Questions tagged [ecdsa]

The Elliptic Curve Digital Signature Algorithm

Filter by
Sorted by
Tagged with
0
votes
1answer
30 views

Why is signature S value is unnecessarily high not safe?

I get frequent warning when sending RawTX to PushTX message (Non-canonical signature: S value is unnecessarily high) Why is signature S with a large value dangerous (that is, when the first HEX ...
1
vote
1answer
1k views

What does sigscript and witness mean?

I tried using the R scanner from the following link https://github.com/ca333/rng-scanner/blob/master/rscan.py, then I got results like this Bitcoin Address : 3EZ5yV5FARDqEZTXzwWNt33XLVhv7hqAS2 R: ...
0
votes
1answer
37 views

What is the relativity between ECDSA public keys, if any?

Wondering if there is any relative connection between public keys? I know that they are a function of G, but is there any other connection they share? Is it possible to calculate how many G are ...
2
votes
2answers
2k views

How to find Reused R values

I use software from https://github.com/ca333/rng-scanner , I try to find r that is reused. from the software I found results Bitcoin Address : 1GQdrgqAbkeEPUef1UpiTc4X1mUHMcyuGW In Input NR : 141 ~ ...
1
vote
1answer
119 views

Why MakeNewKey in key.cpp isn't called when getnewaddress or generate

Hi I'm student studying bitcoin-core. I tested bitcoin regtest mode, and I want to know when CKey::MakeNewKey() is called. when I do this, bitcoin-cli -regtest createwallet "wallet1" ...
2
votes
1answer
1k views

How do I get hash to verify transaction?

If I have the public key and signature for a transaction how do I get the hash value that is used in verify(hash, sig, pubkey). I want to know how to work backwards from a raw transaction to get it, ...
15
votes
3answers
6k views

How do you derive the private key from two signatures that share the same k value?

I wrote my own ECDSA signature algorithm just for the purpose of creating unit tests. With it I created two signatures which went into transaction 56ec7ca7df..., sending from 1GXFXm3es.... These ...
16
votes
1answer
2k views

Why use DER encoding for signatures?

A signature in secp256k1 is two 32 byte numbers. DER encoding a signature adds about 6-7 bytes. It also needlessly complicates things (is DER encoding used anywhere else?). In a transaction format ...
0
votes
2answers
197 views

As a developer, what steps do I need to take to generate private-public keys?

When developing (I'm using Apple Swift), what steps are needed in order to independently create my own pair of private-public keys (with the ability to restore a private key from a mnemonic phrase)? ...
5
votes
1answer
132 views

Are there risks to using the same private key for both ECDSA and Schnorr signatures?

I think I've seen a comment by Greg Maxwell about this but am having trouble finding it. I think there was some risk when signing the same message with the same key with both algorithms? In this ...
1
vote
2answers
3k views
1
vote
2answers
3k views

same R value is used for two different addresses? finding z1 and z2 value and privatekey

txid1 txid2 input script 1 304502206bcc247f1259262b4035bfa84f0397a69f69baa01659daaf94fe1164b650c86a022100a044b38e8264a1c928ddd28b4657aa7109d1ea30e911208c7ce57abcb1451fe601 ...
1
vote
1answer
446 views

OpenSSL bitcoin addresses generation

Using OpenSSL ver 1.1.0h on win 8.1 - 32 bit Im trying to recreate this post using cmd: OpenSSL generate Bitcoin address But on step 3: openssl ec -in c:\keys\private.pem -outform DER|tail -c +8|...
0
votes
0answers
34 views

Nothing-Up-My-Sleeve BTC Addresses [duplicate]

I've been researching some crypto related concepts and came across "Nothing-Up-My-Sleeve Numbers" and from what I understand I can generated a Bitcoin address that basically comes with an ...
7
votes
1answer
602 views

Will Schnorr Multi-signatures completely replace ECDSA?

I stumbled upon the fact that schnorr signatures will most probably replace the current ECDSA system in a future BIP. Is it worth learning about ECDSA or this will become obsolete/useless/confusing ...
1
vote
1answer
64 views

Y coordinate of PubKey on elliptic curve prefix

Public keys in the form of 04[x,y] can be compressed since the x axis is symmetrical. Hence we only need the x-coordinate with the 02/03 prefix which states if Y is odd or even. I don't understand the ...
0
votes
1answer
43 views

Is ECDSA signing supported from within a Taproot tree or must all signing be Schnorr?

