Questions tagged [ecdsa]

The Elliptic Curve Digital Signature Algorithm

Filter by
Sorted by
Tagged with
6
votes
1answer
297 views

Will Schnorr Multi-signatures completely replace ECDSA?

I stumbled upon the fact that schnorr signatures will most probably replace the current ECDSA system in a future BIP. Is it worth learning about ECDSA or this will become obsolete/useless/confusing ...
0
votes
2answers
45 views

Difference between Sign Message and Sign Transaction

Using "Sign Message" one can prove ownership of an address. This happens by signing a human-readable string using the private key belonging to the address. The owner then provides the address, message ...
1
vote
0answers
48 views

How to sign an Altcoin transaction manually with 2 inputs and 2 outputs

So i'm working with the altcoin denarius which has the following raw TX structure. This is a transaction I am try to sign: Original: ...
2
votes
1answer
237 views

I tried to recover the public key from the signature, but I failed

I used data that comes from https://github.com/bitcoin/bips/blob/master/bip-0143.mediawiki#p2sh-p2wpkh. It is easy to know how to get sigHash. But when I try to recover public key, everything out off ...
0
votes
1answer
71 views

Creating a nothing-up-my-sleeve public key

I am trying to create a public key whose x starts with "34" and is followed by the minimum number n such that the concatenation of "34" and n is the x of a valid point (x, y) on the elliptic curve ...
1
vote
1answer
41 views

Up to 4 Different Points within ECDSA/Public Key Recovery technique

In the answer to this question, it is stated that: Rearranging this equation you get rP = sR - mG, or P = (s/r)R - (m/r)G. Thus, it seems we can just compute the public key from the message and the ...
0
votes
1answer
44 views

ScriptSig does not validate with seemingly valid signature

I am trying to build raw transactions from scratch to improve my understanding. For comparison I am using the hexoutput from https://coinb.in/ as I can choose Testnet on there. I am trying to ...
2
votes
1answer
37 views

Why is a library's signature of a segwit tx different from Bitcoin Core signature?

I have been writing a (yet another) Bitcoin python library primarily for educational purposes; for me and my students. Signing a non-segwit transaction results in a signed tx that is identical to ...
0
votes
1answer
19 views

How to sign Bitcoin transactions using JCE?

I need to sign Bitcoin transactions using JCE primitives(no bitcoinj), but my signatures are not considered valid by bitcoinj. I tried to simulate this process. I created a random hash and signed it ...
3
votes
1answer
60 views

ECDSA - why not using the cyclic additive group

As I understand things so far, the ECDSA scheme used by Bitcoin uses a group G generated by a point on the elliptic curve y^2 = x^2 + 7. Now G is a cyclic group of finite order n and is, hence, ...
0
votes
1answer
62 views

How to verify signature of multisig transaction

How to verify signature of multisig transaction (2-2) after it being signed by first owner? How can I understand if that owner used wrong private key => wrong signature?
4
votes
1answer
87 views

Low-s value in bitcoin signature

What are the problems related in using the "normal" ( bigger than N/2) value of the s number in transaction signature and why we use the lower one? Is it about the math behind the ecdsa?
2
votes
1answer
247 views

Bitcoin scripts that force disclosure of the private key

Context: I am creating an example code that would demonstrate an atomic swap between Elements and Bitcoin, with the aim that the swap transactions cannot be trivially linked, as it would be with ...
1
vote
0answers
127 views

How to sign bitcoin raw transactions with Python offline

I have a raw bitcoin transaction created using createrawtransaction unsigned_tx = "...
0
votes
1answer
41 views

Are transactions with the same ScriptSig a security problem?

For instance while looking at the transaction stack of my address, tracing it to exchanges I use, I came across this: https://www.blockchain.com/btc/tx/...
3
votes
3answers
992 views

What is the reasoning behind the choice of 2^256-2^32-977 for the prime on the secp256k1 curve?

In Bitcoin's elliptic curve (secp256k1), the prime p = 2^256 - 2^32 - 2^9 -2^8 - 2^7 - 2^6 - 2^4 - 1 the generator point Gx = 0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798 ...
1
vote
1answer
28 views

Why are exactly 4 bit windows used in the lookup table of libsecp256k1 to speed up point multiplications?

From the Readme of secp256k1 we can see the following: Use a precomputed table of multiples of powers of 16 multiplied with the generator, so general multiplication becomes a series of additions. ...
5
votes
1answer
117 views

Does MuSig have the same security as 2-2 multisig?

