# Questions tagged [ecdsa]

The Elliptic Curve Digital Signature Algorithm

137 questions
11k views

### If someone wanted to pretend to be Satoshi by posting a fake signature to defraud people how could they?

If a random fraudster wanted to post a bunch of mysterious ECDSA signatures that the public would believe came from Bitcoin's creator, in order to disrupt the Bitcoin market, extract money from people,...
32k views

### How do you get a Bitcoin Public Key from a Private Key

How do I, in extreme specificity, convert a given private bitcoin key into a public bitcoin key (Talk to me like I'm 5 and I have to do this step by step or the evil witch will cook me alive in her ...
11k views

### ECDSA: (v, r, s), what is v?

Deterministically signing a Tx with RFC6979 returns v, r, s, where r and s are the 2 values used in standard ECDSA signatures. v = 27 + (y % 2), so 27 + the parity of r, as pybitcointools indicates. ...
9k views

### Why the signature is always 65 (1+32+32) bytes long?

A signature created by the Bitcoin-Qt client can always be decoded (base64) to a 65-byte array. This array seems (according to https://github.com/bitcoin/bitcoin/blob/master/src/key.cpp#L217) to ...
11k views

### ECDSA r, s encoding as a signature

An ECDSA algorithm when signing a given messages produces a pair of outputs, r and s. How, given a sigStr from a Tx can one extract r and s? Are they just concatenated byte arrays of a specific length,...
3k views

### How do you derive the private key from two signatures that share the same k value?

I wrote my own ECDSA signature algorithm just for the purpose of creating unit tests. With it I created two signatures which went into transaction 56ec7ca7df..., sending from 1GXFXm3es.... These ...
2k views

### What is the origin of insecure 64-bit nonces in signatures in the Bitcoin chain?

In Biased Nonce Sense: Lattice Attacks against Weak ECDSA Signatures in Cryptocurrencies Joachim Breitner and Nadia Heninger use a lattice based algorithm to recover private keys from signatures in ...
2k views

### Why use DER encoding for signatures?

A signature in secp256k1 is two 32 byte numbers. DER encoding a signature adds about 6-7 bytes. It also needlessly complicates things (is DER encoding used anywhere else?). In a transaction format ...
9k views

### Recovering private key when someone uses the same k twice in ECDSA signatures

In this blog: http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html the author showed a case that using same k twice will leak private key. Many people know this method. But I ...
417 views

### Why was the Oct 2015 Transaction Malleability event possible in spite of BIP62/66?

The recent re-emergence of transaction malleability has been responsible for a large number of Txs which are being double spent (October 2015). /r/Bitcoin has posted some C++ code which @amaclin has ...
2k views

### How vulnerable is bitcoin to quantum algorithms? [duplicate]

Assuming that quantum computers are implemented some time in the near-ish future, how vulnerable is Bitcoin to decryption via quantum algorithms? For example, Shor's algorithm enables a quantum ...
10k views

### ECDSA Signature and the “z” value

The following link contains details on how to reverse the ECDSA signature if given two identical "R" values. http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html I have read ...
2k views

### Which programming languages support secp256k1?

Which programming languages have some ready libraries that support Bitcoin's ECDSA curve - secp256k1?
1k views

### Is libsecp256k1 faster than OpenSSL?

Bitcoin Core is eventually going to replace OpenSSL with libsecp256k1 for all ECDSA operations. As I understand it, this is motivated by wanting consensus-critical rules to not depend on OpenSSL. Is ...
4k views

### What's the rationale of using ECDSA instead of RSA?

One major drawback of (EC)DSA is that it requires a good RNG, otherwise the private key may be accidentally exposed. This is also one of the major reasons (I found so far) why no(?) smartcard supports ...
2k views

### Problems with deterministic ECDSA based on RFC6979 in Bitcoin

Generating random number k in elliptic curve is crucial and in any transactions signature in Bitcoin, random number k is required to compute a point k*G. If this k is chosen not randomly, it instantly ...
4k views

### Transaction signature generation

When one sets up a transaction, the input of the transaction needs to have a script with a signature to show that you can spend those coins. Which fields of the previous and current transactions need ...
12k views

### For a non-technical person, how do I generate a ECDSA key pair easily?

I want to know because I would like to generate a vanity address at Vanity Pool.
4k views

### How does the ECDSA verification algorithm work during transaction?

I understand the basic concept ECDSA where if Bob wants to sign a message it generates a random number n, multiply it with the secp256k1, r = the x value , s = (H(x)dr)*n^-1 mod q. Also the ...
2k views

### If SHA256 and/or RIPEMD-160 were broken, would all bitcoin addresses be compromised?

If not, what else would be needed to steal all funds from all people and completely break bitcoin? I bet some will say ECSDA gives bitcoin an additional layer of protection. I counter this by saying ...
414 views

### Is normal ECDSA verification slower than a verification method based on Public Key Recovery?

Background info: This post on the Cryptography stack exchange shows how to almost uniquely recover the public key from the signature, hash of the signed data, and knowledge of the curve: https://...
1k views

### How do you derive the lambda and beta values for endomorphism on the secp256k1 curve?

You can see a little background about this on this bitcointalk post by the late Hal Finney. Beta and lambda are the values on the secp256k1 curve where: λ^3 (mod N) = 1 β^3 (mod P) = 1 As seen ...
212 views

### Why isn't Bitcoin using public key extraction from signature to reduce the blockchain size?

Why doesn't Bitcoin use public key recovering from the signature in order to reduce the Blockchain size? This would save 32 bytes per transaction input.
4k views

