Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ecdsa]

The Elliptic Curve Digital Signature Algorithm

65
votes
1answer
10k views

If someone wanted to pretend to be Satoshi by posting a fake signature to defraud people how could they?

If a random fraudster wanted to post a bunch of mysterious ECDSA signatures that the public would believe came from Bitcoin's creator, in order to disrupt the Bitcoin market, extract money from people,...
33
votes
5answers
31k views

How do you get a Bitcoin Public Key from a Private Key

How do I, in extreme specificity, convert a given private bitcoin key into a public bitcoin key (Talk to me like I'm 5 and I have to do this step by step or the evil witch will cook me alive in her ...
19
votes
2answers
10k views

ECDSA: (v, r, s), what is v?

Deterministically signing a Tx with RFC6979 returns v, r, s, where r and s are the 2 values used in standard ECDSA signatures. v = 27 + (y % 2), so 27 + the parity of r, as pybitcointools indicates. ...
17
votes
1answer
8k views

Why the signature is always 65 (1+32+32) bytes long?

A signature created by the Bitcoin-Qt client can always be decoded (base64) to a 65-byte array. This array seems (according to https://github.com/bitcoin/bitcoin/blob/master/src/key.cpp#L217) to ...
15
votes
2answers
10k views

ECDSA r, s encoding as a signature

An ECDSA algorithm when signing a given messages produces a pair of outputs, r and s. How, given a sigStr from a Tx can one extract r and s? Are they just concatenated byte arrays of a specific length,...
13
votes
2answers
2k views

How do you derive the private key from two signatures that share the same k value?

I wrote my own ECDSA signature algorithm just for the purpose of creating unit tests. With it I created two signatures which went into transaction 56ec7ca7df..., sending from 1GXFXm3es.... These ...
13
votes
1answer
1k views

What is the origin of insecure 64-bit nonces in signatures in the Bitcoin chain?

In Biased Nonce Sense: Lattice Attacks against Weak ECDSA Signatures in Cryptocurrencies Joachim Breitner and Nadia Heninger use a lattice based algorithm to recover private keys from signatures in ...
12
votes
1answer
2k views

Why use DER encoding for signatures?

A signature in secp256k1 is two 32 byte numbers. DER encoding a signature adds about 6-7 bytes. It also needlessly complicates things (is DER encoding used anywhere else?). In a transaction format ...
11
votes
2answers
9k views

Recovering private key when someone uses the same k twice in ECDSA signatures

In this blog: http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html the author showed a case that using same k twice will leak private key. Many people know this method. But I ...
10
votes
2answers
2k views

How vulnerable is bitcoin to quantum algorithms? [duplicate]

Assuming that quantum computers are implemented some time in the near-ish future, how vulnerable is Bitcoin to decryption via quantum algorithms? For example, Shor's algorithm enables a quantum ...
9
votes
1answer
408 views

Why was the Oct 2015 Transaction Malleability event possible in spite of BIP62/66?

The recent re-emergence of transaction malleability has been responsible for a large number of Txs which are being double spent (October 2015). /r/Bitcoin has posted some C++ code which @amaclin has ...
8
votes
3answers
8k views

ECDSA Signature and the “z” value

The following link contains details on how to reverse the ECDSA signature if given two identical "R" values. http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html I have read ...
8
votes
4answers
2k views

Which programming languages support secp256k1?

Which programming languages have some ready libraries that support Bitcoin's ECDSA curve - secp256k1?
8
votes
1answer
1k views

Is libsecp256k1 faster than OpenSSL?

Bitcoin Core is eventually going to replace OpenSSL with libsecp256k1 for all ECDSA operations. As I understand it, this is motivated by wanting consensus-critical rules to not depend on OpenSSL. Is ...
8
votes
3answers
4k views

What's the rationale of using ECDSA instead of RSA?

One major drawback of (EC)DSA is that it requires a good RNG, otherwise the private key may be accidentally exposed. This is also one of the major reasons (I found so far) why no(?) smartcard supports ...
8
votes
1answer
2k views

Problems with deterministic ECDSA based on RFC6979 in Bitcoin

Generating random number k in elliptic curve is crucial and in any transactions signature in Bitcoin, random number k is required to compute a point k*G. If this k is chosen not randomly, it instantly ...
8
votes
2answers
3k views

Transaction signature generation

When one sets up a transaction, the input of the transaction needs to have a script with a signature to show that you can spend those coins. Which fields of the previous and current transactions need ...
7
votes
2answers
12k views

For a non-technical person, how do I generate a ECDSA key pair easily?