Disclaimer: This question is of theoretical importance to me trying to educate myself better on cryptographic principles and signature schemes. I don't intend to imply that in practice schnorr ...
3
votes
1answer
106 views

ECDSA signature with r value of 31?

occasionally on Android we are generating an ECDSA signature. This turns out to have a "r" length of 31 bytes. Is that valid? For reference here is a nice diagram outlining the ASN.1 structure of ...
2
votes
1answer
68 views

Why is a cyclic subgroup chosen in ECDSA?

One thing which I am wondering for a long time and to which I did not find an answer after doing a web search and hope to find an answer here. When we construct the elliptic curve over a prime field ...
0
votes
1answer
83 views

Generator Point G multiple

if in a curve y2 mod p = x3+ 7 mod p ( ecdsa-secp256k1) p=115792089237316195423570985008687907853269984665640564039457584007908834671663 G=...
1
vote
2answers
436 views

Nonce usage in ECDSA signing algorithm

I'm trying to understand the signing function secp256k1_ecdsa_sig_sign(), and I'm curious about the nonce usage here. static int secp256k1_ecdsa_sig_sign(const secp256k1_ecmult_gen_context *ctx, ...
1
vote
1answer
258 views

tiny-secp256k1 and ECDSA signing determinism

I noticed in bitcoin when using the tiny-secp256k1 library to sign the signature for a signature hash of an input, the signature is always the same. However in other ECDSA secp256k1 libraries (im ...
14
votes
1answer
2k views

What is the origin of insecure 64-bit nonces in signatures in the Bitcoin chain?

In Biased Nonce Sense: Lattice Attacks against Weak ECDSA Signatures in Cryptocurrencies Joachim Breitner and Nadia Heninger use a lattice based algorithm to recover private keys from signatures in ...
3
votes
1answer
271 views

In ECDSA, why is (r,−s mod n) complementary to (r, s)?

I am trying to find resources in previous malleability posts, but couldn't find derivations/proofs of this fact or how the exact low-s value is derived. Any pointers would greatly appreciated.
0
votes
1answer
330 views

How public key is calculated from a base58 encoded private key?

I followed this post and created a private key for bitcoin wallet. The post says after finding the random 256 bit(32 bytes) integer the version number should be prepended and the checksum should be ...
2
votes
1answer
245 views

Bitcoin ECDSA signature in the compact format

I would like to understand how to get Bitcoin ECDSA signature in a compact format, when it's exactly 65 bytes. In the bitcoin-core repository, secp256k1_ecdsa_recoverable_signature_load is ...
2
votes
1answer
287 views

How to determine first byte (recovery ID) for signatures (message signing)?

I do realize that in bitcoin when we return the signature result for signing a message the first byte includes information for recovering the public key required for verification using a formula like ...
1
vote
2answers
149 views

How to figure out the coordinates of a compressed G point?

I really can't get my head around this ECDSA thing... So far I know that it's used for validating transactions by having a private key sign its signature to the transaction. I've come to the math part ...
67
votes
1answer
11k views

If someone wanted to pretend to be Satoshi by posting a fake signature to defraud people how could they?

If a random fraudster wanted to post a bunch of mysterious ECDSA signatures that the public would believe came from Bitcoin's creator, in order to disrupt the Bitcoin market, extract money from people,...
2
votes
2answers
98 views

Bitcoind does not like ECDSA (r, s) pair produced by OpenSSL

I am writing transactions manually and have stumbled across a rather bizarre situation. Only one in a few of the transactions I broadcast to bitcoind is accepted, otherwise I get a REJECT_NONSTANDARD ...
2
votes
1answer
94 views

Why are some public keys prefixed with 0x00?

ECDSA public keys seem to always start with 0x02/0x03/0x04/0x05 1, followed by either 32 bytes of 64 bytes. However, I encounter some public keys prefixed with 0x00. For example, the source output ...
2
votes
1answer
81 views

Can someone explain me ECDSA (creating public from private key) with 8-bit numbers? [closed]

Trying to understand Elliptic Curve maths with 256-bit numbers seems like hard to explain/understand. I wonder if by lowering down the possible numbers get's a little bit easier.
5
votes
2answers
819 views

What is is minimum possible number for an ECDSA private key?

