Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ecdsa]

The Elliptic Curve Digital Signature Algorithm

1
vote
2answers
53 views

How to figure out the coordinates of a compressed G point?

I really can't get my head around this ECDSA thing... So far I know that it's used for validating transactions by having a private key sign its signature to the transaction. I've come to the math part ...
1
vote
3answers
668 views

What is the reasoning behind the choice of 2^256-2^32-977 for the prime on the secp256k1 curve?

In Bitcoin's elliptic curve (secp256k1), the prime p = 2^256 - 2^32 - 2^9 -2^8 - 2^7 - 2^6 - 2^4 - 1 the generator point Gx = 0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798 ...
4
votes
2answers
606 views

Bitcoin how to get X value from Y

How to get X value from Y? ECDSA x,y coordinate validity verification doesn't seem to work X = 0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798 Python code, p = ...
1
vote
1answer
20 views

Why are exactly 4 bit windows used in the lookup table of libsecp256k1 to speed up point multiplications?

From the Readme of secp256k1 we can see the following: Use a precomputed table of multiples of powers of 16 multiplied with the generator, so general multiplication becomes a series of additions. ...
2
votes
2answers
2k views

Where can I find code that allows me to calculate Z1 and Z2 from an ECDSA signature?

By following Recovering Bitcoin private keys using weak signatures from the blockchain, I am able to do other calculations, but I have no idea how to calculate Z1 or Z2. There was a public code ...
4
votes
1answer
38 views

Does MuSig have the same security as 2-2 multisig?

Disclaimer: This question is of theoretical importance to me trying to educate myself better on cryptographic principles and signature schemes. I don't intend to imply that in practice schnorr ...
4
votes
2answers
2k views

Bitcoin private key, location on ECC curve

In the ECDSA algorithm, the Bitcoin private key is supposedly a point on the graph (or is it?). But the private key is a single integer, and not x,y coordinates. Is the integer, by itself, the x ...
3
votes
1answer
36 views

ECDSA signature with r value of 31?

occasionally on Android we are generating an ECDSA signature. This turns out to have a "r" length of 31 bytes. Is that valid? For reference here is a nice diagram outlining the ASN.1 structure of ...
1
vote
1answer
691 views

How do I get hash to verify transaction?

If I have the public key and signature for a transaction how do I get the hash value that is used in verify(hash, sig, pubkey). I want to know how to work backwards from a raw transaction to get it, ...
1
vote
1answer
39 views

Why is a cyclic subgroup chosen in ECDSA?

One thing which I am wondering for a long time and to which I did not find an answer after doing a web search and hope to find an answer here. When we construct the elliptic curve over a prime field ...
2
votes
4answers
17k views

online tool to play around with ECDSA public keys, message signature verification?

I realize that this question may be borderline bannable because it's asking for suggestions on tools, but it will really help newbies. This online tool allowed me to play around with hashes and to ...
0
votes
1answer
65 views

Generator Point G multiple

if in a curve y2 mod p = x3+ 7 mod p ( ecdsa-secp256k1) p=115792089237316195423570985008687907853269984665640564039457584007908834671663 G=...
1
vote
2answers
95 views

Nonce usage in ECDSA signing algorithm

I'm trying to understand the signing function secp256k1_ecdsa_sig_sign(), and I'm curious about the nonce usage here. static int secp256k1_ecdsa_sig_sign(const secp256k1_ecmult_gen_context *ctx, ...
8
votes
2answers
3k views

Transaction signature generation

When one sets up a transaction, the input of the transaction needs to have a script with a signature to show that you can spend those coins. Which fields of the previous and current transactions need ...
7
votes
2answers
12k views

For a non-technical person, how do I generate a ECDSA key pair easily?

I want to know because I would like to generate a vanity address at Vanity Pool.
13
votes
2answers
2k views

How do you derive the private key from two signatures that share the same k value?

I wrote my own ECDSA signature algorithm just for the purpose of creating unit tests. With it I created two signatures which went into transaction 56ec7ca7df..., sending from 1GXFXm3es.... These ...
1
vote
1answer
63 views

tiny-secp256k1 and ECDSA signing determinism

I noticed in bitcoin when using the tiny-secp256k1 library to sign the signature for a signature hash of an input, the signature is always the same. However in other ECDSA secp256k1 libraries (im ...
2
votes
1answer
773 views

What is the maximum size of a DER encoded ECDSA signature?

