1

Using the "message signing" feature in the Bitcoin and Dash it's static with the same message. Signing the same message with the same private key will result always in the same signature.

This behavior is not the same in Peercoin or in the old wallet of Bitcoin. In these wallets, the signature changes even if both messages are equal, for me it has some "nonce" inside.

Example:

Message: xxx

Address: 18ZbyqYYwgEmn5hVMtJpihPeYxsUpCLhr7

Bitcoin 0.8.5-beta:

INbwudFmql3iOH6c1UWylOpgLu5zrrqGrcFCanirz+Zb/nmJkcDXSkug5J0s3Yawb1/GzZKqXVjRHRNVSenRdMI=
II7W5su7EBQ4u1ppSKMVcmy8etnJsSOsvQHZ3j+moJs2P/vjwpqMlZkvOQ+W5odCdmwOz/5wK2T0RDV6aiqaEQs=
H7XNf5of1kmpwvcvLqVKIYc3TY5eN3kIrZWJPlDYhKVZekZ7Xk2qnJWjNDdsODkYtLEYn5p6fJfIC9LR+/rQky0=

Bitcoin 0.14.2:

IBl6SRpJwzGjXTDbO/IuUcHzlbxqbzN+MmeGRLRIAcPjKpQ9XgQG+gBOzo5PcgtBbtDqXhJIKnbUH9vEcQ5CNlM=
IBl6SRpJwzGjXTDbO/IuUcHzlbxqbzN+MmeGRLRIAcPjKpQ9XgQG+gBOzo5PcgtBbtDqXhJIKnbUH9vEcQ5CNlM=
IBl6SRpJwzGjXTDbO/IuUcHzlbxqbzN+MmeGRLRIAcPjKpQ9XgQG+gBOzo5PcgtBbtDqXhJIKnbUH9vEcQ5CNlM=

In the old Bitcoin-qt the same message with the same private key create different signatures. But in the new Bitcoin-qt it's result in the same signature.

What is the difference between this signature method? Have an alternative to continue getting the PK from a signature in the second case? Have name of this specific change?

Improve this question

1 Answer 1

Reset to default
3

You're seeing the effect of RFC6979.

When generating a signature, some randomness is needed (called the nonce), as there are multiple valid signatures for the same message/key pair. The algorithm used, ECDSA, is extraordinarily vulnerable to weak randomness. An attacker who knows just a slight bit of information about your nonces can learn your private key after observing many signatures.

However, someone figured out that it doesn't need to actually be random. The only thing required is that it is unpredictable for the attacker. As a result, a standard was created that suggested using basically the hash of your private key and the message as your nonce. That standard is called RFC6979, and Bitcoin Core switched to using it in version 0.10.0. Clones that forked off before that version typically don't use it.

I have no idea why pubkey recovery does not work without deterministic signatures. I think it should work fine.

Improve this answer
7
  • If the signature remains the same for all messages, what's to prevent someone from spending funds from the address (given change goes back to the same place)? Thanks
    – Ayush
    Dec 1, 2020 at 12:18
  • The signature is most definitely not the same for all messages. What makes you conclude that?
    – Pieter Wuille
    Dec 1, 2020 at 15:00
  • >Signing the same message with the same private key will result always in the same signature. By all, I meant all same messages (the same amount going to the same address from the same address). Maybe I misunderstood the question. Could you kindly clarify it?
    – Ayush
    Dec 1, 2020 at 15:05
  • 1
    Every transaction is a different message, even if it transfers the same amount.
    – Pieter Wuille
    Dec 1, 2020 at 15:07
  • 1
    Yes, ECDSA has a nonce. If the nonce is insecure, the signature is insecure. This answer is about the fact that the nonce can be made deterministic (picking the same nonce for the same message and key every time).
    – Pieter Wuille
    Dec 1, 2020 at 15:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.