I want to know because I would like to generate a vanity address at Vanity Pool.
7
votes
2answers
4k views

How does the ECDSA verification algorithm work during transaction?

I understand the basic concept ECDSA where if Bob wants to sign a message it generates a random number n, multiply it with the secp256k1, r = the x value , s = (H(x)dr)*n^-1 mod q. Also the ...
7
votes
2answers
2k views

If SHA256 and/or RIPEMD-160 were broken, would all bitcoin addresses be compromised?

If not, what else would be needed to steal all funds from all people and completely break bitcoin? I bet some will say ECSDA gives bitcoin an additional layer of protection. I counter this by saying ...
6
votes
1answer
383 views

Is normal ECDSA verification slower than a verification method based on Public Key Recovery?

Background info: This post on the Cryptography stack exchange shows how to almost uniquely recover the public key from the signature, hash of the signed data, and knowledge of the curve: https://...
6
votes
3answers
1k views

How do you derive the lambda and beta values for endomorphism on the secp256k1 curve?

You can see a little background about this on this bitcointalk post by the late Hal Finney. Beta and lambda are the values on the secp256k1 curve where: λ^3 (mod N) = 1 β^3 (mod P) = 1 As seen ...
6
votes
1answer
204 views

Why isn't Bitcoin using public key extraction from signature to reduce the blockchain size?

Why doesn't Bitcoin use public key recovering from the signature in order to reduce the Blockchain size? This would save 32 bytes per transaction input.
5
votes
2answers
792 views

What is is minimum possible number for an ECDSA private key?

Private keys are 256 bit numbers. I know the max. possible number is something around: 115792089237316195423570985008687907852837564279074904382605163141518161494336 What about the min. number ...
5
votes
2answers
526 views

The complement of s (when s < curve order / 2)

Bitcoinlib refers to the requirement that if s > ORDER / 2, then the complement of s should be used instead since it's one byte shorter This sounds like it's referring to the inverse or negative s ...
5
votes
1answer
529 views

How do you invert an ECDSA multiplication to get the generator?

Pieter Wuille said: [...](people often assume that no inverse for EC multiplication exists, which is true, but only to solve for k in k*P = Q; solving for P is possible). When you multiply a ...
5
votes
1answer
3k views

How to sign raw transaction given a private key and SHA hash (in java)

I have followed the instructions here to build my own bitcoin transaction. Redeeming a raw transaction step by step example required Currently my code can create a transaction and compute the SHA ...
5
votes
1answer
381 views

Bitcoin safe if ECDSA is broken?

I've read that one reason to use a new address for each transaction is because it hides the pubkey behind a hash, so that even if ECDSA is broken and someone is able to derive my privkey from my ...
5
votes
3answers
4k views

How to generate a public key from a private key using Elliptic Curve Digital Signature Algorithm

I'm trying to understand the graphical basis that underlies the discreet logarithmic Elliptic Curve Digital Signature Algorithm (ECDSA) introduced in Chapter 4 of "Mastering Bitcoin" by Andreas ...
4
votes
2answers
761 views

How can someone verify the signature of a Bitcoin ECDSA signature without knowing the signer's public key?

I understand how ECDSA exactly works and for verification of a signature, the public key of the signer is required. But in Bitcoin, public key is double hashed and the only information the receiver ...
4
votes
2answers
2k views

Bitcoin private key, location on ECC curve

In the ECDSA algorithm, the Bitcoin private key is supposedly a point on the graph (or is it?). But the private key is a single integer, and not x,y coordinates. Is the integer, by itself, the x ...
4
votes
1answer
777 views

Replacing ECDSA (SECP256k1) with Schnorr signatures

On March 23, 2017 the Bitcoin Core team published a technology roadmap, expressing their intent to replace ECDSA (SECP256k1) with Schnorr signatures: https://bitcoincore.org/en/2017/03/23/schnorr-...
4
votes
2answers
747 views

How much time it takes to verify a Bitcoin signature in the Satoshi client?

Assuming: An average modern computer Using a single thread, as the current Satoshi client does Using the OpenSSL library, as the Satoshi Bitcoin client does The signature is not in the signature ...
4
votes
2answers
2k views

How are compressed PubKeys generated?

