Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ecdsa]

The Elliptic Curve Digital Signature Algorithm

2
votes
4answers
17k views

online tool to play around with ECDSA public keys, message signature verification?

I realize that this question may be borderline bannable because it's asking for suggestions on tools, but it will really help newbies. This online tool allowed me to play around with hashes and to ...
1
vote
1answer
157 views

Is there a simple reference implementation of ECDSA algorithms?

I'm using Node.js's elliptic library to do some signing on my app, but there is some chance I'll migrate it to another language. That library is kinda big and not easy to port, so, I wonder, is there ...
5
votes
1answer
3k views

How to sign raw transaction given a private key and SHA hash (in java)

I have followed the instructions here to build my own bitcoin transaction. Redeeming a raw transaction step by step example required Currently my code can create a transaction and compute the SHA ...
1
vote
1answer
237 views

Why transaction is signed with locking script from the input transaction?

Finally, I've successfully made a raw transaction with Python and this is the last thing, which is totally mistic for me. In my case, here's the input transaction and it's locking script is: OP_DUP ...
4
votes
1answer
1k views

OpenSSL and Secp256k1 differing in implementation of ECDSA signatures?

OpenSSL (from ssl in Mac OS X Version 10.11.6) and Secp256k1 (from the bitcoin-core repository) seem to differ in their implementations of ECDSA. I'm having issues with these differences and want to ...
2
votes
1answer
2k views

How to generate Bitcoin private - public keys with ECDSA module?

Pretty same question was asked here, but maybe there is a way to generate keys using ecdsa module in just a few lines of code?
0
votes
1answer
147 views

Should signature verification by key recovery ignore compression status?

The bitcoinj library's API offers a signMessage method of the ECKey class which returns a signature (r,s) as 65 bytes encoded as a Base64 string. The crunch of the encoding lies in the additional ...
3
votes
1answer
1k views

How do I convert Public Key x value to y in Python and verify?

I have been using the BTC Address utility which enables me to type in something like: 020F031CA83F3FB372BD6C2430119E0B947CF059D19CDEA98F4CEFFEF620C584F9 Then clicking a button the program can spit ...
0
votes
1answer
561 views

Testing the blockchain for ECDSA signature random collision

The wikipedia page on ECDSA signature explains how the signer's private key can be recovered if two signatures are produced with the same random (private key looking) element k. In fact, it is claimed ...
2
votes
1answer
155 views

Why is it harder to generate addresses starting with 1s?

Here's a table I got from bitcoin wiki. They say: A special case, leading numbers 1 (one) is especially difficult. But why?
0
votes
1answer
164 views

Troubleshooting pybitcointools transaction signing/verification

I'm having several problems getting tests to successfully run under my fork (or vbuterin's pybitcointools, and I'm hoping someone with a combined Python / Bitcoin knowledge can provide some insight. ...
2
votes
1answer
1k views

How can I convert a bitcoin private key (hex) into a Bitcoin public key? [duplicate]

How can I take a bitcoin private key encoded in hex: d1d9a2e9fd3da7e7710310ea17a9edff9e08845c7a6f2ea3d650ba4ae7ee0d3b and convert it to the corresponding public key: ...
5
votes
1answer
381 views

Bitcoin safe if ECDSA is broken?

I've read that one reason to use a new address for each transaction is because it hides the pubkey behind a hash, so that even if ECDSA is broken and someone is able to derive my privkey from my ...
0
votes
2answers
493 views

Signing data with ECDSA

I was reading about the math behind bitcoins in this article, and one thing I can't seem to wrap my head around is how the said algorithm is used to sign "data". What exactly is this "data"? Is it my ...
2
votes
1answer
490 views

Can't find correct z1 & z2 for transaction

I've been trying to understand the issue and repeat Willem Hengeveld's answer, but I think I'm failing at getting correct script for hash. I'm looking for this transaction, my scripts are: ...
1
vote
1answer
457 views

how base point of bitcoin public key x , y formed

n = FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364140 p = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F base point of bitcoin public key x , y Gx = ...
0
votes
3answers
304 views

How Bitcoin handles addresses collisions?

