828282845073389510128517794926842579178

There is a computer disease that anybody who works with computers knows about. It's a very serious disease and it interferes completely with the work. The trouble with computers is that you 'play' with them!
Chosen k: 1F4B84C23A86A221D233F2521BE018D9318639D5B8BBD6374A8A59232D16AD3D
r: 82015148440730259881706720884713319746656362638681409313456646334089680941451 s:17922283604959101703896856980526902590000569471101320808251512455147251200502
  • So it seems that the 'expected signature' field is indeed the concatenation (of the hex encoding) of r and s. From Pieter's answer I am guessing this is prior to any 'standardization'. Jan 25, 2017 at 19:02
  • Indeed. I just needed verification that the (r,s) values were concatenated for these test vectors, which this answer seems to verify.
    – user31364
    Jan 25, 2017 at 19:20
  • So, my r is fine, but I can't seem to get s. It may be a little off topic for this post, so I'll just ask one question. Currently I am hashing the message with SHA256 and doing nothing with the private key before I run them through my operations. Does this sound correct?
    – user31364
    Jan 26, 2017 at 2:10
  • 3
    @BrettDoffing Contrary to what we assumed, it turns out that these signatures have been standardized. Unless you 'standardize' your number s yourself, you will not be able to match (except for the 5th signature). Standardizing means replacing s by -s (mod q) whenever s is greater than q/2, where q is the order of the group underlying secp256k1. Jan 26, 2017 at 12:50
  • 1
    @SvenWilliamson Thank you so much for pointing that out! In being so naive, I have been looking at my other resources, and didn't, or probably wouldn't, have recognized what the post was saying. I was just interested in the test vectors. This has indeed allowed me to produce s!!
    – user31364
    Jan 26, 2017 at 13:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.