I've been told by a seasoned Bitcoin contributor that signatures in Bitcoin could be up to 75 bytes. I'm curious to find out how that maximum comes to pass. According to this answer on Why the ...
4
votes
2answers
524 views

What are the advantages of using Secp256k1?

Bitcoin uses secp256k1 as the specification for it's address system (https://en.bitcoin.it/wiki/Secp256k1). What are the advantages (and disadvantages) of using this over other specifications such as ...
13
votes
1answer
1k views

What is the origin of insecure 64-bit nonces in signatures in the Bitcoin chain?

In Biased Nonce Sense: Lattice Attacks against Weak ECDSA Signatures in Cryptocurrencies Joachim Breitner and Nadia Heninger use a lattice based algorithm to recover private keys from signatures in ...
4
votes
1answer
625 views

How were the secp256k1 base point coordinates decided?

79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798,483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8 seems very random to me. I see how this point is on the curve, but how ...
3
votes
1answer
158 views

In ECDSA, why is (r,−s mod n) complementary to (r, s)?

I am trying to find resources in previous malleability posts, but couldn't find derivations/proofs of this fact or how the exact low-s value is derived. Any pointers would greatly appreciated.
0
votes
1answer
77 views

How public key is calculated from a base58 encoded private key?

I followed this post and created a private key for bitcoin wallet. The post says after finding the random 256 bit(32 bytes) integer the version number should be prepended and the checksum should be ...
1
vote
1answer
2k views

ecdsa - Create Private key and Bitcoin Address

I have the following code: import binascii import hashlib from fastecdsa import keys, curve # generate a private key for curve P256 priv_key = keys.gen_private_key(curve.secp256k1) print (priv_key) ...
2
votes
1answer
91 views

Bitcoin ECDSA signature in the compact format

I would like to understand how to get Bitcoin ECDSA signature in a compact format, when it's exactly 65 bytes. In the bitcoin-core repository, secp256k1_ecdsa_recoverable_signature_load is ...
2
votes
1answer
93 views

How to determine first byte (recovery ID) for signatures (message signing)?

I do realize that in bitcoin when we return the signature result for signing a message the first byte includes information for recovering the public key required for verification using a formula like ...
1
vote
1answer
127 views

OpenSSL bitcoin addresses generation

Using OpenSSL ver 1.1.0h on win 8.1 - 32 bit Im trying to recreate this post using cmd: OpenSSL generate Bitcoin address But on step 3: openssl ec -in c:\keys\private.pem -outform DER|tail -c +8|...
-1
votes
2answers
2k views

how do you figure out the r and s out of a signature using python [closed]

ECDSA r, s encoding as a signature this link doesnt seem to add up, any suggestions?
2
votes
3answers
701 views

In Elliptic Curve Addition, where does the second point come from?

I have a limited understanding of elliptic curve terminology, but if you can bear with me I'd like to ask this question anyway. I'll start with what I understand... You do EC multiplication with the ...
65
votes
1answer
10k views

If someone wanted to pretend to be Satoshi by posting a fake signature to defraud people how could they?

If a random fraudster wanted to post a bunch of mysterious ECDSA signatures that the public would believe came from Bitcoin's creator, in order to disrupt the Bitcoin market, extract money from people,...
2
votes
2answers
81 views

Bitcoind does not like ECDSA (r, s) pair produced by OpenSSL

I am writing transactions manually and have stumbled across a rather bizarre situation. Only one in a few of the transactions I broadcast to bitcoind is accepted, otherwise I get a REJECT_NONSTANDARD ...
5
votes
3answers
4k views

How to generate a public key from a private key using Elliptic Curve Digital Signature Algorithm

I'm trying to understand the graphical basis that underlies the discreet logarithmic Elliptic Curve Digital Signature Algorithm (ECDSA) introduced in Chapter 4 of "Mastering Bitcoin" by Andreas ...
2
votes
1answer
68 views

Why are some public keys prefixed with 0x00?

ECDSA public keys seem to always start with 0x02/0x03/0x04/0x05 1, followed by either 32 bytes of 64 bytes. However, I encounter some public keys prefixed with 0x00. For example, the source output ...
1
vote
0answers
91 views

How verify p2sh spending transaction signature using public key with btcsuite?

