I am trying to find resources in previous malleability posts, but couldn't find derivations/proofs of this fact or how the exact low-s value is derived. Any pointers would greatly appreciated.


ECDSA signatures are pairs (r,s) such that r = x(m/sG + r/sP) mod n, where P is the public key and m is the message digest. x() in that equation means "the X coordinate of".

In that equation, if you substitute s = -s', you get *r = x(m/(-s')*G + r/(-s)P) mod n, or *r = x(-(m/s'*G + r/s'P)).

However, it is true that for any point Q, x(Q) = x(-Q), as negating a point only affects the Y coordinate. Thus, *r = x(m/s'*G + r/s'P) mod n, or (r,s') is valid signature whenever (r,s) is.

  • Thank you very much. I understand negating a scalar over ff, but not why that negated scalar * point will result in a point with the same x-coord as scalar * point.
    – James C.
    Jan 5 '19 at 22:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.