78
votes
Accepted
If someone wanted to pretend to be Satoshi by posting a fake signature to defraud people how could they?
Unfortunately, given the public's limited of understanding of cryptography this is apparently an easy fraud to pull off.
The key trick is that non-technical people are prone to believe things that ...
- 7,676
54
votes
Accepted
ECDSA: (v, r, s), what is v?
This has nothing to do with RFC6979, but with ECDSA signing and public key recovery.
The (r, s) is the normal output of an ECDSA signature, where r is computed as the X coordinate of a point R, ...
- 99.3k
33
votes
Accepted
What are the potential attacks against ECDSA that would be possible if we used raw public keys as addresses?
The theory
It is assumed that in order to forge an ECDSA signature you need to compute the private key for a given public key first (this operation is known as the "discrete logarithm" (DL), ...
- 99.3k
26
votes
Accepted
How do you derive the private key from two signatures that share the same k value?
ECDSA signatures are pairs (r,s) where r=(kG).x mod n, and s = (m + rx)/k mod n, where x is the secret key, k is the random nonce, and m is the message.
If you have two s values s1 and s2 for the same ...
- 99.3k
23
votes
Accepted
What are the advantages of Schnorr vs ECDSA?
Your question seems to assume that the only goal is minimizing on-chain transaction size. Reducing size and related costs is certainly something that can be improved upon, but it's far from the only ...
- 99.3k
20
votes
Accepted
Are Schnorr signatures quantum-computer resistant?
No, ECDSA and EC-Schnorr, as well as related schemes like EdDSA, all belong to the class of elliptic curve cryptography. Their security is based on the assumption that the EC discrete logarithm is ...
- 99.3k
17
votes
Accepted
What is the origin of insecure 64-bit nonces in signatures in the Bitcoin chain?
Based on the time-frame and my impression of the capabilities of the various groups developing wallet software during that period my initial guess was that the Bitpay copay software might be the ...
- 7,676
14
votes
Accepted
What is the maximum size of a DER encoded ECDSA signature?
A signature in Bitcoin (as used to sign transactions inside scriptSigs and scriptWitnesses), consists of a DER encoding of an ECDSA signature, plus a sighash type byte.
Overall, this means they ...
- 99.3k
13
votes
Accepted
What is the reasoning behind the choice of 2^256-2^32-977 for the prime on the secp256k1 curve?
Secp256k1 was designed to be a 256-bit size elliptic curve without cofactor and admitting an efficient endomorphism for optimization purposes. The choices of the relevant parameters are derived from ...
- 7,676
13
votes
Accepted
Will Schnorr Multi-signatures completely replace ECDSA?
Schnorr signatures will not replace ECDSA. Schnorr signature verification is expected to be implemented with the Taproot soft-fork using SegWit witness version 1. This means only outputs that are ...
- 7,308
11
votes
Accepted
Why was ECDSA chosen over Schnorr Signatures in the inital design?
Why was ECDSA chosen over Schnorr Signatures in the inital design?
You'll need to ask Satoshi to know for sure, but my guess is simply because ECDSA was well standardized at the time, while no ...
- 99.3k
11
votes
Accepted
What is is minimum possible number for an ECDSA private key?
The all-zero bitstring doesn't have a corresponding public key per the standard (according to "Are all possible EC private keys valid?" on Crypto.SE), so it's 000…001.
- 71.7k
10
votes
Accepted
Replacing ECDSA (SECP256k1) with Schnorr signatures
Schnorr will replace ECDSA, the signing algorithm, but both still use the same elliptic curve and thus the same public and private keys, etc.
Regardless, compatibility with ECDSA must be kept too ...
- 11.7k
9
votes
Accepted
Why was the Oct 2015 Transaction Malleability event possible in spite of BIP62/66?
Canonical DER signature implemented in BIP 66 fixes issue #1 of BIP 62 ( Non-DER encoded ECDSA signatures )
Amacilin's code exploits issue #5 in BIP 62 ( Inherent ECSDA signature malleability ), ...
