0

this time is difficult for me to explain problem i was facing. i realize that R/S signature in DER signature is not match to the 1 in bitcoin signed message? Ok below is my say signed message.

-----BEGIN BITCOIN SIGNED MESSAGE-----
c4ca4238a0b923820dcc509a6f75849b
-----BEGIN SIGNATURE-----
1BxqqjVC29fvCWin4qBuqZhBy4V7Ncdxby
        IPnTEOU713+XclrBrUEfTLeP0A7QIR4lObzQjBjyxGQExPwkalrQK1JOggIWk4xrfWIjHEC0RKGv3vtguDfto0o=
-----END BITCOIN SIGNED MESSAGE-----

my working way is $decoded_content = bin2hex(base64_decode(IPnTEOU713+XclrBrUEfTLeP0A7QIR4lObzQjBjyxGQExPwkalrQK1JOggIWk4xrfWIjHEC0RKGv3vtguDfto0o=))

then i manage to get R/S signature from $decoded_content. after that, i use R/S signature to generate DER signature. I realized that this DER signature is fail in signature verification.

shortly to say,

my program check valid signature using function in https://github.com/tuaris/CryptoCurrencyPHP/blob/master/Wallet.class.php#L225

if another party send me DER signature, how do i convert it into base64_encoded string? so end up i am able to use function i mention just now.

I try alot of methods but no luck, are R/S signature in both signed message and DER signature means to same?

please help

  • 3
    r and s are not points. They both are the signature, but not a point on the curve. r, however, is the x coordinate of the point R which calculated like this: (z/s)G + (r/s)P = kG = R. G is the originator point of the secp256k1, P is the public key point on the curve. z is the signature hash of the transaction, and k is a "random" value to generate the signature (in reality k is deterministic). – Oscar Serna Jun 3 at 20:09
2

Bitcoin transactions use DER format for the signature (plus sighash byte), but bitcoin messages use 'plain' format (aka P1363, CVC, PKCS11, Microsoft, JWS and more) (plus recovery byte). The computation of the r,s values in an ECDSA (which as Oscar correctly commented are not a point) is the same either way, but the data being signed for a message can never be the same as for a transaction so the signatures can never actually be the same value.

Your signature should not be and is not in DER format. The code you link to appears correct:

    $signature = base64_decode($encodedSignature);

    $flag = hexdec(bin2hex(substr($signature, 0, 1)));

    $R = bin2hex(substr($signature, 1, 32));
    $S = bin2hex(substr($signature, 33));

That correctly parses a plain-format signature (not DER), from base64.

    $derPubKey = Signature::getPubKeyWithRS($flag, $R, $S, $hash);

Without tracking down the code this calls, that looks like it should recover and encode the pubkey; whether it also verifies the signature is not obvious.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.