2

I noticed in bitcoin when using the tiny-secp256k1 library to sign the signature for a signature hash of an input; the signature is always the same.

However, the signature is always different in other ECDSA-Secp256k1 libraries. (I'm using one by nordic semiconductors.)

Do I misunderstand something? Is there a difference in the signature algorithms?

I read something about randomly and deterministically calculating the k value; should it matter if it is random or not? Or is there possibly extra encoding done after the signature hash is signed in Bitcoin Secp256k1?

Improve this question

1 Answer 1

Reset to default
6

The secp256k1 library uses RFC6979 to generate deterministic nonce values (k). It essentially takes the hash of both the private key and the message being signed in order to get k. This means that signing the same message with the same private key multiple times will always result in the same signature.

Other libraries may not do this. For example, ECDSA only requires that k be a random integer (or rather that k is indistinguishable from random). Therefore, some libraries will simply generate a random k and use that. RFC 6979 is another way to generate a k that is indistinguishable from random, assuming that the hash function used is pseudorandom (meaning its output is indistinguishable from random). The hash function used by Secp256k1 is HMAC-SHA256 which is considered secure.

Improve this answer
4
  • Thanks So basically other libraries that do not deterministically generate k but use a random k should still be able to produce a valid signature that would be accepted by the network?
    – MandelDuck
    Jan 18, 2019 at 17:33
  • 1
    @MandelDuck Correct. It's not possible to enforce that signatures are deterministic (if you could figure out whether they were, you could also learn the private key), so ECDSA (and all EC based signatures schemes like Schnorr and Ed25519) does not have deterministic signatures. Individual implementations can choose to be deterministic, but that's a purely local unobservable implementation detail.
    – Pieter Wuille
    Jan 18, 2019 at 17:51
  • thanks guys thats good to know, makes perfect sense
    – MandelDuck
    Jan 18, 2019 at 17:57
  • @MandelDuck Please mark Andrew's answer as a valid answer so this will get marked as answered.
    – elichai2
    Sep 24, 2019 at 20:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.