I'm trying to verify inputs signatures in Go using Verify Signature script of package btcec. Decoding this p2sh spending transaction rawSpendingTxd := ...
2
votes
1answer
63 views

Can someone explain me ECDSA (creating public from private key) with 8-bit numbers? [closed]

Trying to understand Elliptic Curve maths with 256-bit numbers seems like hard to explain/understand. I wonder if by lowering down the possible numbers get's a little bit easier.
5
votes
2answers
792 views

What is is minimum possible number for an ECDSA private key?

Private keys are 256 bit numbers. I know the max. possible number is something around: 115792089237316195423570985008687907852837564279074904382605163141518161494336 What about the min. number ...
0
votes
1answer
227 views

How to find Values N and K given R,S and Z in ECDSA?

How to find Value N and K ? I have the values for R, S and Z. for example these: BigInteger R =("00d47ce4c025c35ec440bc81d99834a624875161a26bf56ef7fdc0f5d52f843ad1")); BigInteger S =("...
2
votes
3answers
1k views

ECDSA x,y coordinate validity verification doesn't seem to work

The ECDSA algorithm, secp256k1 for Bitcoin allegedly uses the equation y ^ 2 = x ^ 3 + 7 mod P to determine the validity of an alleged point upon the elliptical curve. Utilizing http://web2.0calc....
5
votes
2answers
526 views

The complement of s (when s < curve order / 2)

Bitcoinlib refers to the requirement that if s > ORDER / 2, then the complement of s should be used instead since it's one byte shorter This sounds like it's referring to the inverse or negative s ...
19
votes
2answers
10k views

ECDSA: (v, r, s), what is v?

Deterministically signing a Tx with RFC6979 returns v, r, s, where r and s are the 2 values used in standard ECDSA signatures. v = 27 + (y % 2), so 27 + the parity of r, as pybitcointools indicates. ...
2
votes
1answer
113 views

Hypothetical Scenario - Address collision with address with already confirmed outgoing transaction

In a typical case of finding a collision with an address, as long as the private key provided has a consistent public key that hashes to the address, then the coins in that address can be spent. The ...
0
votes
2answers
73 views

ECDSA Input When Transferring Bitcoin From Owner A to Owner B

I want to get my terms right and master how transactions work within the Bitcoin network. Keeping things simple, when Alice wants to transfer 1 BTC to Bob, Alice signs a message with her private key....
2
votes
2answers
453 views

Bitcoin - Technical difference between P2PKH and P2SH address generation?

I was convinced that the only difference between the generation of addresses starting with '1' and '3' was simply changing the prefix added to the digest from 0x00 to 0x05 after the ripemd160 part. ...
0
votes
1answer
93 views

Address and Public key [duplicate]

I am reading about cryptography in Bitcoin. Bitcoin adress is created by applying cryptographic hash function to public key of the wallet. I know that this function is a trap door function but what ...
11
votes
2answers
9k views

Recovering private key when someone uses the same k twice in ECDSA signatures

In this blog: http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html the author showed a case that using same k twice will leak private key. Many people know this method. But I ...
3
votes
2answers
245 views

Unable to construct a correct raw transaction for bitcoin cash testnet

I am trying to construct a raw transaction for bitcoin cash testnet. I have made a lot of use out of this very nice answer to how to construct a raw transaction, but am still unable to construct a ...
0
votes
0answers
113 views

Would it be possible for an 8-bit microprocessor to create a bitcoin keypair?

Context for question: With the latest security breaches around modern CPU's (Spectre / Meltdown) I was wondering if we could generate ECDSA keypairs on cheap, small and/or simple air gapped (micro)...
1
vote
1answer
3k views

Public key from private key generation problem

I met some problems, when I was trying to write function able to create Bitcoin public key from private key. I was using the tutorial: http://procbits.com/2013/08/27/generating-a-bitcoin-address-with-...
0
votes
0answers
135 views

How to make calculations using Decimal to Hex converter?

Help me understand this article ECDSA Signature and the “z” valueI have questions on the calculation of these formulas? I use to calculate MATLAB all the values ​​I converted via (Decimal to Hex ...
2
votes
1answer
155 views

Why is it harder to generate addresses starting with 1s?

Here's a table I got from bitcoin wiki. They say: A special case, leading numbers 1 (one) is especially difficult. But why?