Questions tagged [ecdsa]

The Elliptic Curve Digital Signature Algorithm

Filter by
Sorted by
Tagged with
1
vote
1answer
38 views

PUBLIC ECDSA KEY

I want to know how I can build a Python script that can Calculate Public Key ECDSA from a Private Key (HEX) and the result is similar to the imagen
0
votes
0answers
37 views

The Generator Point (G) in Eliptic curve Cryptography

I am aware that the generator point (G) in Ecdsa is constant... But if I we're to calculate an equation using this number, I don't know if I should use the compressed or the uncompressed format of the ...
1
vote
2answers
75 views

Openssl magic values? Secp256k1 and ECDSA similarities? What makes secp256k1 special?

Part 1: Running this command seems to be a reliable way to produce a pubkey from a valid private key that for Bitcoin. Is this a correct assumption? openssl ec -inform DER -text -noout -in <(cat &...
0
votes
0answers
24 views

How to calculate z and z1 from ecdsa signature [duplicate]

Can anyone explain me any clearly answer or code in python with examples how we can calculate z and z' value fromECDSA Signature order? I search in google and youtube and i not saw any correctly ...
0
votes
0answers
45 views

How can i calculate z and z1 from ecdsa signature

Can anyone explain me any clearly answer or code in python with examples how we can calculate z and z' value fromECDSA Signature order? I search in google and youtube and i not saw any correctly ...
0
votes
1answer
88 views

Calculate Z from r and s

Can anyone explain me any clearly answer or code in python with examples how we can calculate Z value from r and s and inputs outputs order ?? I search in google and youtube and i not saw any ...
0
votes
1answer
38 views

Does secp256k1 library provide API for generating uncompressed key?

Hi I am right now want to do a make a small tool to generate some test vector for ecdsa. Openssl is quite good, for support secp256k1 bitcoin provides an excellent library. However, it looks what I ...
1
vote
1answer
42 views

Basic point multiplication with G in libsecp256k1

I'm trying to work out a minimal example with the bitcoin core secp256k1 library but am a bit lost due to the many options available. Concretely, I simply want to use libsecp256k1 to multiply the ...
3
votes
0answers
64 views

How many bitcoin transactions can be verified per second on commodity hardware in 2020?

I am trying to figure out how many Bitcoin transactions could be verified per second. Am I correct that signature verification is more expansive than computing Merkletrees and hashes and constitutes ...
0
votes
0answers
87 views

What does sigscript and witness mean?

I tried using the R scanner from the following link https://github.com/ca333/rng-scanner/blob/master/rscan.py, then I got results like this Bitcoin Address : 3EZ5yV5FARDqEZTXzwWNt33XLVhv7hqAS2 R: ...
0
votes
0answers
24 views

Need help with signing transactions in Java. I am using Bouncy Castle for ECDSA

I have successfully created the raw transaction that needs to be signed. I passed the big-endian (also tried little-endian) hash256 of the raw transaction to the ECSA.sign() method (implementation ...
3
votes
1answer
118 views

Elliptic Curve Point at Infinity

Let's take into account the Bitcoin curve. My questions are: What exactly is the "point at infinity"? Is there more than one "point at infinity" How can I identify if my EC generated x and y are the "...
9
votes
1answer
1k views

What are the potential attacks against ECDSA that would be possible if we used raw public keys as addresses?

According to this answer about why addresses are hashes rather than public keys there are potential attacks that are possible if you have the public key rather than the address, what are these attacks?...
0
votes
2answers
169 views

How to find Reused R values

I use software from https://github.com/ca333/rng-scanner , I try to find r that is reused. from the software I found results Bitcoin Address : 1GQdrgqAbkeEPUef1UpiTc4X1mUHMcyuGW In Input NR : 141 ~ ...
0
votes
1answer
48 views

Bitcoin Transaction Signing

I wrote a couple of algorithms that perform the ECDSA and also the verification. So I used my algorithm and the RPC call for signing and I got a couple of questions. Since we have the ephemeral ...
0
votes
1answer
282 views

How do I to get the r, S and Z values from a raw transaction (version 2)

For example I have this raw transaction ...
2
votes
3answers
225 views

How to subtract two points on an elliptic curve?

