Questions tagged [ecdsa]
The Elliptic Curve Digital Signature Algorithm
239
questions
48
votes
5
answers
40k
views
ECDSA: (v, r, s), what is v?
Deterministically signing a Tx with RFC6979 returns v, r, s, where r and s are the 2 values used in standard ECDSA signatures. v = 27 + (y % 2), so 27 + the parity of r, as pybitcointools indicates.
...
- 1
2
votes
1
answer
2k
views
How do I get hash to verify transaction?
If I have the public key and signature for a transaction how do I get the hash value that is used in verify(hash, sig, pubkey). I want to know how to work backwards from a raw transaction to get it, ...
CommunityBot
- 1
0
votes
4
answers
6k
views
same R value is used for two different addresses? finding z1 and z2 value and privatekey
txid1
txid2
input script 1
304502206bcc247f1259262b4035bfa84f0397a69f69baa01659daaf94fe1164b650c86a022100a044b38e8264a1c928ddd28b4657aa7109d1ea30e911208c7ce57abcb1451fe601
...
- 1
20
votes
3
answers
24k
views
Recovering private key when someone uses the same k twice in ECDSA signatures
In this blog: https://web.archive.org/web/20160308014317/http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html
the author showed a case that using same k twice will leak private ...
- 1
2
votes
2
answers
85
views
After signing a message, how to verify the signature with JavaScript/TypeScript?
At the frontend, user signs an arbitrary message (e.g., "Sign this message to prove that you own this wallet"). We can do this via, for example, UniSat's signMessage function (see here).
I ...
- 435
1
vote
1
answer
48
views
Trying to figure out non-canonical DER signature error for a specific tx
I have two transactions, they produce the same hash. But the first one throws Non-canonical DER signature error and the second one doesn't. This is a standard 2/3 multi-sig transaction.
Tx 1:
...
- 71.6k
0
votes
1
answer
584
views
OpenSSL bitcoin addresses generation
Using OpenSSL ver 1.1.0h on win 8.1 - 32 bit
Im trying to recreate this post using cmd: OpenSSL generate Bitcoin address
But on step 3:
openssl ec -in c:\keys\private.pem -outform DER|tail -c +8|...
CommunityBot
- 1
3
votes
1
answer
490
views
What is the probability of an ECDSA signature being less than 71 bytes
Since DER requires R and s values being minimally encoded signed integers, they could be less than the expected 32 bytes. What is the probability that one or both of R and s are less than 32 bytes for ...
5
votes
2
answers
960
views
The complement of s (when s < curve order / 2)
Bitcoinlib refers to the requirement that if s > ORDER / 2, then the complement of s should be used instead since it's one byte shorter
This sounds like it's referring to the inverse or negative s ...
CommunityBot
- 1
0
votes
0
answers
30
views
Bitcoin message signing and other functions coded in C (not C++). Is there a good library that takes care of it all?
After searching for libraries that could do this, and/or code that could do this, all around the internet, and also AI code assistants failing me, I have managed to write C code (not C++, simple C) ...
2
votes
1
answer
82
views
Low vs High R value signatures
I have a conceptual understanding of the R value in so far as it can fall either above or below the X axis in the elliptical curve and that positive R values use an extra byte in the signature to ...
- 9,394
81
votes
1
answer
14k
views
If someone wanted to pretend to be Satoshi by posting a fake signature to defraud people how could they?
If a random fraudster wanted to post a bunch of mysterious ECDSA signatures that the public would believe came from Bitcoin's creator, in order to disrupt the Bitcoin market, extract money from people,...
0
votes
0
answers
82
views
Why do we need additional secret value (k) in ECDSA?
Formula for calculating an ECDSA signature (r, s) is:
s = k-1(z + qr)
k - private key for a random point R
z - hash of a message
q - original private key
r - x(R)
I am interested in why do we need ...
- 990
8
votes
1
answer
2k
views
Is libsecp256k1 faster than OpenSSL?
Bitcoin Core is eventually going to replace OpenSSL with libsecp256k1 for all ECDSA operations. As I understand it, this is motivated by wanting consensus-critical rules to not depend on OpenSSL.
Is ...
- 9,394
2
votes
2
answers
124
views
Curious about the Math that makes Bitcoin/Blockchain work ! Any good resources to learn it?
A bit of a background about me ; Computer Engineer but during my studies i didn't dive too deep into the maths , especially the maths that makes the blockchain and cryptography work
looking for advice ...
CommunityBot
- 1
0
votes
1
answer
111
views
What does a digital signature scheme need to have in order to be used (indirectly) in Bitcoin?
Here (see the comments) Pieter Wuille described digital scheme as a collection of three algorithms:
(key generation, signing, verification)
Since Bitcoin uses ECDSA (pre-Taproot outputs) and Schnorr (...
