Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ecdsa]

The Elliptic Curve Digital Signature Algorithm

2
votes
1answer
534 views

What is the maximum size of a DER encoded ECDSA signature?

I've been told by a seasoned Bitcoin contributor that signatures in Bitcoin could be up to 75 bytes. I'm curious to find out how that maximum comes to pass. According to this answer on Why the ...
3
votes
2answers
489 views

What are the advantages of using Secp256k1?

Bitcoin uses secp256k1 as the specification for it's address system (https://en.bitcoin.it/wiki/Secp256k1). What are the advantages (and disadvantages) of using this over other specifications such as ...
12
votes
1answer
1k views

What is the origin of insecure 64-bit nonces in signatures in the Bitcoin chain?

In Biased Nonce Sense: Lattice Attacks against Weak ECDSA Signatures in Cryptocurrencies Joachim Breitner and Nadia Heninger use a lattice based algorithm to recover private keys from signatures in ...
3
votes
1answer
568 views

How were the secp256k1 base point coordinates decided?

79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798,483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8 seems very random to me. I see how this point is on the curve, but how ...
2
votes
1answer
111 views

In ECDSA, why is (r,−s mod n) complementary to (r, s)?

I am trying to find resources in previous malleability posts, but couldn't find derivations/proofs of this fact or how the exact low-s value is derived. Any pointers would greatly appreciated.
0
votes
1answer
27 views

How public key is calculated from a base58 encoded private key?

I followed this post and created a private key for bitcoin wallet. The post says after finding the random 256 bit(32 bytes) integer the version number should be prepended and the checksum should be ...
-3
votes
1answer
26 views

How to get private ECDSA key [on hold]

I want to know how to use r,s,z sign and pubkey hex of a raw transaction to get the private key hex
1
vote
1answer
2k views

ecdsa - Create Private key and Bitcoin Address

I have the following code: import binascii import hashlib from fastecdsa import keys, curve # generate a private key for curve P256 priv_key = keys.gen_private_key(curve.secp256k1) print (priv_key) ...
2
votes
1answer
40 views

Bitcoin ECDSA signature in the compact format

I would like to understand how to get Bitcoin ECDSA signature in a compact format, when it's exactly 65 bytes. In the bitcoin-core repository, secp256k1_ecdsa_recoverable_signature_load is ...
2
votes
1answer
43 views

How to determine first byte (recovery ID) for signatures (message signing)?

I do realize that in bitcoin when we return the signature result for signing a message the first byte includes information for recovering the public key required for verification using a formula like ...
1
vote
0answers
26 views

How to figure out the coordinates of a compressed G point?

I really can't get my head around this ECDSA thing... So far I know that it's used for validating transactions by having a private key sign its signature to the transaction. I've come to the math part ...
1
vote
1answer
101 views

OpenSSL bitcoin addresses generation

Using OpenSSL ver 1.1.0h on win 8.1 - 32 bit Im trying to recreate this post using cmd: OpenSSL generate Bitcoin address But on step 3: openssl ec -in c:\keys\private.pem -outform DER|tail -c +8|...
-1
votes
2answers
2k views

how do you figure out the r and s out of a signature using python [closed]

ECDSA r, s encoding as a signature this link doesnt seem to add up, any suggestions?
2
votes
3answers
664 views

In Elliptic Curve Addition, where does the second point come from?

I have a limited understanding of elliptic curve terminology, but if you can bear with me I'd like to ask this question anyway. I'll start with what I understand... You do EC multiplication with the ...
63
votes
2answers
9k views

If someone wanted to pretend to be Satoshi by posting a fake signature to defraud people how could they?

If a random fraudster wanted to post a bunch of mysterious ECDSA signatures that the public would believe came from Bitcoin's creator, in order to disrupt the Bitcoin market, extract money from people,...
1
vote
2answers
67 views

Bitcoind does not like ECDSA (r, s) pair produced by OpenSSL

I am writing transactions manually and have stumbled across a rather bizarre situation. Only one in a few of the transactions I broadcast to bitcoind is accepted, otherwise I get a REJECT_NONSTANDARD ...
5
votes
3answers
3k views

How to generate a public key from a private key using Elliptic Curve Digital Signature Algorithm

I'm trying to understand the graphical basis that underlies the discreet logarithmic Elliptic Curve Digital Signature Algorithm (ECDSA) introduced in Chapter 4 of "Mastering Bitcoin" by Andreas ...
2
votes
3answers
15k views

online tool to play around with ECDSA public keys, message signature verification?