Since the addresses are hashes of a public portion of a public/private ECDSA keypair, what would happen to two different people with different keys that hashes into the same address? How would ...
1
vote
1answer
350 views

ECKey.ECDSASignature creation

I have my ECKey key. In order to create an ECDSASignature object with BitcoinJ, we have to call ECDSASignature mySignature = key.sign(Sha256Hash input). Is the Sha256Hash input my message? Or is it ...
1
vote
1answer
326 views

Verifing the given R/S pair (signature) against a hash using the public key

According to this function: public boolean verify(Sha256Hash sigHash, ECDSASignature signature) { return ECKey.verify(sigHash.getBytes(), signature, getPubKey()); } I do not understand ...
2
votes
1answer
3k views

PEM format for ECDSA

I have been looking at Coinapult's API documentation which details the use of PEM format in python-ecdsa. Specifically, private keys and public keys need to be formatted using PEM. Let's take ...
1
vote
0answers
563 views

Cryptocurrencies based on RSA instead of ECDSA

Bitcoin is based on ECDSA. Does anyone know of cryptocurrencies based on RSA for authentication?
6
votes
1answer
204 views

Why isn't Bitcoin using public key extraction from signature to reduce the blockchain size?

Why doesn't Bitcoin use public key recovering from the signature in order to reduce the Blockchain size? This would save 32 bytes per transaction input.
1
vote
1answer
353 views

How does ripple verify the signature?

As I understand, the client send the following information to server 1.the hash of the message, 2. public key 3. signature made by private key And the server verified the signature with the ...
2
votes
1answer
324 views

Are there any signatures where the recid (v) is equal to 29,30 (or 33,34 compressed)?

Peter Wuille recently explained how ECDSA pubkey recovery is done, in response to my question. So it's basically that for a given base64 signature, the value v in v,r,s provides the specific ...
9
votes
1answer
408 views

Why was the Oct 2015 Transaction Malleability event possible in spite of BIP62/66?

The recent re-emergence of transaction malleability has been responsible for a large number of Txs which are being double spent (October 2015). /r/Bitcoin has posted some C++ code which @amaclin has ...
1
vote
2answers
525 views

How do I add two secp256k1 keys together?

I have two public/private keypairs, A and B. I want to add them together to get a new keypair AB. I'd also like to be able to add the public keys of A and B to get the public key of AB. How do I do ...
1
vote
2answers
504 views

Why are r and s modulo N? (not P)

As Peter Wuille mentions here, the ECDSA signature values (r, s) are modulo N (eg verifying ECDSA signatures, where u1 = z * w % N), whereas the rest of the ECDSA functionality in Bitcoin seems to be ...
4
votes
2answers
605 views

Bitcoin how to get X value from Y

How to get X value from Y? ECDSA x,y coordinate validity verification doesn't seem to work X = 0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798 Python code, p = ...
3
votes
2answers
764 views

The shortest ECDSA signature

I want to create ECDSA signature {r,s} where r is very low (for example 1) and can be encoded in DER-format in one byte. How to calculate k value? Seems to me that it does not depend of anything. ...
19
votes
2answers
10k views

ECDSA: (v, r, s), what is v?

Deterministically signing a Tx with RFC6979 returns v, r, s, where r and s are the 2 values used in standard ECDSA signatures. v = 27 + (y % 2), so 27 + the parity of r, as pybitcointools indicates. ...
5
votes
2answers
525 views

The complement of s (when s < curve order / 2)

Bitcoinlib refers to the requirement that if s > ORDER / 2, then the complement of s should be used instead since it's one byte shorter This sounds like it's referring to the inverse or negative s ...
0
votes
0answers
893 views

Any bitcoin transaction to get S1 and Z1 and R value script need

bitcoin transaction to get S1 and Z1 and R value script need Need script that gives bitcoin translation to S1 and Z1 and R value like below link http://2coin.org/txinfo.aspx?txid=...
-1
votes
1answer
841 views

converting RUBY script into PYTHON ( Recovering private key when someone uses the same k twice )

require 'ecdsa' public_key_hex = '02a50eb66887d03fe186b608f477d99bc7631c56e64bb3af7dc97e71b917c5b364' msghash1_hex = '01b125d18422cdfa7b153f5bcf5b01927cf59791d1d9810009c70cd37b14f4e6' msghash2_hex = '...
1
vote
0answers
2k views

Same identical R value of all transaction not provide corresponding privatekey

ECDSA Signature and the “z” value from above link learn calculation of z value and to get private key https://blockchain.info/tx/9ec4bc49e828d924af1d1029cacf709431abbde46d59554b62bc270e3b29c4b1 ...
1
vote
1answer
827 views