- 108k
-2
votes
1
answer
50
views
Feedback system possible
I grasp the concept of point negation and addition quite well. Point negation involves taking a public key, inverting it, and adding it to a target. The resulting difference between the target and the ...
- 108k
0
votes
3
answers
789
views
Why do private keys have a range limit?
I am reading about ECDSA, and I find that the private key must be in (0,n), with n = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141.
Is n the total number of points on the ...
0
votes
1
answer
168
views
How to convert the results of point doubling (Rx1 and Ry1) to point addition (Rx2 and Ry2) without knowledge of (Qx, Qy) in secp256k1 elliptic curve [closed]
I'm working with the secp256k1 elliptic curve and have point doubling and point addition formulas for this curve. Given the following formulas:
Point Addition Formula in Python3:
s = (Qy - Gy) * pow(...
- 77k
2
votes
1
answer
508
views
How to manually verify an ECDSA signature in Python?
Maybe I got the formula wrong but I heard that x = (z*s^-1)*G+(r*s^-1)*K is the equation for verifying an ECDSA signature but my code says signature is invalid but the values are from a valid bitcoin ...
- 9,394
0
votes
3
answers
517
views
How does Bitcoin handle address collisions?
Since the addresses are hashes of a public portion of a public/private ECDSA keypair, what would happen to two different people with different keys that hashes into the same address?
How would ...
- 9,394
0
votes
1
answer
207
views
Would two related nonces cause the private key to leak?
Let there be two signatures made with the same private key(d) using two nonces {k1, k2}. Would knowing that k1*u+f=k2 be sufficient to reveal the private key(d)?
- 1
0
votes
1
answer
70
views
Do we pay cheaper fees for less security in P2TR rather than P2PKH?
Answer quote:
P2TR now is a spiritual successor of P2PK: it locks funds directly to a key and only requires a signature to spend the funds.
If P2TR UTXOs are guarded by Schnorr signatures and P2PKH ...
- 431
2
votes
1
answer
470
views
p2pkh vs. p2pk keeping public key private
I just got into learning Bitcoin programming through Jimmy Song's Programming Bitcoin.
Jimmy says that some of p2pkh's advantages over p2pk include:
a smaller ScriptPubKey
keeping one's public key ...
- 77k
1
vote
1
answer
109
views
What is the concept behind extracting point x from point y given that both are correspondants of G ^ k mod p
Within the encryption protocol that governs bitcoin (Secp256k1 to be precise), the generated points publicKey_x and publicKey_y are a results of calculated coordinates within the finite field " G^...
- 15.7k
6
votes
3
answers
2k
views
How to determine first byte (recovery ID) for signatures (message signing)?
I do realize that in bitcoin when we return the signature result for signing a message the first byte includes information for recovering the public key required for verification using a formula like ...
- 3
0
votes
1
answer
300
views
Address Reuse and ECDSA Concern
I have a question about address reuse. Admittedly, I'm a little confused on the matter, so please bear with me if the framing of my question doesn't make much sense.
Recently I started using Sparrow ...
- 77k
0
votes
2
answers
315
views
Is Taproot the best address against quantum computers attack?
I'm looking for an address type for long term storage of bitcoin but I don't know what to choose. I'm not sure if Taproot is more secure than segwit.
Another question I have about Taproot, is that if ...
- 77k
4
votes
1
answer
6k
views
Invalid public key was spent! How was this possible?
From previous questions this bitcoin 1FYMZEHnszCHKTBdFZ2DLrUuk3dGwYKQxh address had an invalid public key of "00" and was unspendable but the coins are now spent?? The invalid key was generated by a ...
- 101
1
vote
1
answer
87
views
Is the Z value generated before the (r, s) values?
I just want to confirm my understanding of signatures for P2PKH transactions.
The signature hash, z, is generated before generating the r and s values of a DER signature, correct?
- 673
9
votes
2
answers
4k
views
Are Schnorr signatures quantum-computer resistant?
Here (https://bitcoincore.org/en/2017/03/23/schnorr-signature-aggregation/) it says Schnorr replaces ECDSA, we know that ECDSA can be broken by quantum computers. Is Schnorr safe from q-computers?
CommunityBot
- 1
2
votes
2
answers
3k
views
What does sigscript and witness mean?
I tried using the R scanner from the following link https://github.com/ca333/rng-scanner/blob/master/rscan.py, then I got results like this
Bitcoin Address : 3EZ5yV5FARDqEZTXzwWNt33XLVhv7hqAS2
R: ...
- 673
1
vote
2
answers
74
views
Error while installing libwally
I am trying to install libwally on my debian machine. I followed the installation guide but running ./configure I got the warning
=== configuring in src/secp256k1 (/home/standup/libwally-core/src/...