### How to generate a public key from a private key using Elliptic Curve Digital Signature Algorithm

I'm trying to understand the graphical basis that underlies the discreet logarithmic Elliptic Curve Digital Signature Algorithm (ECDSA) introduced in Chapter 4 of "Mastering Bitcoin" by Andreas ...
805 views

### What is is minimum possible number for an ECDSA private key?

Private keys are 256 bit numbers. I know the max. possible number is something around: 115792089237316195423570985008687907852837564279074904382605163141518161494336 What about the min. number ...
907 views

### Are Schnorr signatures quantum-computer resistant?

Here (https://bitcoincore.org/en/2017/03/23/schnorr-signature-aggregation/) it says Schnorr replaces ECDSA, we know that ECDSA can be broken by quantum computers. Can Schnorr be broken by q-computers ...
612 views

### The complement of s (when s < curve order / 2)

Bitcoinlib refers to the requirement that if s > ORDER / 2, then the complement of s should be used instead since it's one byte shorter This sounds like it's referring to the inverse or negative s ...
595 views

### How do you invert an ECDSA multiplication to get the generator?

Pieter Wuille said: [...](people often assume that no inverse for EC multiplication exists, which is true, but only to solve for k in k*P = Q; solving for P is possible). When you multiply a ...
3k views

### How to sign raw transaction given a private key and SHA hash (in java)

I have followed the instructions here to build my own bitcoin transaction. Redeeming a raw transaction step by step example required Currently my code can create a transaction and compute the SHA ...
106 views

### Does MuSig have the same security as 2-2 multisig?

Disclaimer: This question is of theoretical importance to me trying to educate myself better on cryptographic principles and signature schemes. I don't intend to imply that in practice schnorr ...
719 views

### How were the secp256k1 base point coordinates decided?

79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798,483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8 seems very random to me. I see how this point is on the curve, but how ...
397 views

### Bitcoin safe if ECDSA is broken?

I've read that one reason to use a new address for each transaction is because it hides the pubkey behind a hash, so that even if ECDSA is broken and someone is able to derive my privkey from my ...
788 views

### How can someone verify the signature of a Bitcoin ECDSA signature without knowing the signer's public key?

I understand how ECDSA exactly works and for verification of a signature, the public key of the signer is required. But in Bitcoin, public key is double hashed and the only information the receiver ...
2k views

### Bitcoin private key, location on ECC curve

In the ECDSA algorithm, the Bitcoin private key is supposedly a point on the graph (or is it?). But the private key is a single integer, and not x,y coordinates. Is the integer, by itself, the x ...
842 views

### Replacing ECDSA (SECP256k1) with Schnorr signatures

On March 23, 2017 the Bitcoin Core team published a technology roadmap, expressing their intent to replace ECDSA (SECP256k1) with Schnorr signatures: https://bitcoincore.org/en/2017/03/23/schnorr-...
772 views

### How much time it takes to verify a Bitcoin signature in the Satoshi client?

Assuming: An average modern computer Using a single thread, as the current Satoshi client does Using the OpenSSL library, as the Satoshi Bitcoin client does The signature is not in the signature ...
2k views

### How are compressed PubKeys generated?

Just read this: https://bitcoin.stackexchange.com/a/1715/ What is the process to generate compressed pub keys via ECDSA?
564 views

### What are the advantages of using Secp256k1?

Bitcoin uses secp256k1 as the specification for it's address system (https://en.bitcoin.it/wiki/Secp256k1). What are the advantages (and disadvantages) of using this over other specifications such as ...
4k views

### Signing a raw transaction with Python ECDSA (or OpenSSL)

I'm looking for specifics of Step15-17 from Redeeming a raw Tx Step By Step, which is essentially the step where the concatenated raw Tx structure is double sha256 hashed, and then signed with an ...
1k views

### OpenSSL and Secp256k1 differing in implementation of ECDSA signatures?

OpenSSL (from ssl in Mac OS X Version 10.11.6) and Secp256k1 (from the bitcoin-core repository) seem to differ in their implementations of ECDSA. I'm having issues with these differences and want to ...
608 views

### Storage of Private Keys

Most web apps that accept bitcoin (whether it's an exchange, a gambling site, etc) provide the user with a public address for depositing bitcoins into their account. How are these web applications ...
702 views

### ECDSA transaction signing on a smartcard?

I know that the underlying digitial signing method Bitcoin uses for transactions is ECDSA (sep256k1 if memory serves). I've also read a few papers about performing ECDSA signing on certain kinds of ...
46 views

### Low-s value in bitcoin signature

What are the problems related in using the "normal" ( bigger than N/2) value of the s number in transaction signature and why we use the lower one? Is it about the math behind the ecdsa?
674 views

### Bitcoin how to get X value from Y

How to get X value from Y? ECDSA x,y coordinate validity verification doesn't seem to work X = 0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798 Python code, p = ...
307 views

### bitcoin two identical R

605 views

From previous questions this bitcoin 1FYMZEHnszCHKTBdFZ2DLrUuk3dGwYKQxh address had an invalid public key of "00" and was unspendable but the coins are now spent?? The invalid key was generated by a ...
854 views

### The shortest ECDSA signature

I want to create ECDSA signature {r,s} where r is very low (for example 1) and can be encoded in DER-format in one byte. How to calculate k value? Seems to me that it does not depend of anything. ...
865 views

### What is the reasoning behind the choice of 2^256-2^32-977 for the prime on the secp256k1 curve?

In Bitcoin's elliptic curve (secp256k1), the prime p = 2^256 - 2^32 - 2^9 -2^8 - 2^7 - 2^6 - 2^4 - 1 the generator point Gx = 0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798 ...