I realize that this question may be borderline bannable because it's asking for suggestions on tools, but it will really help newbies. This online tool allowed me to play around with hashes and to ...
2
votes
1answer
60 views

Why are some public keys prefixed with 0x00?

ECDSA public keys seem to always start with 0x02/0x03/0x04/0x05 1, followed by either 32 bytes of 64 bytes. However, I encounter some public keys prefixed with 0x00. For example, the source output ...
1
vote
0answers
69 views

How verify p2sh spending transaction signature using public key with btcsuite?

I'm trying to verify inputs signatures in Go using Verify Signature script of package btcec. Decoding this p2sh spending transaction rawSpendingTxd := ...
2
votes
1answer
59 views

Can someone explain me ECDSA (creating public from private key) with 8-bit numbers? [closed]

Trying to understand Elliptic Curve maths with 256-bit numbers seems like hard to explain/understand. I wonder if by lowering down the possible numbers get's a little bit easier.
5
votes
2answers
775 views

What is is minimum possible number for an ECDSA private key?

Private keys are 256 bit numbers. I know the max. possible number is something around: 115792089237316195423570985008687907852837564279074904382605163141518161494336 What about the min. number ...
0
votes
1answer
175 views

How to find Values N and K given R,S and Z in ECDSA?

How to find Value N and K ? I have the values for R, S and Z. for example these: BigInteger R =("00d47ce4c025c35ec440bc81d99834a624875161a26bf56ef7fdc0f5d52f843ad1")); BigInteger S =("...
2
votes
3answers
1k views

ECDSA x,y coordinate validity verification doesn't seem to work

The ECDSA algorithm, secp256k1 for Bitcoin allegedly uses the equation y ^ 2 = x ^ 3 + 7 mod P to determine the validity of an alleged point upon the elliptical curve. Utilizing http://web2.0calc....
5
votes
2answers
479 views

The complement of s (when s < curve order / 2)

Bitcoinlib refers to the requirement that if s > ORDER / 2, then the complement of s should be used instead since it's one byte shorter This sounds like it's referring to the inverse or negative s ...
17
votes
2answers
9k views

ECDSA: (v, r, s), what is v?

Deterministically signing a Tx with RFC6979 returns v, r, s, where r and s are the 2 values used in standard ECDSA signatures. v = 27 + (y % 2), so 27 + the parity of r, as pybitcointools indicates. ...
2
votes
1answer
98 views

Hypothetical Scenario - Address collision with address with already confirmed outgoing transaction

In a typical case of finding a collision with an address, as long as the private key provided has a consistent public key that hashes to the address, then the coins in that address can be spent. The ...
0
votes
2answers
70 views

ECDSA Input When Transferring Bitcoin From Owner A to Owner B

I want to get my terms right and master how transactions work within the Bitcoin network. Keeping things simple, when Alice wants to transfer 1 BTC to Bob, Alice signs a message with her private key....
2
votes
2answers
384 views

Bitcoin - Technical difference between P2PKH and P2SH address generation?

I was convinced that the only difference between the generation of addresses starting with '1' and '3' was simply changing the prefix added to the digest from 0x00 to 0x05 after the ripemd160 part. ...
0
votes
1answer
90 views

Address and Public key [duplicate]

I am reading about cryptography in Bitcoin. Bitcoin adress is created by applying cryptographic hash function to public key of the wallet. I know that this function is a trap door function but what ...
11
votes
2answers
8k views

Recovering private key when someone uses the same k twice in ECDSA signatures

In this blog: http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html the author showed a case that using same k twice will leak private key. Many people know this method. But I ...
3
votes
2answers
205 views

Unable to construct a correct raw transaction for bitcoin cash testnet

I am trying to construct a raw transaction for bitcoin cash testnet. I have made a lot of use out of this very nice answer to how to construct a raw transaction, but am still unable to construct a ...
0
votes
0answers
99 views

Would it be possible for an 8-bit microprocessor to create a bitcoin keypair?

