Questions tagged [ecdsa]

The Elliptic Curve Digital Signature Algorithm

Filter by
Sorted by
Tagged with
0 votes
1 answer
561 views

OpenSSL bitcoin addresses generation

Using OpenSSL ver 1.1.0h on win 8.1 - 32 bit Im trying to recreate this post using cmd: OpenSSL generate Bitcoin address But on step 3: openssl ec -in c:\keys\private.pem -outform DER|tail -c +8|...
2 votes
1 answer
45 views

Low vs High R value signatures

I have a conceptual understanding of the R value in so far as it can fall either above or below the X axis in the elliptical curve and that positive R values use an extra byte in the signature to ...
81 votes
1 answer
14k views

If someone wanted to pretend to be Satoshi by posting a fake signature to defraud people how could they?

If a random fraudster wanted to post a bunch of mysterious ECDSA signatures that the public would believe came from Bitcoin's creator, in order to disrupt the Bitcoin market, extract money from people,...
2 votes
1 answer
2k views

How do I get hash to verify transaction?

If I have the public key and signature for a transaction how do I get the hash value that is used in verify(hash, sig, pubkey). I want to know how to work backwards from a raw transaction to get it, ...
0 votes
0 answers
65 views

Why do we need additional secret value (k) in ECDSA?

Formula for calculating an ECDSA signature (r, s) is: s = k-1(z + qr) k - private key for a random point R z - hash of a message q - original private key r - x(R) I am interested in why do we need ...
8 votes
1 answer
2k views

Is libsecp256k1 faster than OpenSSL?

Bitcoin Core is eventually going to replace OpenSSL with libsecp256k1 for all ECDSA operations. As I understand it, this is motivated by wanting consensus-critical rules to not depend on OpenSSL. Is ...
2 votes
2 answers
124 views

Curious about the Math that makes Bitcoin/Blockchain work ! Any good resources to learn it?

A bit of a background about me ; Computer Engineer but during my studies i didn't dive too deep into the maths , especially the maths that makes the blockchain and cryptography work looking for advice ...
0 votes
1 answer
107 views

What does a digital signature scheme need to have in order to be used (indirectly) in Bitcoin?

Here (see the comments) Pieter Wuille described digital scheme as a collection of three algorithms: (key generation, signing, verification) Since Bitcoin uses ECDSA (pre-Taproot outputs) and Schnorr (...
-2 votes
1 answer
49 views

Feedback system possible

I grasp the concept of point negation and addition quite well. Point negation involves taking a public key, inverting it, and adding it to a target. The resulting difference between the target and the ...
0 votes
3 answers
624 views

Why do private keys have a range limit?

I am reading about ECDSA, and I find that the private key must be in (0,n), with n = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141. Is n the total number of points on the ...
0 votes
1 answer
146 views

How to convert the results of point doubling (Rx1 and Ry1) to point addition (Rx2 and Ry2) without knowledge of (Qx, Qy) in secp256k1 elliptic curve [closed]

I'm working with the secp256k1 elliptic curve and have point doubling and point addition formulas for this curve. Given the following formulas: Point Addition Formula in Python3: s = (Qy - Gy) * pow(...
2 votes
1 answer
365 views

How to manually verify an ECDSA signature in Python?

Maybe I got the formula wrong but I heard that x = (z*s^-1)*G+(r*s^-1)*K is the equation for verifying an ECDSA signature but my code says signature is invalid but the values are from a valid bitcoin ...
0 votes
3 answers
497 views

How does Bitcoin handle address collisions?

Since the addresses are hashes of a public portion of a public/private ECDSA keypair, what would happen to two different people with different keys that hashes into the same address? How would ...
0 votes
1 answer
168 views

Would two related nonces cause the private key to leak?

Let there be two signatures made with the same private key(d) using two nonces {k1, k2}. Would knowing that k1*u+f=k2 be sufficient to reveal the private key(d)?
0 votes
1 answer
59 views

Do we pay cheaper fees for less security in P2TR rather than P2PKH?

Answer quote: P2TR now is a spiritual successor of P2PK: it locks funds directly to a key and only requires a signature to spend the funds. If P2TR UTXOs are guarded by Schnorr signatures and P2PKH ...
2 votes
1 answer
419 views

p2pkh vs. p2pk keeping public key private

I just got into learning Bitcoin programming through Jimmy Song's Programming Bitcoin. Jimmy says that some of p2pkh's advantages over p2pk include: a smaller ScriptPubKey keeping one's public key ...
0 votes
0 answers
50 views

If I solved y²= (x³ * ax * b) mod p [as it is] what would I gain or be able to do with it's algorithm?