Please tell me if there is a formula for A-B, (That is, subtraction of two points / minus). I know how two points are added, A + B this addition is described in detail (Please tell me how you can ...
1
vote
1answer
148 views

How to verify a signed message in Java?

I want to verify, in Java, a signature produced with bitcoin core's signmessagewithprivkey (equivalent to the verifymessage). I noticed a bitcoinj method similar to the bitcoin core's verifymessage - ...
0
votes
0answers
55 views

Extract ECDSA parameters from Bitcoin Blockchain Block

I am trying to extract the parameters of ECDSA signature used in bitcoin to run some tests. For that i need to obtain : --- r and s , i.e., the ECDSA signature --- H(m) , the hash of ...
0
votes
1answer
87 views

Is it possible to add two secp256k1 points to get a “shared key”?

As I know from the Elliptic Curve Diffie Hellman (ECDH), you can create a "Shared Key": https://asecuritysite.com/encryption/ecdh2 This will look like this: dA × dB × G = Shared Key QB = dB × G QA ...
6
votes
1answer
466 views

Will Schnorr Multi-signatures completely replace ECDSA?

I stumbled upon the fact that schnorr signatures will most probably replace the current ECDSA system in a future BIP. Is it worth learning about ECDSA or this will become obsolete/useless/confusing ...
0
votes
2answers
231 views

Difference between Sign Message and Sign Transaction

Using "Sign Message" one can prove ownership of an address. This happens by signing a human-readable string using the private key belonging to the address. The owner then provides the address, message ...
1
vote
0answers
71 views

How to sign an Altcoin transaction manually with 2 inputs and 2 outputs

So i'm working with the altcoin denarius which has the following raw TX structure. This is a transaction I am try to sign: Original: ...
2
votes
1answer
309 views

I tried to recover the public key from the signature, but I failed

I used data that comes from https://github.com/bitcoin/bips/blob/master/bip-0143.mediawiki#p2sh-p2wpkh. It is easy to know how to get sigHash. But when I try to recover public key, everything out off ...
0
votes
1answer
93 views

Creating a nothing-up-my-sleeve public key

I am trying to create a public key whose x starts with "34" and is followed by the minimum number n such that the concatenation of "34" and n is the x of a valid point (x, y) on the elliptic curve ...
1
vote
1answer
68 views

Up to 4 Different Points within ECDSA/Public Key Recovery technique

In the answer to this question, it is stated that: Rearranging this equation you get rP = sR - mG, or P = (s/r)R - (m/r)G. Thus, it seems we can just compute the public key from the message and the ...
0
votes
1answer
76 views

ScriptSig does not validate with seemingly valid signature

I am trying to build raw transactions from scratch to improve my understanding. For comparison I am using the hexoutput from https://coinb.in/ as I can choose Testnet on there. I am trying to ...
2
votes
1answer
56 views

Why is a library's signature of a segwit tx different from Bitcoin Core signature?

I have been writing a (yet another) Bitcoin python library primarily for educational purposes; for me and my students. Signing a non-segwit transaction results in a signed tx that is identical to ...
0
votes
1answer
111 views

How to sign Bitcoin transactions using JCE?

I need to sign Bitcoin transactions using JCE primitives(no bitcoinj), but my signatures are not considered valid by bitcoinj. I tried to simulate this process. I created a random hash and signed it ...
3
votes
1answer
74 views

ECDSA - why not using the cyclic additive group

As I understand things so far, the ECDSA scheme used by Bitcoin uses a group G generated by a point on the elliptic curve y^2 = x^2 + 7. Now G is a cyclic group of finite order n and is, hence, ...
0
votes
1answer
81 views

How to verify signature of multisig transaction

How to verify signature of multisig transaction (2-2) after it being signed by first owner? How can I understand if that owner used wrong private key => wrong signature?
4
votes
1answer
389 views

Low-s value in bitcoin signature

What are the problems related in using the "normal" ( bigger than N/2) value of the s number in transaction signature and why we use the lower one? Is it about the math behind the ecdsa?
3
votes
1answer
439 views

Bitcoin scripts that force disclosure of the private key

Context: I am creating an example code that would demonstrate an atomic swap between Elements and Bitcoin, with the aim that the swap transactions cannot be trivially linked, as it would be with ...
1
vote
0answers
258 views

How to sign bitcoin raw transactions with Python offline

I have a raw bitcoin transaction created using createrawtransaction unsigned_tx = "...
0
votes
1answer
80 views

Are transactions with the same ScriptSig a security problem?

