1

I noticed in bitcoin when using the tiny-secp256k1 library to sign the signature for a signature hash of an input, the signature is always the same. However in other ECDSA secp256k1 libraries (im using one by nordic semi conductors) the signature is always different.

Am I misunderstanding something? is there a difference in the signature algorithms? I read something about randomly and deterministically calculating the k value, should it matter if it is random or not? or is there possibly extra encoding done after the signature hash is signed in bitcoin secp256k1?

Thanks! Chris

|improve this question
4

The secp256k1 library uses RFC6979 to generate deterministic nonce values (k). It essentially takes the hash of both the private key and the message being signed in order to get k. This means that signing the same message with the same private key multiple times will always result in the same signature.

Other libraries may not do this. ECDSA only requires that k be a random integer (or rather that k is indistinguishable from random). So some libraries will simply generate a random k and use that. RFC 6979 is another way to generate a k that is indistinguishable from random, assuming that the hash function used is a pseudorandom function (meaning it's output is indistinguishable from random). The hash function used by secp25k1 is HMAC-SHA256 which is considered to be secure.

|improve this answer
  • Thanks So basically other libraries that do not deterministically generate k but use a random k should still be able to produce a valid signature that would be accepted by the network? – MandelDuck Jan 18 '19 at 17:33
  • 1
    @MandelDuck Correct. It's not possible to enforce that signatures are deterministic (if you could figure out whether they were, you could also learn the private key), so ECDSA (and all EC based signatures schemes like Schnorr and Ed25519) does not have deterministic signatures. Individual implementations can choose to be deterministic, but that's a purely local unobservable implementation detail. – Pieter Wuille Jan 18 '19 at 17:51
  • thanks guys thats good to know, makes perfect sense – MandelDuck Jan 18 '19 at 17:57
  • @MandelDuck Please mark Andrew's answer as a valid answer so this will get marked as answered. – elichai2 Sep 24 '19 at 20:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.