So the calculations for secp256k1 affirm to the formula y² = (x³ * ax * b) mod p of which is said to be impossible to calculate (as is) because of arbitrary large numbers involved. Hypothetically if ...
1 vote
1 answer
82 views

What is the concept behind extracting point x from point y given that both are correspondants of G ^ k mod p

Within the encryption protocol that governs bitcoin (Secp256k1 to be precise), the generated points publicKey_x and publicKey_y are a results of calculated coordinates within the finite field " G^...
6 votes
3 answers
2k views

How to determine first byte (recovery ID) for signatures (message signing)?

I do realize that in bitcoin when we return the signature result for signing a message the first byte includes information for recovering the public key required for verification using a formula like ...
0 votes
1 answer
201 views

Address Reuse and ECDSA Concern

I have a question about address reuse. Admittedly, I'm a little confused on the matter, so please bear with me if the framing of my question doesn't make much sense. Recently I started using Sparrow ...
0 votes
2 answers
256 views

Is Taproot the best address against quantum computers attack?

I'm looking for an address type for long term storage of bitcoin but I don't know what to choose. I'm not sure if Taproot is more secure than segwit. Another question I have about Taproot, is that if ...
4 votes
1 answer
6k views

Invalid public key was spent! How was this possible?

From previous questions this bitcoin 1FYMZEHnszCHKTBdFZ2DLrUuk3dGwYKQxh address had an invalid public key of "00" and was unspendable but the coins are now spent?? The invalid key was generated by a ...
1 vote
1 answer
77 views

Is the Z value generated before the (r, s) values?

I just want to confirm my understanding of signatures for P2PKH transactions. The signature hash, z, is generated before generating the r and s values of a DER signature, correct?
9 votes
2 answers
4k views

Are Schnorr signatures quantum-computer resistant?

Here (https://bitcoincore.org/en/2017/03/23/schnorr-signature-aggregation/) it says Schnorr replaces ECDSA, we know that ECDSA can be broken by quantum computers. Is Schnorr safe from q-computers?
2 votes
2 answers
3k views

What does sigscript and witness mean?

I tried using the R scanner from the following link https://github.com/ca333/rng-scanner/blob/master/rscan.py, then I got results like this Bitcoin Address : 3EZ5yV5FARDqEZTXzwWNt33XLVhv7hqAS2 R: ...
1 vote
2 answers
72 views

Error while installing libwally

I am trying to install libwally on my debian machine. I followed the installation guide but running ./configure I got the warning === configuring in src/secp256k1 (/home/standup/libwally-core/src/...
1 vote
1 answer
292 views

Basic point multiplication with G in libsecp256k1

I'm trying to work out a minimal example with the bitcoin core secp256k1 library but am a bit lost due to the many options available. Concretely, I simply want to use libsecp256k1 to multiply the ...
8 votes
1 answer
5k views

What is the maximum size of a DER encoded ECDSA signature?

I've been told by a seasoned Bitcoin contributor that signatures in Bitcoin could be up to 75 bytes. I'm curious to find out how that maximum comes to pass. According to this answer on Why the ...
2 votes
1 answer
4k views

Recovering ECDSA public key from the signature

How to recover ECDSA public key from the signature? I know that all is need is a hash of the unsigned message and signature. But may be there is some detailed method for to calculate ECDSA public ...
0 votes
0 answers
135 views

secp256k1, reused nonce across two differents pubkeys

Edited: changing the notation according request by fgrieu. I have prepared 4 transactions for 2 pubkeys with the same r1 and r2. properties of secp256k1: p = ...
1 vote
1 answer
355 views

Can a signer recover their own signature's nonce `k`?

I am proofreading a blog post about nonce reuse. One point that comes up is whether someone could recover another person's private key if the other user reuses the same nonce. In that context, it was ...
1 vote
1 answer
235 views

Question about transaction verification relating to the ECDSA "nonce"

Context about the ECDSA nonce: Questions about generating a random number for ECDSA Are these nonce values public or private? I understand that they are generated to be different every transaction and ...
1 vote
0 answers
139 views

Is Curve25519 better option than Secp256k1?

Are signatures over Curve25519 better than over Secp256k1 or are there major drawbacks? How do, for instance, EdDSA/Schnorr using Curve25519 compare with ECDSA/Schnorr for Secp256k1?
1 vote
1 answer
129 views

Keep getting wrong bitcoin addresses

I'm trying to write a script that can generate a private key and the compressed and uncompressed addresses. It seems to work however the private key doesn't correspond to the addresses generated. Can'...
4 votes
1 answer
1k views

In ECDSA, why is (r,−s mod n) complementary to (r, s)?