Context for question: With the latest security breaches around modern CPU's (Spectre / Meltdown) I was wondering if we could generate ECDSA keypairs on cheap, small and/or simple air gapped (micro)...
1
vote
1answer
3k views

Public key from private key generation problem

I met some problems, when I was trying to write function able to create Bitcoin public key from private key. I was using the tutorial: http://procbits.com/2013/08/27/generating-a-bitcoin-address-with-...
0
votes
0answers
116 views

How to make calculations using Decimal to Hex converter?

Help me understand this article ECDSA Signature and the “z” valueI have questions on the calculation of these formulas? I use to calculate MATLAB all the values ​​I converted via (Decimal to Hex ...
11
votes
2answers
2k views

How do you derive the private key from two signatures that share the same k value?

I wrote my own ECDSA signature algorithm just for the purpose of creating unit tests. With it I created two signatures which went into transaction 56ec7ca7df..., sending from 1GXFXm3es.... These ...
2
votes
1answer
151 views

Why is it harder to generate addresses starting with 1s?

Here's a table I got from bitcoin wiki. They say: A special case, leading numbers 1 (one) is especially difficult. But why?
1
vote
1answer
1k views

same R value is used for two different addresses? finding z1 and z2 value and privatekey

txid1 txid2 input script 1 304502206bcc247f1259262b4035bfa84f0397a69f69baa01659daaf94fe1164b650c86a022100a044b38e8264a1c928ddd28b4657aa7109d1ea30e911208c7ce57abcb1451fe601 ...
1
vote
1answer
81 views

What means “messege” in the bitcoin blockchain? [elliptic curve cryptography]

I am stuck with one question in my research. I found some mentions that bitcoin(or blockchain) is a messeging system, I played with couple curve encoding algorithms and it was like: Curve params, ...
4
votes
2answers
473 views

Invalid public key was spent! How was this possible?

From previous questions this bitcoin 1FYMZEHnszCHKTBdFZ2DLrUuk3dGwYKQxh address had an invalid public key of "00" and was unspendable but the coins are now spent?? The invalid key was generated by a ...
1
vote
3answers
2k views

Bitcoin public key to private key

I did go thru a lot of articles which say's It's highly impossible to break the bitcoin public-key and get a private key from it. I understand that the public key does hold some info of it's ...
4
votes
2answers
1k views

How are compressed PubKeys generated?

Just read this: https://bitcoin.stackexchange.com/a/1715/ What is the process to generate compressed pub keys via ECDSA?
1
vote
0answers
22 views

Why 256 bit for a cryptocurrency is enough but 1024 bit for ssh is not? [duplicate]

If 256-bit private key is secure enough for Bitcoin and Ethereum then why people are moving from 1024 to 2048-bit RSA for day-to-day cryptographic operations (such as ssh) and even this can be not ...
0
votes
2answers
720 views

How can I fix this: (Non-canonical signature: S value is unnecessarily high)

I've written a small script that will create a bitcoin transaction from scratch, using an ECDSA library. It works, but sometimes I get this error: 64: non-mandatory-script-verify-flag (Non-canonical ...
0
votes
1answer
125 views

Secure Generation of Private Keys

Suppose you've created a random private key by rolling dices. You've checked in the blockchain and nobody else has ever used the respective address of such private key. Issue Is this process ...
32
votes
5answers
30k views

How do you get a Bitcoin Public Key from a Private Key

How do I, in extreme specificity, convert a given private bitcoin key into a public bitcoin key (Talk to me like I'm 5 and I have to do this step by step or the evil witch will cook me alive in her ...
1
vote
1answer
120 views

Why does ScriptSig contain public key, since it can be recovered from the signature and message?

Using ECDSA, given a signature and the message signed, it is possible to recover the public key. So it seems to be a waste of up to 65 bytes in each transaction. Why does bitcoin do it? Which ...
14
votes
2answers
10k views

ECDSA r, s encoding as a signature

An ECDSA algorithm when signing a given messages produces a pair of outputs, r and s. How, given a sigStr from a Tx can one extract r and s? Are they just concatenated byte arrays of a specific length,...
8
votes
3answers
8k views

ECDSA Signature and the “z” value

The following link contains details on how to reverse the ECDSA signature if given two identical "R" values. http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html I have read ...
8
votes
3answers
4k views

What's the rationale of using ECDSA instead of RSA?

One major drawback of (EC)DSA is that it requires a good RNG, otherwise the private key may be accidentally exposed. This is also one of the major reasons (I found so far) why no(?) smartcard supports ...