# Low-s value in bitcoin signature

What are the problems related in using the "normal" ( bigger than N/2) value of the s number in transaction signature and why we use the lower one? Is it about the math behind the ecdsa?

## 1 Answer

Details are in BIP 146:

We require that the S value inside ECDSA signatures is at most the curve order divided by 2...

...

A high S value in signature could be trivially replaced by S' = 0xFFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141 - S.

Signatures encode two important values for verification `r` and `S`. If `(r, S)` is a valid signature, then so is `(r, -S)`, which is equivalent to `(r, curver_order -S)`.

• Maybe I've understood. Before BIP 146, a relay node could invalidate my trx using the higher s value, which is mathematically equals, but it would have result in a completely different trx hash. So low-s value is a care for the trx malleability?
– dcfg
Commented Apr 9, 2019 at 14:26
• Yes, both transactions would be valid, but with different signatures and TX hash. Yes, it's against TX (and TXID) malleability @dc_Bita98 Commented Apr 9, 2019 at 15:59