Just read this: https://bitcoin.stackexchange.com/a/1715/ What is the process to generate compressed pub keys via ECDSA?
4
votes
2answers
524 views

What are the advantages of using Secp256k1?

Bitcoin uses secp256k1 as the specification for it's address system (https://en.bitcoin.it/wiki/Secp256k1). What are the advantages (and disadvantages) of using this over other specifications such as ...
4
votes
1answer
4k views

Signing a raw transaction with Python ECDSA (or OpenSSL)

I'm looking for specifics of Step15-17 from Redeeming a raw Tx Step By Step, which is essentially the step where the concatenated raw Tx structure is double sha256 hashed, and then signed with an ...
4
votes
1answer
624 views

How were the secp256k1 base point coordinates decided?

79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798,483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8 seems very random to me. I see how this point is on the curve, but how ...
4
votes
1answer
1k views

OpenSSL and Secp256k1 differing in implementation of ECDSA signatures?

OpenSSL (from ssl in Mac OS X Version 10.11.6) and Secp256k1 (from the bitcoin-core repository) seem to differ in their implementations of ECDSA. I'm having issues with these differences and want to ...
4
votes
2answers
596 views

Storage of Private Keys

Most web apps that accept bitcoin (whether it's an exchange, a gambling site, etc) provide the user with a public address for depositing bitcoins into their account. How are these web applications ...
4
votes
1answer
38 views

Does MuSig have the same security as 2-2 multisig?

Disclaimer: This question is of theoretical importance to me trying to educate myself better on cryptographic principles and signature schemes. I don't intend to imply that in practice schnorr ...
4
votes
1answer
688 views

ECDSA transaction signing on a smartcard?

I know that the underlying digitial signing method Bitcoin uses for transactions is ECDSA (sep256k1 if memory serves). I've also read a few papers about performing ECDSA signing on certain kinds of ...
4
votes
2answers
606 views

Bitcoin how to get X value from Y

How to get X value from Y? ECDSA x,y coordinate validity verification doesn't seem to work X = 0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798 Python code, p = ...
4
votes
1answer
294 views

bitcoin two identical R

Blockchain transaction id 30440220d47ce4c025c35ec440bc81d99834a624875161a26bf56ef7fdc0f5d52f843ad1022044e1ff2dfd8102cf7a47c21d5c9fd5701610d04953c6836596b4fe9dd2f53e3e01 ...
4
votes
2answers
526 views

Invalid public key was spent! How was this possible?

From previous questions this bitcoin 1FYMZEHnszCHKTBdFZ2DLrUuk3dGwYKQxh address had an invalid public key of "00" and was unspendable but the coins are now spent?? The invalid key was generated by a ...
3
votes
2answers
766 views

The shortest ECDSA signature

I want to create ECDSA signature {r,s} where r is very low (for example 1) and can be encoded in DER-format in one byte. How to calculate k value? Seems to me that it does not depend of anything. ...
3
votes
1answer
3k views

Why do keys need both X and Y coordinates, if X can be solved for Y using the curve equation?

Reference: https://en.bitcoin.it/wiki/File:PubKeyToAddr.png and https://en.bitcoin.it/wiki/Secp256k1 Why do we need both X and Y to make a private key?
3
votes
1answer
1k views

How do I convert Public Key x value to y in Python and verify?

I have been using the BTC Address utility which enables me to type in something like: 020F031CA83F3FB372BD6C2430119E0B947CF059D19CDEA98F4CEFFEF620C584F9 Then clicking a button the program can spit ...
3
votes
1answer
798 views

Are Schnorr signatures quantum-computer resistant?

Here (https://bitcoincore.org/en/2017/03/23/schnorr-signature-aggregation/) it says Schnorr replaces ECDSA, we know that ECDSA can be broken by quantum computers. Can Schnorr be broken by q-computers ...
3
votes
1answer
35 views

ECDSA signature with r value of 31?

occasionally on Android we are generating an ECDSA signature. This turns out to have a "r" length of 31 bytes. Is that valid? For reference here is a nice diagram outlining the ASN.1 structure of ...
3
votes
1answer
158 views

In ECDSA, why is (r,−s mod n) complementary to (r, s)?

I am trying to find resources in previous malleability posts, but couldn't find derivations/proofs of this fact or how the exact low-s value is derived. Any pointers would greatly appreciated.