Skip to main content

Questions tagged [ecdsa]

The Elliptic Curve Digital Signature Algorithm

Filter by
Sorted by
Tagged with
0 votes
0 answers
22 views

Bitcoin message signing and other functions coded in C (not C++). Is there a good library that takes care of it all?

After searching for libraries that could do this, and/or code that could do this, all around the internet, and also AI code assistants failing me, I have managed to write C code (not C++, simple C) ...
capodieci's user avatar
2 votes
1 answer
59 views

Low vs High R value signatures

I have a conceptual understanding of the R value in so far as it can fall either above or below the X axis in the elliptical curve and that positive R values use an extra byte in the signature to ...
user2334659's user avatar
0 votes
0 answers
68 views

Why do we need additional secret value (k) in ECDSA?

Formula for calculating an ECDSA signature (r, s) is: s = k-1(z + qr) k - private key for a random point R z - hash of a message q - original private key r - x(R) I am interested in why do we need ...
LeaBit's user avatar
  • 980
0 votes
1 answer
108 views

What does a digital signature scheme need to have in order to be used (indirectly) in Bitcoin?

Here (see the comments) Pieter Wuille described digital scheme as a collection of three algorithms: (key generation, signing, verification) Since Bitcoin uses ECDSA (pre-Taproot outputs) and Schnorr (...
LeaBit's user avatar
  • 980
-2 votes
1 answer
49 views

Feedback system possible

I grasp the concept of point negation and addition quite well. Point negation involves taking a public key, inverting it, and adding it to a target. The resulting difference between the target and the ...
Melwyn's user avatar
  • 9
2 votes
1 answer
441 views

How to manually verify an ECDSA signature in Python?

Maybe I got the formula wrong but I heard that x = (z*s^-1)*G+(r*s^-1)*K is the equation for verifying an ECDSA signature but my code says signature is invalid but the values are from a valid bitcoin ...
Alexio puk2sefu's user avatar
0 votes
1 answer
157 views

How to convert the results of point doubling (Rx1 and Ry1) to point addition (Rx2 and Ry2) without knowledge of (Qx, Qy) in secp256k1 elliptic curve [closed]

I'm working with the secp256k1 elliptic curve and have point doubling and point addition formulas for this curve. Given the following formulas: Point Addition Formula in Python3: s = (Qy - Gy) * pow(...
Aviril Smith's user avatar
0 votes
1 answer
68 views

Do we pay cheaper fees for less security in P2TR rather than P2PKH?

Answer quote: P2TR now is a spiritual successor of P2PK: it locks funds directly to a key and only requires a signature to spend the funds. If P2TR UTXOs are guarded by Schnorr signatures and P2PKH ...
Mercedes's user avatar
  • 824
0 votes
1 answer
195 views

Would two related nonces cause the private key to leak?

Let there be two signatures made with the same private key(d) using two nonces {k1, k2}. Would knowing that k1*u+f=k2 be sufficient to reveal the private key(d)?
Joakim20's user avatar
0 votes
0 answers
52 views

If I solved y²= (x³ * ax * b) mod p [as it is] what would I gain or be able to do with it's algorithm?

So the calculations for secp256k1 affirm to the formula y² = (x³ * ax * b) mod p of which is said to be impossible to calculate (as is) because of arbitrary large numbers involved. Hypothetically if ...
AncientTides's user avatar
1 vote
1 answer
98 views

What is the concept behind extracting point x from point y given that both are correspondants of G ^ k mod p

Within the encryption protocol that governs bitcoin (Secp256k1 to be precise), the generated points publicKey_x and publicKey_y are a results of calculated coordinates within the finite field " G^...
AncientTides's user avatar
0 votes
1 answer
238 views

Address Reuse and ECDSA Concern

I have a question about address reuse. Admittedly, I'm a little confused on the matter, so please bear with me if the framing of my question doesn't make much sense. Recently I started using Sparrow ...
anonpleb's user avatar
1 vote
1 answer
81 views

Is the Z value generated before the (r, s) values?

I just want to confirm my understanding of signatures for P2PKH transactions. The signature hash, z, is generated before generating the r and s values of a DER signature, correct?
jiamijiang's user avatar
0 votes
0 answers
143 views

secp256k1, reused nonce across two differents pubkeys

Edited: changing the notation according request by fgrieu. I have prepared 4 transactions for 2 pubkeys with the same r1 and r2. properties of secp256k1: p = ...
Ironic's user avatar
  • 23
1 vote
1 answer
463 views

Can a signer recover their own signature's nonce `k`?

I am proofreading a blog post about nonce reuse. One point that comes up is whether someone could recover another person's private key if the other user reuses the same nonce. In that context, it was ...
Murch's user avatar
  • 76k
1 vote
1 answer
253 views

Question about transaction verification relating to the ECDSA "nonce"

Context about the ECDSA nonce: Questions about generating a random number for ECDSA Are these nonce values public or private? I understand that they are generated to be different every transaction and ...
Poseidon's user avatar
  • 653
1 vote
0 answers
154 views

Is Curve25519 better option than Secp256k1?

