# Questions tagged [ecdsa]

The Elliptic Curve Digital Signature Algorithm

126 questions
8k views

### ECDSA Signature and the “z” value

The following link contains details on how to reverse the ECDSA signature if given two identical "R" values. http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html I have read ...
1k views

### How to get the Z value aka Hash of the outputs to be signed

I get it that the "OP_CHECKSIG" does this, but I can't see how to recreate it. I tried SHA1 and SHA256 of some of the info in a given bitcoin transaction but it didn't give me confirmed values of Z. ...
2k views

### Bitcoin private key, location on ECC curve

In the ECDSA algorithm, the Bitcoin private key is supposedly a point on the graph (or is it?). But the private key is a single integer, and not x,y coordinates. Is the integer, by itself, the x ...
372 views

### How do you do point multiplication in bitcoin associated with the ecdsa algorithm?

I have posted a similar question recently, but not this specific. I have found that a lot may ride on the idea of "point multiplication" yet all explanations I have found lack explanation or are in ...
30k views

### How do you get a Bitcoin Public Key from a Private Key

How do I, in extreme specificity, convert a given private bitcoin key into a public bitcoin key (Talk to me like I'm 5 and I have to do this step by step or the evil witch will cook me alive in her ...
356 views

### In ScriptSig, which form of the public key is considered canonical?

In the standard pay-to-pubKeyHash scriptSig, which form of the public key should be used. My understanding is that both the compressed (33 bytes) and the expanded (64 bytes) are both valid. Is there ...
4k views

### What's the rationale of using ECDSA instead of RSA?

One major drawback of (EC)DSA is that it requires a good RNG, otherwise the private key may be accidentally exposed. This is also one of the major reasons (I found so far) why no(?) smartcard supports ...
3k views

### Public key from private key generation problem

I met some problems, when I was trying to write function able to create Bitcoin public key from private key. I was using the tutorial: http://procbits.com/2013/08/27/generating-a-bitcoin-address-with-...
835 views

### How to find out the ECDSA private key perfix version for Altcoins?

I want to create a paperwallet for an altcoin (Protoshares). I know the public key version byte is 0x38 (56) and the addresses start with P... But how do I find out the ECDSA private key prefix? For ...
2k views

### Why do keys need both X and Y coordinates, if X can be solved for Y using the curve equation?

Reference: https://en.bitcoin.it/wiki/File:PubKeyToAddr.png and https://en.bitcoin.it/wiki/Secp256k1 Why do we need both X and Y to make a private key?
2k views

### Why use DER encoding for signatures?

A signature in secp256k1 is two 32 byte numbers. DER encoding a signature adds about 6-7 bytes. It also needlessly complicates things (is DER encoding used anywhere else?). In a transaction format ...
650 views

### How are brain wallets generated?

How do sites like blockchain.info and bitaddress.org generate private keys by simply hashing a string? (the passphrase?) In this wiki article, https://en.bitcoin.it/wiki/...
489 views

### What are the advantages of using Secp256k1?

Bitcoin uses secp256k1 as the specification for it's address system (https://en.bitcoin.it/wiki/Secp256k1). What are the advantages (and disadvantages) of using this over other specifications such as ...
159 views

### Would a transition to a different signature scheme be feasible?

The recent problem with Android's SecureRandom PRNG once again shows that using (EC)DSA can go horribly wrong if the signature nonce is ever reused. There is an elliptic curve signature scheme that ...
8k views

### Why the signature is always 65 (1+32+32) bytes long?

A signature created by the Bitcoin-Qt client can always be decoded (base64) to a 65-byte array. This array seems (according to https://github.com/bitcoin/bitcoin/blob/master/src/key.cpp#L217) to ...
2k views

### How vulnerable is bitcoin to quantum algorithms? [duplicate]

Assuming that quantum computers are implemented some time in the near-ish future, how vulnerable is Bitcoin to decryption via quantum algorithms? For example, Shor's algorithm enables a quantum ...
2k views

### If SHA256 and/or RIPEMD-160 were broken, would all bitcoin addresses be compromised?

If not, what else would be needed to steal all funds from all people and completely break bitcoin? I bet some will say ECSDA gives bitcoin an additional layer of protection. I counter this by saying ...
119 views

### Is the generator G of the keypair always the same number for all different tx messages in Bitcoin?

If so, what is that number and why can't you divide the public key by G to obtain the private key?
730 views

### How much time it takes to verify a Bitcoin signature in the Satoshi client?

Assuming: An average modern computer Using a single thread, as the current Satoshi client does Using the OpenSSL library, as the Satoshi Bitcoin client does The signature is not in the signature ...
680 views

### ECDSA transaction signing on a smartcard?

I know that the underlying digitial signing method Bitcoin uses for transactions is ECDSA (sep256k1 if memory serves). I've also read a few papers about performing ECDSA signing on certain kinds of ...
12k views

### For a non-technical person, how do I generate a ECDSA key pair easily?

I want to know because I would like to generate a vanity address at Vanity Pool.
593 views

### Storage of Private Keys

Most web apps that accept bitcoin (whether it's an exchange, a gambling site, etc) provide the user with a public address for depositing bitcoins into their account. How are these web applications ...
2k views

### Which programming languages support secp256k1?

Which programming languages have some ready libraries that support Bitcoin's ECDSA curve - secp256k1?
3k views

### Transaction signature generation

When one sets up a transaction, the input of the transaction needs to have a script with a signature to show that you can spend those coins. Which fields of the previous and current transactions need ...