# Questions tagged [ecdsa]

The Elliptic Curve Digital Signature Algorithm

31 questions
Filter by
Sorted by
Tagged with
5k views

### How does the ECDSA verification algorithm work during transaction?

I understand the basic concept ECDSA where if Bob wants to sign a message it generates a random number n, multiply it with the secp256k1, r = the x value , s = (H(x)dr)*n^-1 mod q. Also the ...
11k views

### Why the signature is always 65 (1+32+32) bytes long?

A signature created by the Bitcoin-Qt client can always be decoded (base64) to a 65-byte array. This array seems (according to https://github.com/bitcoin/bitcoin/blob/master/src/key.cpp#L217) to ...
4k views

### How are compressed PubKeys generated?

Just read this: https://bitcoin.stackexchange.com/a/1715/ What is the process to generate compressed pub keys via ECDSA?
39k views

### How do you get a Bitcoin Public Key from a Private Key

How do I, in extreme specificity, convert a given private bitcoin key into a public bitcoin key (Talk to me like I'm 5 and I have to do this step by step or the evil witch will cook me alive in her ...
12k views

### Recovering private key when someone uses the same k twice in ECDSA signatures

In this blog: http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html the author showed a case that using same k twice will leak private key. Many people know this method. But I ...
16k views

### ECDSA Signature and the “z” value

The following link contains details on how to reverse the ECDSA signature if given two identical "R" values. http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html I have read ...
15k views

### ECDSA: (v, r, s), what is v?

Deterministically signing a Tx with RFC6979 returns v, r, s, where r and s are the 2 values used in standard ECDSA signatures. v = 27 + (y % 2), so 27 + the parity of r, as pybitcointools indicates. ...
4k views

### How do you derive the private key from two signatures that share the same k value?

I wrote my own ECDSA signature algorithm just for the purpose of creating unit tests. With it I created two signatures which went into transaction 56ec7ca7df..., sending from 1GXFXm3es.... These ...
13k views

### ECDSA r, s encoding as a signature

An ECDSA algorithm when signing a given messages produces a pair of outputs, r and s. How, given a sigStr from a Tx can one extract r and s? Are they just concatenated byte arrays of a specific length,...
3k views

### If SHA256 and/or RIPEMD-160 were broken, would all bitcoin addresses be compromised?

If not, what else would be needed to steal all funds from all people and completely break bitcoin? I bet some will say ECSDA gives bitcoin an additional layer of protection. I counter this by saying ...
5k views

### how do you figure out the r and s out of a signature using python [closed]

ECDSA r, s encoding as a signature this link doesnt seem to add up, any suggestions?
12k views

### If someone wanted to pretend to be Satoshi by posting a fake signature to defraud people how could they?

If a random fraudster wanted to post a bunch of mysterious ECDSA signatures that the public would believe came from Bitcoin's creator, in order to disrupt the Bitcoin market, extract money from people,...
2k views

### How do you derive the lambda and beta values for endomorphism on the secp256k1 curve?

You can see a little background about this on this bitcointalk post by the late Hal Finney. Beta and lambda are the values on the secp256k1 curve where: Ī»^3 (mod N) = 1 Ī²^3 (mod P) = 1 As seen ...
5k views

### Signing a raw transaction with Python ECDSA (or OpenSSL)

I'm looking for specifics of Step15-17 from Redeeming a raw Tx Step By Step, which is essentially the step where the concatenated raw Tx structure is double sha256 hashed, and then signed with an ...
4k views

### How to sign raw transaction given a private key and SHA hash (in java)

I have followed the instructions here to build my own bitcoin transaction. Redeeming a raw transaction step by step example required Currently my code can create a transaction and compute the SHA ...
2k views

From previous questions this bitcoin 1FYMZEHnszCHKTBdFZ2DLrUuk3dGwYKQxh address had an invalid public key of "00" and was unspendable but the coins are now spent?? The invalid key was generated by a ...
4k views

### PEM format for ECDSA

I have been looking at Coinapult's API documentation which details the use of PEM format in python-ecdsa. Specifically, private keys and public keys need to be formatted using PEM. Let's take ...
1k views

### What are the potential attacks against ECDSA that would be possible if we used raw public keys as addresses?

According to this answer about why addresses are hashes rather than public keys there are potential attacks that are possible if you have the public key rather than the address, what are these attacks?...
861 views

### How do you invert an ECDSA multiplication to get the generator?

Pieter Wuille said: [...](people often assume that no inverse for EC multiplication exists, which is true, but only to solve for k in k*P = Q; solving for P is possible). When you multiply a ...
4k views

### Public key from private key generation problem

I met some problems, when I was trying to write function able to create Bitcoin public key from private key. I was using the tutorial: http://procbits.com/2013/08/27/generating-a-bitcoin-address-with-...
1k views

### converting RUBY script into PYTHON ( Recovering private key when someone uses the same k twice )

require 'ecdsa' public_key_hex = '02a50eb66887d03fe186b608f477d99bc7631c56e64bb3af7dc97e71b917c5b364' msghash1_hex = '01b125d18422cdfa7b153f5bcf5b01927cf59791d1d9810009c70cd37b14f4e6' msghash2_hex = '...
4k views

### Transaction signature generation

When one sets up a transaction, the input of the transaction needs to have a script with a signature to show that you can spend those coins. Which fields of the previous and current transactions need ...
1k views

### Are Schnorr signatures quantum-computer resistant?

Here (https://bitcoincore.org/en/2017/03/23/schnorr-signature-aggregation/) it says Schnorr replaces ECDSA, we know that ECDSA can be broken by quantum computers. Is Schnorr safe from q-computers?
826 views

### How much time it takes to verify a Bitcoin signature in the Satoshi client?

Assuming: An average modern computer Using a single thread, as the current Satoshi client does Using the OpenSSL library, as the Satoshi Bitcoin client does The signature is not in the signature ...
1k views

### How can I fix this: (Non-canonical signature: S value is unnecessarily high)

I've written a small script that will create a bitcoin transaction from scratch, using an ECDSA library. It works, but sometimes I get this error: 64: non-mandatory-script-verify-flag (Non-canonical ...
447 views

### In ScriptSig, which form of the public key is considered canonical?

In the standard pay-to-pubKeyHash scriptSig, which form of the public key should be used. My understanding is that both the compressed (33 bytes) and the expanded (64 bytes) are both valid. Is there ...
2k views

### ECDSA x,y coordinate validity verification doesn't seem to work

The ECDSA algorithm, secp256k1 for Bitcoin allegedly uses the equation y ^ 2 = x ^ 3 + 7 mod P to determine the validity of an alleged point upon the elliptical curve. Utilizing http://web2.0calc....
998 views

### How to verify ECDSA of a sample litecoin tx using pycoin?

I'm using the litecoin testnet network for testing. I have a UTXO at 053baee857adfdc16959e9dbc9618e0e935f0a1e51e226e651fcd67242f1f462 with a vout of 0. I make a raw transaction sending the coins to ...
2k views

### How to get the Z value aka Hash of the outputs to be signed

I get it that the "OP_CHECKSIG" does this, but I can't see how to recreate it. I tried SHA1 and SHA256 of some of the info in a given bitcoin transaction but it didn't give me confirmed values of Z. ...