For instance while looking at the transaction stack of my address, tracing it to exchanges I use, I came across this: https://www.blockchain.com/btc/tx/...
3
votes
3answers
1k views

What is the reasoning behind the choice of 2^256-2^32-977 for the prime on the secp256k1 curve?

In Bitcoin's elliptic curve (secp256k1), the prime p = 2^256 - 2^32 - 2^9 -2^8 - 2^7 - 2^6 - 2^4 - 1 the generator point Gx = 0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798 ...
1
vote
1answer
35 views

Why are exactly 4 bit windows used in the lookup table of libsecp256k1 to speed up point multiplications?

From the Readme of secp256k1 we can see the following: Use a precomputed table of multiples of powers of 16 multiplied with the generator, so general multiplication becomes a series of additions. I ...
5
votes
1answer
166 views

Does MuSig have the same security as 2-2 multisig?

Disclaimer: This question is of theoretical importance to me trying to educate myself better on cryptographic principles and signature schemes. I don't intend to imply that in practice schnorr ...
3
votes
1answer
196 views

ECDSA signature with r value of 31?

occasionally on Android we are generating an ECDSA signature. This turns out to have a "r" length of 31 bytes. Is that valid? For reference here is a nice diagram outlining the ASN.1 structure of ...
2
votes
1answer
97 views

Why is a cyclic subgroup chosen in ECDSA?

One thing which I am wondering for a long time and to which I did not find an answer after doing a web search and hope to find an answer here. When we construct the elliptic curve over a prime field ...
0
votes
1answer
118 views

Generator Point G multiple

if in a curve y2 mod p = x3+ 7 mod p ( ecdsa-secp256k1) p=115792089237316195423570985008687907853269984665640564039457584007908834671663 G=...
1
vote
2answers
894 views

Nonce usage in ECDSA signing algorithm

I'm trying to understand the signing function secp256k1_ecdsa_sig_sign(), and I'm curious about the nonce usage here. static int secp256k1_ecdsa_sig_sign(const secp256k1_ecmult_gen_context *ctx, ...
1
vote
1answer
384 views

tiny-secp256k1 and ECDSA signing determinism

I noticed in bitcoin when using the tiny-secp256k1 library to sign the signature for a signature hash of an input, the signature is always the same. However in other ECDSA secp256k1 libraries (im ...
14
votes
1answer
2k views

What is the origin of insecure 64-bit nonces in signatures in the Bitcoin chain?

In Biased Nonce Sense: Lattice Attacks against Weak ECDSA Signatures in Cryptocurrencies Joachim Breitner and Nadia Heninger use a lattice based algorithm to recover private keys from signatures in ...
3
votes
1answer
354 views

In ECDSA, why is (r,−s mod n) complementary to (r, s)?

I am trying to find resources in previous malleability posts, but couldn't find derivations/proofs of this fact or how the exact low-s value is derived. Any pointers would greatly appreciated.
0
votes
1answer
637 views

How public key is calculated from a base58 encoded private key?

I followed this post and created a private key for bitcoin wallet. The post says after finding the random 256 bit(32 bytes) integer the version number should be prepended and the checksum should be ...
2
votes
1answer
395 views

Bitcoin ECDSA signature in the compact format

I would like to understand how to get Bitcoin ECDSA signature in a compact format, when it's exactly 65 bytes. In the bitcoin-core repository, secp256k1_ecdsa_recoverable_signature_load is ...
2
votes
1answer
476 views

How to determine first byte (recovery ID) for signatures (message signing)?

I do realize that in bitcoin when we return the signature result for signing a message the first byte includes information for recovering the public key required for verification using a formula like ...
2
votes
2answers
517 views

How to figure out the coordinates of a compressed G point?

I really can't get my head around this ECDSA thing... So far I know that it's used for validating transactions by having a private key sign its signature to the transaction. I've come to the math part ...
71
votes
1answer
12k views

If someone wanted to pretend to be Satoshi by posting a fake signature to defraud people how could they?

If a random fraudster wanted to post a bunch of mysterious ECDSA signatures that the public would believe came from Bitcoin's creator, in order to disrupt the Bitcoin market, extract money from people,...