I am trying to find resources in previous malleability posts, but couldn't find derivations/proofs of this fact or how the exact low-s value is derived. Any pointers would greatly appreciated.
2 votes
1 answer
83 views

Will ECDSA be less and less popular when Schnorr signature can be used in Bitcoin?

Schnorr signature is simpler than ECDSA, and it enjoys the linearity property, which brings more efficiency to Bitcoin. Will ECDSA be less and less popular when the Schnorr signature can be used in ...
7 votes
1 answer
1k views

Why was ECDSA chosen over Schnorr Signatures in the inital design?

Schnorr Signatures and Signature aggregation is in the bitcoin technology roadmap. Schnorr Signatures was around the same time ECDSA is around. Why wasnt Schnorr Signature Scheme implemented at the ...
17 votes
3 answers
9k views

How do you derive the private key from two signatures that share the same k value?

I wrote my own ECDSA signature algorithm just for the purpose of creating unit tests. With it I created two signatures which went into transaction 56ec7ca7df..., sending from 1GXFXm3es.... These ...
2 votes
2 answers
260 views

What is the relationship between r in signature and the public key

I've been reading about ECDSA in here. Step 11 says that you only need the ‘x‘ value (20 bytes) for the signature, and that value will be called ‘R‘ Does that say that R is the x-coordinate of the ...
1 vote
1 answer
228 views

Do I have to worry about endian swapping when calculating ECDSA public key values, Creation & Signing of transactions and verification of signature?

Do I have to worry about endian swapping when calculating ECDSA public key values, Creation & Signing of transactions and verification of signature? This question is more of a straightforward yes/...
0 votes
3 answers
5k views

same R value is used for two different addresses? finding z1 and z2 value and privatekey

txid1 txid2 input script 1 304502206bcc247f1259262b4035bfa84f0397a69f69baa01659daaf94fe1164b650c86a022100a044b38e8264a1c928ddd28b4657aa7109d1ea30e911208c7ce57abcb1451fe601 ...
2 votes
1 answer
201 views

Were uncompressed public keys always supported by Bitcoin?

I was wondering when compressed public keys were introduced to bitcoin, then I saw this quote from this answer: The original Bitcoin software didn't use compressed keys only because their use was ...
2 votes
1 answer
321 views

How to calculate the public key, compute point P and create signature using ECDSA?

I'm quite new to the intricacies of bitcoin cryptography and ECDSA and elliptic curve cryptography has me quite stymied. I am faced with a curve with the equation: y^2 = x^3 + 7 of order N=39 with ...
16 votes
1 answer
855 views

How many bitcoin transactions can be verified per second on commodity hardware in 2020?

I am trying to figure out how many Bitcoin transactions could be verified per second. Am I correct that signature verification is more expensive than computing Merkletrees and hashes and therefore ...
-3 votes
2 answers
2k views

How to derive the Private key when the two the nonces are k and k*2

Is the same private key using k and k*2 respectively in two different signatures vulnerable? If yes How to calculate the key in this case Here is an example, Both signatures are valid and the nonce of ...
1 vote
1 answer
586 views

Is it true that Public keys with even y coordinate correspond to private key that are less than n/2 and vice versa? (Secp256k1)

The question is somewhat complex and directed to clearing thing out. Suppose that n is the order of the cyclic group. It n - 1 is the number of all private keys possible n = ...
2 votes
1 answer
316 views

Why g is 2 and 3 to derive the lambda and beta values for endomorphism on the secp256k1 curve?

As you can seen here, in hex, N and P are: N = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141 P = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F The ...
1 vote
1 answer
472 views

Questions about generating a random number for ECDSA

One of the component of making of SECP256K1 signatures, is a random number that is later multiplied by the generator point in order to be used in further computations. If we imagine that k - is the ...
8 votes
3 answers
3k views

How do you derive the lambda and beta values for endomorphism on the secp256k1 curve?

You can see a little background about this on this bitcointalk post by the late Hal Finney. Beta and lambda are the values on the secp256k1 curve where: λ^3 (mod N) = 1 β^3 (mod P) = 1 As seen ...
1 vote
1 answer
194 views

Does secp256k1 library provide API for generating uncompressed key?

Hi I am right now want to do a make a small tool to generate some test vector for ecdsa. Openssl is quite good, for support secp256k1 bitcoin provides an excellent library. However, it looks what I ...

1
2 3 4 5