Two identical R value finding z value from two transaction

tx1 from the trans1 i got Input Scripts 30450220262e481b6d8905b5adba67aff05eb8261501b0a9434c0b7f043d00cf8d23c91b022100bf82c0d212f30d3a0599e9b879516d762eaf5688ab83787cf470e99af5a6917101 ...
1
vote
1answer
1k views

same R value is used for two different addresses? finding z1 and z2 value and privatekey

txid1 txid2 input script 1 304502206bcc247f1259262b4035bfa84f0397a69f69baa01659daaf94fe1164b650c86a022100a044b38e8264a1c928ddd28b4657aa7109d1ea30e911208c7ce57abcb1451fe601 ...
4
votes
1answer
294 views

bitcoin two identical R

Blockchain transaction id 30440220d47ce4c025c35ec440bc81d99834a624875161a26bf56ef7fdc0f5d52f843ad1022044e1ff2dfd8102cf7a47c21d5c9fd5701610d04953c6836596b4fe9dd2f53e3e01 ...
2
votes
3answers
699 views

In Elliptic Curve Addition, where does the second point come from?

I have a limited understanding of elliptic curve terminology, but if you can bear with me I'd like to ask this question anyway. I'll start with what I understand... You do EC multiplication with the ...
2
votes
1answer
342 views

Signature: encoding a message - transaction to a point of curve y^2=x^3+7 and Bitcoin Core

Where should I look at in Bitcoin Core source code to figure out how the signature process trasform a message in a curve point? To sign a transaction (message) in Bitcoin system, you need to encode ...
4
votes
1answer
4k views

Signing a raw transaction with Python ECDSA (or OpenSSL)

I'm looking for specifics of Step15-17 from Redeeming a raw Tx Step By Step, which is essentially the step where the concatenated raw Tx structure is double sha256 hashed, and then signed with an ...
5
votes
1answer
527 views

How do you invert an ECDSA multiplication to get the generator?

Pieter Wuille said: [...](people often assume that no inverse for EC multiplication exists, which is true, but only to solve for k in k*P = Q; solving for P is possible). When you multiply a ...
1
vote
1answer
686 views

How do I get hash to verify transaction?

If I have the public key and signature for a transaction how do I get the hash value that is used in verify(hash, sig, pubkey). I want to know how to work backwards from a raw transaction to get it, ...
4
votes
2answers
761 views

How can someone verify the signature of a Bitcoin ECDSA signature without knowing the signer's public key?

I understand how ECDSA exactly works and for verification of a signature, the public key of the signer is required. But in Bitcoin, public key is double hashed and the only information the receiver ...
8
votes
1answer
1k views

Is libsecp256k1 faster than OpenSSL?

Bitcoin Core is eventually going to replace OpenSSL with libsecp256k1 for all ECDSA operations. As I understand it, this is motivated by wanting consensus-critical rules to not depend on OpenSSL. Is ...
8
votes
1answer
2k views

Problems with deterministic ECDSA based on RFC6979 in Bitcoin

Generating random number k in elliptic curve is crucial and in any transactions signature in Bitcoin, random number k is required to compute a point k*G. If this k is chosen not randomly, it instantly ...
11
votes
2answers
9k views

Recovering private key when someone uses the same k twice in ECDSA signatures

In this blog: http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html the author showed a case that using same k twice will leak private key. Many people know this method. But I ...
6
votes
3answers
1k views

How do you derive the lambda and beta values for endomorphism on the secp256k1 curve?

You can see a little background about this on this bitcointalk post by the late Hal Finney. Beta and lambda are the values on the secp256k1 curve where: λ^3 (mod N) = 1 β^3 (mod P) = 1 As seen ...
2
votes
2answers
2k views

Where can I find code that allows me to calculate Z1 and Z2 from an ECDSA signature?

By following Recovering Bitcoin private keys using weak signatures from the blockchain, I am able to do other calculations, but I have no idea how to calculate Z1 or Z2. There was a public code ...
6
votes
1answer
383 views

Is normal ECDSA verification slower than a verification method based on Public Key Recovery?

Background info: This post on the Cryptography stack exchange shows how to almost uniquely recover the public key from the signature, hash of the signed data, and knowledge of the curve: https://...
2
votes
3answers
1k views

ECDSA x,y coordinate validity verification doesn't seem to work

The ECDSA algorithm, secp256k1 for Bitcoin allegedly uses the equation y ^ 2 = x ^ 3 + 7 mod P to determine the validity of an alleged point upon the elliptical curve. Utilizing http://web2.0calc....