Let's say a server is set up to do ECDSA signing and you want to include the requirement to provide a ECDSA signature within your Taproot tree (script path). Is this supported?
11
votes
1answer
2k views

What are the potential attacks against ECDSA that would be possible if we used raw public keys as addresses?

According to this answer about why addresses are hashes rather than public keys there are potential attacks that are possible if you have the public key rather than the address, what are these attacks?...
1
vote
1answer
44 views

Are high-s ECDSA signatures forbidden in segwit witnesses?

I must have looked that up five times by now, but did segwit actually forbid high-s ECDSA signatures in witnesses, esp. in standard single-sig constructions such as P2SH-P2WPKH or P2WPKH? Or are high-...
4
votes
1answer
147 views

What previously existing technologies made Bitcoin possible?

When watching a tutorial, they mentioned that Bitcoin is based off 4 or 5 technologies that existed for at least a decade before Bitcoin. Satoshi Nakamoto was the first person to combine them all into ...
5
votes
0answers
285 views

How many bitcoin transactions can be verified per second on commodity hardware in 2020?

I am trying to figure out how many Bitcoin transactions could be verified per second. Am I correct that signature verification is more expensive than computing Merkletrees and hashes and therefore ...
1
vote
2answers
245 views

secp256k1 recovery id and how does the code work

Here I have some questions regarding the recovery id (recid) defined in secp256k1 implementation. I had found few posts about how the recid is defined and what does it mean, also the source code (...
2
votes
1answer
181 views

Why is a cyclic subgroup chosen in ECDSA?

One thing which I am wondering for a long time and to which I did not find an answer after doing a web search and hope to find an answer here. When we construct the elliptic curve over a prime field ...
4
votes
1answer
110 views

ECDSA - why not using the cyclic additive group

As I understand things so far, the ECDSA scheme used by Bitcoin uses a group G generated by a point on the elliptic curve y^2 = x^2 + 7. Now G is a cyclic group of finite order n and is, hence, ...
0
votes
1answer
396 views

How convert Bitcoin Privat Key Compression to public address?

This script gets the public address from the uncompressed private key. import ecdsa import hashlib import base58 private_key = input("privatekey: ") # ...
0
votes
3answers
343 views

What is the math behind Bitcoin's elliptic curve?

I have seen many videos regarding the math behind the bitcoin elliptical curve but none of them show the public key generation. They are just defining few steps. I need the complete math behind the ...
9
votes
2answers
5k views

Transaction signature generation

When one sets up a transaction, the input of the transaction needs to have a script with a signature to show that you can spend those coins. Which fields of the previous and current transactions need ...
2
votes
1answer
138 views

secp256k1 lib compiling issue "invalid use of incomplete type secp256k1_context"

I make a small test code (test.cpp), try to show the problem I meet: to compile use g++ -o test test.cpp -lsecp256k1 #include <stdio.h> #include "secp256k1.h" static ...
1
vote
3answers
468 views

What is the relationship between a Bitcoin Private Key / Public Key / Address?

What is the relationship between a Bitcoin Private Key / Public Key / Address? I see that a private key / public key pair is generated, but is there a possibility of generating a private key already ...
0
votes
3answers
422 views

How Bitcoin handles addresses collisions?

Since the addresses are hashes of a public portion of a public/private ECDSA keypair, what would happen to two different people with different keys that hashes into the same address? How would ...
0
votes
2answers
90 views

How is the random number R for transaction signatures created?

I wonder about the random number used in signatures that result in R values ? x coordinate R = G(k) How is it created? Does it have a specific chars length? Is there a specific random generator used, ...
0
votes
1answer
66 views

Random Number In R Value , what is it actually, is it the same as Nonce in the blocks

I wonder about the random number in R value ... if i am right , the R value is First part of the script signature which is combined of two parts (r,s) r = Gk (elliptic curve scalar multiplication) Or ...
17
votes
2answers
17k views

Recovering private key when someone uses the same k twice in ECDSA signatures

In this blog: https://web.archive.org/web/20160308014317/http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html the author showed a case that using same k twice will leak private ...
1
vote
4answers
176 views

Is it possible to know if the result of 2 point subtraction is before or after G

I am trying to see if there is a way to see if subtraction of 2 points on the elliptical curve resulted in a point before or after G?. Let me explain what I mean by it. Let's take a point GP. Using ...
44
votes
5answers
50k views

How do you get a Bitcoin Public Key from a Private Key

How do I, in extreme specificity, convert a given private bitcoin key into a public bitcoin key (Talk to me like I'm 5 and I have to do this step by step or the evil witch will cook me alive in her ...
2
votes
2answers
3k views

Where can I find code that allows me to calculate Z1 and Z2 from an ECDSA signature?