Are signatures over Curve25519 better than over Secp256k1 or are there major drawbacks? How do, for instance, EdDSA/Schnorr using Curve25519 compare with ECDSA/Schnorr for Secp256k1?
Son Kaos999's user avatar
1 vote
1 answer
137 views

Keep getting wrong bitcoin addresses

I'm trying to write a script that can generate a private key and the compressed and uncompressed addresses. It seems to work however the private key doesn't correspond to the addresses generated. Can'...
fredsta98's user avatar
0 votes
2 answers
274 views

Is Taproot the best address against quantum computers attack?

I'm looking for an address type for long term storage of bitcoin but I don't know what to choose. I'm not sure if Taproot is more secure than segwit. Another question I have about Taproot, is that if ...
Dodi Alf's user avatar
2 votes
1 answer
86 views

Will ECDSA be less and less popular when Schnorr signature can be used in Bitcoin?

Schnorr signature is simpler than ECDSA, and it enjoys the linearity property, which brings more efficiency to Bitcoin. Will ECDSA be less and less popular when the Schnorr signature can be used in ...
user77340's user avatar
  • 131
2 votes
1 answer
206 views

Were uncompressed public keys always supported by Bitcoin?

I was wondering when compressed public keys were introduced to bitcoin, then I saw this quote from this answer: The original Bitcoin software didn't use compressed keys only because their use was ...
Darius's user avatar
  • 789
1 vote
1 answer
250 views

Do I have to worry about endian swapping when calculating ECDSA public key values, Creation & Signing of transactions and verification of signature?

Do I have to worry about endian swapping when calculating ECDSA public key values, Creation & Signing of transactions and verification of signature? This question is more of a straightforward yes/...
AncientTides's user avatar
1 vote
1 answer
666 views

Is it true that Public keys with even y coordinate correspond to private key that are less than n/2 and vice versa? (Secp256k1)

The question is somewhat complex and directed to clearing thing out. Suppose that n is the order of the cyclic group. It n - 1 is the number of all private keys possible n = ...
Emma Lincoln's user avatar
2 votes
1 answer
353 views

Why g is 2 and 3 to derive the lambda and beta values for endomorphism on the secp256k1 curve?

As you can seen here, in hex, N and P are: N = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141 P = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F The ...
tony pham's user avatar
1 vote
1 answer
524 views

Questions about generating a random number for ECDSA

One of the component of making of SECP256K1 signatures, is a random number that is later multiplied by the generator point in order to be used in further computations. If we imagine that k - is the ...
Maltoon Yezi's user avatar
1 vote
1 answer
187 views

ECDSA sign of transaction

What is true sign of transaction in bitcoin testnet (https://blockstream.info/testnet/tx/c6c232a36395fa338da458b86ff1327395a9afc28c5d2daa4273e410089fd433) : ...
bit_user's user avatar
1 vote
1 answer
127 views

How is a Bitcoin transaction signed using ECDSA?

I am quite familiar with the way secp256k1 ECDSA works as well as the equations that are utilised. However, I have no idea how this ECDSA applies to signing Bitcoin (SegWit Format) and transferring it ...
Jamo's user avatar
  • 167
2 votes
2 answers
728 views

Why can't I reverse secp256k1's public key point in order to determine the private key?

I understand that the public key q is generated by the point addition of g (some secp256 k1 constant) u times such that u is a big number (private key). This process can be simplified in this diagram ...
Jamo's user avatar
  • 167
2 votes
1 answer
348 views

How does ECDSA work when generating the public key?

I know the curve has formula y^{2}=x^{3}+ax+b. However, some websites are saying that a=0 and b=7 for secp256k1? What is secp256k1? Is it the curve that is always used or does it generate the field in ...
Jamo's user avatar
  • 167
2 votes
1 answer
730 views

Can the difference be determined between two nonces k1, k2, having a linear relationship if the nonce and private key are unknown, i.e., k2 - k1 = n?

My question is related to weak signature vulnerability testing where a hypothetical attacker does not know the values of the nonce or private key itself, but can determine that the nonce 'k1' is ...
Alfhilðr ínn Seiðkona's user avatar
1 vote
1 answer
214 views

Verifying the Pizza transaction in Python

A friend of mine and I are trying to learn how to read the bitcoin blockchain. We've gotten pretty much everything except the ECDSA verification that the coins spent actually belong to the person who ...
bnsh's user avatar
  • 193
1 vote
1 answer
192 views

Is it feasible to calculate EC private key k from public key K for very low values of k?

If an EC private key k is very small, say "1", is it feasible to calculate the private key k from its public key K, since there would only be one step back to generator point G and therefore ...
b0d's user avatar
  • 33
2 votes
1 answer
367 views

How to calculate the public key, compute point P and create signature using ECDSA?