Private keys are 256 bit numbers. I know the max. possible number is something around: 115792089237316195423570985008687907852837564279074904382605163141518161494336 What about the min. number ...
0
votes
1answer
401 views

How to find Values N and K given R,S and Z in ECDSA?

How to find Value N and K ? I have the values for R, S and Z. for example these: BigInteger R =("00d47ce4c025c35ec440bc81d99834a624875161a26bf56ef7fdc0f5d52f843ad1")); BigInteger S =("...
1
vote
1answer
208 views

OpenSSL bitcoin addresses generation

Using OpenSSL ver 1.1.0h on win 8.1 - 32 bit Im trying to recreate this post using cmd: OpenSSL generate Bitcoin address But on step 3: openssl ec -in c:\keys\private.pem -outform DER|tail -c +8|...
3
votes
1answer
2k views

What is the maximum size of a DER encoded ECDSA signature?

I've been told by a seasoned Bitcoin contributor that signatures in Bitcoin could be up to 75 bytes. I'm curious to find out how that maximum comes to pass. According to this answer on Why the ...
2
votes
1answer
153 views

Hypothetical Scenario - Address collision with address with already confirmed outgoing transaction

In a typical case of finding a collision with an address, as long as the private key provided has a consistent public key that hashes to the address, then the coins in that address can be spent. The ...
0
votes
2answers
84 views

ECDSA Input When Transferring Bitcoin From Owner A to Owner B

I want to get my terms right and master how transactions work within the Bitcoin network. Keeping things simple, when Alice wants to transfer 1 BTC to Bob, Alice signs a message with her private key....
0
votes
1answer
113 views

Address and Public key [duplicate]

I am reading about cryptography in Bitcoin. Bitcoin adress is created by applying cryptographic hash function to public key of the wallet. I know that this function is a trap door function but what ...
2
votes
2answers
582 views

Bitcoin - Technical difference between P2PKH and P2SH address generation?

I was convinced that the only difference between the generation of addresses starting with '1' and '3' was simply changing the prefix added to the digest from 0x00 to 0x05 after the ripemd160 part. ...
3
votes
2answers
363 views

Unable to construct a correct raw transaction for bitcoin cash testnet

I am trying to construct a raw transaction for bitcoin cash testnet. I have made a lot of use out of this very nice answer to how to construct a raw transaction, but am still unable to construct a ...
1
vote
0answers
161 views

Would it be possible for an 8-bit microprocessor to create a bitcoin keypair?

Context for question: With the latest security breaches around modern CPU's (Spectre / Meltdown) I was wondering if we could generate ECDSA keypairs on cheap, small and/or simple air gapped (micro)...
14
votes
2answers
3k views

How do you derive the private key from two signatures that share the same k value?

I wrote my own ECDSA signature algorithm just for the purpose of creating unit tests. With it I created two signatures which went into transaction 56ec7ca7df..., sending from 1GXFXm3es.... These ...
1
vote
4answers
3k views

Bitcoin public key to private key

I did go thru a lot of articles which say's It's highly impossible to break the bitcoin public-key and get a private key from it. I understand that the public key does hold some info of it's ...
5
votes
2answers
3k views

How are compressed PubKeys generated?

Just read this: https://bitcoin.stackexchange.com/a/1715/ What is the process to generate compressed pub keys via ECDSA?
1
vote
0answers
27 views

Why 256 bit for a cryptocurrency is enough but 1024 bit for ssh is not? [duplicate]

If 256-bit private key is secure enough for Bitcoin and Ethereum then why people are moving from 1024 to 2048-bit RSA for day-to-day cryptographic operations (such as ssh) and even this can be not ...
1
vote
2answers
1k views

How can I fix this: (Non-canonical signature: S value is unnecessarily high)

I've written a small script that will create a bitcoin transaction from scratch, using an ECDSA library. It works, but sometimes I get this error: 64: non-mandatory-script-verify-flag (Non-canonical ...
0
votes
1answer
144 views

Secure Generation of Private Keys

Suppose you've created a random private key by rolling dices. You've checked in the blockchain and nobody else has ever used the respective address of such private key. Issue Is this process ...
1
vote
1answer
88 views

What means “messege” in the bitcoin blockchain? [elliptic curve cryptography]

I am stuck with one question in my research. I found some mentions that bitcoin(or blockchain) is a messeging system, I played with couple curve encoding algorithms and it was like: Curve params, ...