- 2,072
8
votes
How do I convert Public Key x value to y in Python and verify?
First, you need to understand what the two formats actually are. The first is the compressed SEC format and the second is the uncompressed SEC format. The difference between the two is that the ...
- 7,729
8
votes
What is is minimum possible number for an ECDSA private key?
One is the minimum number. [This space intentionally left unblank.]
- 7,676
7
votes
Accepted
How to sign raw transaction given a private key and SHA hash (in java)
This answer does not attempt to sign a transaction, but simply focuses on successfully calling the sign method of the ECKey class, i.e. making your code work. I am not yet familiar with the ...
- 1,524
7
votes
Accepted
How many bitcoin transactions can be verified per second on commodity hardware in 2020?
As others have pointed out, this largely depends on what kind of transaction you're verifying. More inputs and more signatures means longer verification, and for pre-SegWit inputs the computational ...
- 5,840
6
votes
Accepted
PEM format for ECDSA
#0 what is the format? As you partly guessed, that is the "PEM" armoring of the DER encoding of the SubjectPublicKeyInfo ASN.1 type from X.509, republished for Internet use as RFC5280 ...
6
votes
Accepted
Are there any signatures where the recid (v) is equal to 29,30 (or 33,34 compressed)?
For random signatures, it is an extremely low probability event. Around 1 in 2128, so it will likely never ever actually happen.
However, you can easily construct a valid signature that has one of ...
- 99.3k
6
votes
ECDSA: (v, r, s), what is v?
As all the other answers already outline: v is required to recover the correct public key for a signature because there are sometimes (even with low probability) more than one valid public key to be ...
- 1,444
6
votes
How were the secp256k1 base point coordinates decided?
Since the secp256k1 curve order is prime, every point on the curve except the point at infinity is a generator.
Nothing is known about how the designers of the curve chose this specific generator.
...
- 99.3k
6
votes
Accepted
how do you figure out the r and s out of a signature using python
The structure of a DER encoded ECDSA signature is as follows:
30 identifies a SEQUENCE in ASN1 encoding, which is followed by the length of z (the sequence). r and scan be either 32 or 33 bytes long, ...
- 3,107
6
votes
Accepted
How are compressed PubKeys generated?
There is no algorithm for generating compressed pubkeys from private keys keys specifically. In fact, all internal calculations involving points are done using the both the x and y coordinates of the ...
- 1,844
6
votes
tiny-secp256k1 and ECDSA signing determinism
The secp256k1 library uses RFC6979 to generate deterministic nonce values (k). It essentially takes the hash of both the private key and the message being signed in order to get k. This means that ...
- 67.5k
6
votes
Accepted
Elliptic Curve Point at Infinity
What exactly is the "point at infinity"?
It's a point that is added to the points on the curve. Together they form a group. It has the following properties:
(x,y) + (x,-y) = infinity
(x,y) + ...
- 99.3k
6
votes
Openssl magic values? Secp256k1 and ECDSA similarities? What makes secp256k1 special?
You are using the eliptic curve function of openssl and providing a serialized bytestring as an input. DER (Distinguished Encoding Rules) is a restricted variant of BER for producing unequivocal ...
6
votes
Accepted
What previously existing technologies made Bitcoin possible?
Arvind Narayanan and Jeremy Clark wrote an excellent paper about that: Bitcoin's Academic Pedigree. I recommend reading the paper in full, but the following briefly summarizes the paper's content.
...
- 71.7k
5
votes
Sign a tx with "low s" value using OpenSSL
Alternatively, you could use libsecp256k1. This is the code used by Bitcoin Core for signing, and will automatically create low-S signatures (disclaimer: I'm the main author of that library).
Perhaps ...
- 99.3k
5
votes
Recovering ECDSA public key from the signature
when looking at a signed (P2PKH) tx, the signature looks like this:
...
- 5,086
Only top scored, non community-wiki answers of a minimum length are eligible