By following Recovering Bitcoin private keys using weak signatures from the blockchain, I am able to do other calculations, but I have no idea how to calculate Z1 or Z2. There was a public code ...
18
votes
2answers
14k views

ECDSA r, s encoding as a signature

An ECDSA algorithm when signing a given messages produces a pair of outputs, r and s. How, given a sigStr from a Tx can one extract r and s? Are they just concatenated byte arrays of a specific length,...
3
votes
3answers
3k views

ECDSA x,y coordinate validity verification doesn't seem to work

The ECDSA algorithm, secp256k1 for Bitcoin allegedly uses the equation y ^ 2 = x ^ 3 + 7 mod P to determine the validity of an alleged point upon the elliptical curve. Utilizing http://web2.0calc....
9
votes
3answers
21k views

ECDSA Signature and the "z" value

The following link contains details on how to reverse the ECDSA signature if given two identical "R" values. http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html I have read ...
0
votes
0answers
13 views

Message hash used in P2PKH how it works

Please explain about the message hash used in P2PKH transaction ? can we sign a transaction without message hash by only using the r and s values ? and how does the verification work ?
2
votes
1answer
1k views

Can't find correct z1 & z2 for transaction

I've been trying to understand the issue and repeat Willem Hengeveld's answer, but I think I'm failing at getting correct script for hash. I'm looking for this transaction, my scripts are: ...
0
votes
0answers
27 views

How Can i Extract a Z value of a specific Bitcoin Transaction that Belongs to a merkel tree/root transaction?

am trying to find a z value of a transaction that is signed in a merkle tree/root block , i coudn't find a raw tx id in hex of that specific transaction that signed with specific address while a raw ...
1
vote
1answer
58 views

Is my ECDSA signature always unique?

In P2PKH the validation script is: <sig> <pubKey> OP_DUP OP_HASH160 <pubKeyHash> OP_EQUALVERIFY OP_CHECKSIG If I always use exactly the same private key and always sign exactly the ...
2
votes
2answers
101 views

Does every transaction have the same signature?

I want to know whether the bitcoin network generates the same signature for each transaction, because people have only one signature?
2
votes
2answers
1k views

How to figure out the coordinates of a compressed G point?

I really can't get my head around this ECDSA thing... So far I know that it's used for validating transactions by having a private key sign its signature to the transaction. I've come to the math part ...
3
votes
1answer
3k views

How do I convert Public Key x value to y in Python and verify?

I have been using the BTC Address utility which enables me to type in something like: 020F031CA83F3FB372BD6C2430119E0B947CF059D19CDEA98F4CEFFEF620C584F9 Then clicking a button the program can spit ...
3
votes
2answers
2k views

The shortest ECDSA signature

I want to create ECDSA signature {r,s} where r is very low (for example 1) and can be encoded in DER-format in one byte. How to calculate k value? Seems to me that it does not depend of anything. ...
10
votes
2answers
3k views

How vulnerable is bitcoin to quantum algorithms? [duplicate]

Assuming that quantum computers are implemented some time in the near-ish future, how vulnerable is Bitcoin to decryption via quantum algorithms? For example, Shor's algorithm enables a quantum ...
11
votes
1answer
3k views

What are the advantages of Schnorr vs ECDSA?

I understand that Schnorr signatures provide an improvement on ECDSA in that they are a fixed 64 bytes instead of the longer ECDSA sig format, however, I don't see how this is an advantage over ECDSA ...
-1
votes
1answer
167 views

How to get the raw signature data of a transaction?

With the use of segwit, signature data is no longer part of transaction body and thus can’t be retrieved from block explorers. So is there a Bitcoin rpc method in order to get it directly without ...