I'm quite new to the intricacies of bitcoin cryptography and ECDSA and elliptic curve cryptography has me quite stymied. I am faced with a curve with the equation: y^2 = x^3 + 7 of order N=39 with ...
Raighley's user avatar
1 vote
1 answer
154 views

Elliptic Curve and SECP256K1

Just for curiosity, considering that there is a server communicating with other machine (local machine let's call it). If we have the two public keys from Local and Server and we know that Private and ...
Maria Luisa Redondo's user avatar
-1 votes
1 answer
131 views

How can i achieve this signature?

I want to make a signature in bitcoin where the nonce and private are the same. For example, the private key is 0x1000 and the nonce for the R value is also 0x1000
Unknown's user avatar
3 votes
1 answer
461 views

What is the probability of an ECDSA signature being less than 71 bytes

Since DER requires R and s values being minimally encoded signed integers, they could be less than the expected 32 bytes. What is the probability that one or both of R and s are less than 32 bytes for ...
Ava Chow's user avatar
  • 71k
0 votes
3 answers
700 views

Why do private keys have a range limit?

I am reading about ECDSA, and I find that the private key must be in (0,n), with n = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141. Is n the total number of points on the ...
KHJUAF403456ZS3K564WAEF's user avatar
2 votes
2 answers
274 views

What is the relationship between r in signature and the public key

I've been reading about ECDSA in here. Step 11 says that you only need the ‘x‘ value (20 bytes) for the signature, and that value will be called ‘R‘ Does that say that R is the x-coordinate of the ...
KHJUAF403456ZS3K564WAEF's user avatar
1 vote
1 answer
244 views

How long is SIGHASH?

I am reading these two posts 1 2, and following step by step. I almost understand, but I still have some questions. Before signing, input script should be removed and replaced by pre locking script. ...
KHJUAF403456ZS3K564WAEF's user avatar
1 vote
0 answers
1k views

Trying to get the Public key from Private key via secp256k1 [closed]

I have the private key in hex format like this: 9E524DE478970A9621C0E52890805D5F28E3620892BA6BFA701B026C6EE10A52 , now I am running the below python function to get the public key via ecdsa: def ...
spraveenitpro's user avatar
1 vote
1 answer
153 views

How many times and where exactly is ECDSA used in Bitcoin?

I'm currently a little confused about where exactly ECDSA is used in the transaction process... some resources seem to say it's used once, whereas others seem to say it's used three times. Which is ...
compp's user avatar
  • 13
1 vote
2 answers
72 views

Error while installing libwally

I am trying to install libwally on my debian machine. I followed the installation guide but running ./configure I got the warning === configuring in src/secp256k1 (/home/standup/libwally-core/src/...
zerotobtc's user avatar
  • 323
0 votes
1 answer
510 views

How to get public key and bitcoin compressed address from the coordinates (x,y) generated by ECDSA?

I have my x (0xca668a8b5f71e8724aada4b5343c28702a481787855cc42228b8fff97fe94d6a) and y (0x19dd3a603a55b3d8c5f62cbe177b9b63693fb8c91d76845bafc843a7aa19ea55) coordinates generated by ecdsa with a ...
harsh's user avatar
  • 1
-3 votes
3 answers
737 views

How to forge a signature with fixed Z value

I want to forge a signature with a fixed z value, what is the formula to do that
Gwer's user avatar
  • 1
2 votes
2 answers
124 views

Curious about the Math that makes Bitcoin/Blockchain work ! Any good resources to learn it?

A bit of a background about me ; Computer Engineer but during my studies i didn't dive too deep into the maths , especially the maths that makes the blockchain and cryptography work looking for advice ...
Muhammad Yasir's user avatar
-3 votes
2 answers
3k views

How to derive the Private key when the two the nonces are k and k*2

Is the same private key using k and k*2 respectively in two different signatures vulnerable? If yes How to calculate the key in this case Here is an example, Both signatures are valid and the nonce of ...
Guest34122123's user avatar
0 votes
0 answers
103 views

What is the best site/tool/way for finding the RSZ values of a bitcoin transaction? [duplicate]

The two most popular sites for doing this are down which are https://2coin.org/ and https://2xoin.com/getRSZfromRawTX/ with no indication they'll ever return to be usable. Can anyone here link any ...
coaxel 's user avatar
0 votes
1 answer
787 views

public key to private key using HASH TABLE (Pollard's kangaroo for SECPK1)

I have done a little bit of research on HASH TABLE (Pollard's kangaroo for SECPK1) I was wondering if there is any way to extract the private key range using the public key or the public address..??
terminal's user avatar
0 votes
1 answer
190 views

Why is signature S value is unnecessarily high not safe?

I get frequent warning when sending RawTX to PushTX message (Non-canonical signature: S value is unnecessarily high) Why is signature S with a large value dangerous (that is, when the first HEX ...
Dew Debra's user avatar
0 votes
1 answer
58 views

What is the relativity between ECDSA public keys, if any?

Wondering if there is any relative connection between public keys? I know that they are a function of G, but is there any other connection they share? Is it possible to calculate how many G are ...
Tanagi's user avatar
  • 1

1
2 3 4 5