- 1
1
vote
1
answer
327
views
Basic point multiplication with G in libsecp256k1
I'm trying to work out a minimal example with the bitcoin core secp256k1 library but am a bit lost due to the many options available. Concretely, I simply want to use libsecp256k1 to multiply the ...
- 9,394
8
votes
1
answer
5k
views
What is the maximum size of a DER encoded ECDSA signature?
I've been told by a seasoned Bitcoin contributor that signatures in Bitcoin could be up to 75 bytes. I'm curious to find out how that maximum comes to pass.
According to this answer on Why the ...
- 77k
2
votes
1
answer
4k
views
Recovering ECDSA public key from the signature
How to recover ECDSA public key from the signature?
I know that all is need is a hash of the unsigned message and signature.
But may be there is some detailed method for to calculate ECDSA public ...
- 21
0
votes
0
answers
155
views
secp256k1, reused nonce across two differents pubkeys
Edited: changing the notation according request by fgrieu.
I have prepared 4 transactions for 2 pubkeys with the same r1 and r2.
properties of secp256k1:
p = ...
- 23
1
vote
1
answer
533
views
Can a signer recover their own signature's nonce `k`?
I am proofreading a blog post about nonce reuse. One point that comes up is whether someone could recover another person's private key if the other user reuses the same nonce. In that context, it was ...
- 77k
1
vote
1
answer
273
views
Question about transaction verification relating to the ECDSA "nonce"
Context about the ECDSA nonce: Questions about generating a random number for ECDSA
Are these nonce values public or private? I understand that they are generated to be different every transaction and ...
- 108k
1
vote
0
answers
177
views
Is Curve25519 better option than Secp256k1?
Are signatures over Curve25519 better than over Secp256k1 or are there major drawbacks?
How do, for instance, EdDSA/Schnorr using Curve25519 compare with ECDSA/Schnorr for Secp256k1?
- 479
1
vote
1
answer
140
views
Keep getting wrong bitcoin addresses
I'm trying to write a script that can generate a private key and the compressed and uncompressed addresses. It seems to work however the private key doesn't correspond to the addresses generated. Can'...
- 121
4
votes
1
answer
1k
views
In ECDSA, why is (r,−s mod n) complementary to (r, s)?
I am trying to find resources in previous malleability posts, but couldn't find derivations/proofs of this fact or how the exact low-s value is derived. Any pointers would greatly appreciated.
- 147
2
votes
1
answer
90
views
Will ECDSA be less and less popular when Schnorr signature can be used in Bitcoin?
Schnorr signature is simpler than ECDSA, and it enjoys the linearity property, which brings more efficiency to Bitcoin. Will ECDSA be less and less popular when the Schnorr signature can be used in ...
- 15.7k
7
votes
1
answer
1k
views
Why was ECDSA chosen over Schnorr Signatures in the inital design?
Schnorr Signatures and Signature aggregation is in the bitcoin technology roadmap. Schnorr Signatures was around the same time ECDSA is around.
Why wasnt Schnorr Signature Scheme implemented at the ...
- 15.7k
17
votes
3
answers
9k
views
How do you derive the private key from two signatures that share the same k value?
I wrote my own ECDSA signature algorithm just for the purpose of creating unit tests.
With it I created two signatures which went into transaction 56ec7ca7df..., sending from 1GXFXm3es.... These ...
- 1
2
votes
2
answers
307
views
What is the relationship between r in signature and the public key
I've been reading about ECDSA in here.
Step 11 says that
you only need the ‘x‘ value (20 bytes) for the signature, and that value will be called ‘R‘
Does that say that R is the x-coordinate of the ...
- 1,500
1
vote
1
answer
294
views
Do I have to worry about endian swapping when calculating ECDSA public key values, Creation & Signing of transactions and verification of signature?
Do I have to worry about endian swapping when calculating ECDSA public key values, Creation & Signing of transactions and verification of signature?
This question is more of a straightforward yes/...
- 1,500
2
votes
1
answer
210
views
Were uncompressed public keys always supported by Bitcoin?
I was wondering when compressed public keys were introduced to bitcoin, then I saw this quote from this answer:
The original Bitcoin software didn't use compressed keys only because their use was ...
- 77k
2
votes
1
answer
419
views
How to calculate the public key, compute point P and create signature using ECDSA?
I'm quite new to the intricacies of bitcoin cryptography and ECDSA and elliptic curve cryptography has me quite stymied. I am faced with a curve with the equation: y^2 = x^3 + 7 of order N=39 with ...
CommunityBot
- 1
16
votes
1
answer
877
views
How many bitcoin transactions can be verified per second on commodity hardware in 2020?
I am trying to figure out how many Bitcoin transactions could be verified per second.
Am I correct that signature verification is more expensive than computing Merkletrees and hashes and therefore ...
- 9,394