Skip to main content
79 votes
Accepted

If someone wanted to pretend to be Satoshi by posting a fake signature to defraud people how could they?

Unfortunately, given the public's limited of understanding of cryptography this is apparently an easy fraud to pull off. The key trick is that non-technical people are prone to believe things that ...
G. Maxwell's user avatar
  • 7,727
33 votes
Accepted

What are the potential attacks against ECDSA that would be possible if we used raw public keys as addresses?

The theory It is assumed that in order to forge an ECDSA signature you need to compute the private key for a given public key first (this operation is known as the "discrete logarithm" (DL), ...
Pieter Wuille's user avatar
26 votes
Accepted

How do you derive the private key from two signatures that share the same k value?

ECDSA signatures are pairs (r,s) where r=(kG).x mod n, and s = (m + rx)/k mod n, where x is the secret key, k is the random nonce, and m is the message. If you have two s values s1 and s2 for the same ...
Pieter Wuille's user avatar
23 votes
Accepted

What are the advantages of Schnorr vs ECDSA?

Your question seems to assume that the only goal is minimizing on-chain transaction size. Reducing size and related costs is certainly something that can be improved upon, but it's far from the only ...
Pieter Wuille's user avatar
20 votes
Accepted

Are Schnorr signatures quantum-computer resistant?

No, ECDSA and EC-Schnorr, as well as related schemes like EdDSA, all belong to the class of elliptic curve cryptography. Their security is based on the assumption that the EC discrete logarithm is ...
Pieter Wuille's user avatar
17 votes
Accepted

What is the origin of insecure 64-bit nonces in signatures in the Bitcoin chain?

Based on the time-frame and my impression of the capabilities of the various groups developing wallet software during that period my initial guess was that the Bitpay copay software might be the ...
G. Maxwell's user avatar
  • 7,727
14 votes
Accepted

What is the maximum size of a DER encoded ECDSA signature?

A signature in Bitcoin (as used to sign transactions inside scriptSigs and scriptWitnesses), consists of a DER encoding of an ECDSA signature, plus a sighash type byte. Overall, this means they ...
Pieter Wuille's user avatar
14 votes
Accepted

What is the reasoning behind the choice of 2^256-2^32-977 for the prime on the secp256k1 curve?

Secp256k1 was designed to be a 256-bit size elliptic curve without cofactor and admitting an efficient endomorphism for optimization purposes. The choices of the relevant parameters are derived from ...
G. Maxwell's user avatar
  • 7,727
13 votes
Accepted

Why was ECDSA chosen over Schnorr Signatures in the inital design?

Why was ECDSA chosen over Schnorr Signatures in the inital design? You'll need to ask Satoshi to know for sure, but my guess is simply because ECDSA was well standardized at the time, while no ...
Pieter Wuille's user avatar
13 votes
Accepted

Will Schnorr Multi-signatures completely replace ECDSA?

Schnorr signatures will not replace ECDSA. Schnorr signature verification is expected to be implemented with the Taproot soft-fork using SegWit witness version 1. This means only outputs that are ...
Ugam Kamat's user avatar
  • 7,408
11 votes
Accepted

What is is minimum possible number for an ECDSA private key?

The all-zero bitstring doesn't have a corresponding public key per the standard (according to "Are all possible EC private keys valid?" on Crypto.SE), so it's 000…001.
Murch's user avatar
  • 75.4k
10 votes
Accepted

Replacing ECDSA (SECP256k1) with Schnorr signatures

Schnorr will replace ECDSA, the signing algorithm, but both still use the same elliptic curve and thus the same public and private keys, etc. Regardless, compatibility with ECDSA must be kept too ...
meshcollider's user avatar
  • 11.8k
8 votes

How do I convert Public Key x value to y in Python and verify?

First, you need to understand what the two formats actually are. The first is the compressed SEC format and the second is the uncompressed SEC format. The difference between the two is that the ...
Jimmy Song's user avatar
  • 7,759
8 votes

What is is minimum possible number for an ECDSA private key?

One is the minimum number. [This space intentionally left unblank.]
G. Maxwell's user avatar
  • 7,727
7 votes
Accepted

How to sign raw transaction given a private key and SHA hash (in java)

This answer does not attempt to sign a transaction, but simply focuses on successfully calling the sign method of the ECKey class, i.e. making your code work. I am not yet familiar with the ...
Sven Williamson's user avatar
7 votes
Accepted

How many bitcoin transactions can be verified per second on commodity hardware in 2020?

As others have pointed out, this largely depends on what kind of transaction you're verifying. More inputs and more signatures means longer verification, and for pre-SegWit inputs the computational ...
Vojtěch Strnad's user avatar
6 votes

ECDSA: (v, r, s), what is v?

As all the other answers already outline: v is required to recover the correct public key for a signature because there are sometimes (even with low probability) more than one valid public key to be ...
q9f's user avatar
  • 1,445
6 votes

How were the secp256k1 base point coordinates decided?

Since the secp256k1 curve order is prime, every point on the curve except the point at infinity is a generator. Nothing is known about how the designers of the curve chose this specific generator. ...
Pieter Wuille's user avatar
6 votes
Accepted

how do you figure out the r and s out of a signature using python

The structure of a DER encoded ECDSA signature is as follows: 30 identifies a SEQUENCE in ASN1 encoding, which is followed by the length of z (the sequence). r and scan be either 32 or 33 bytes long, ...
sr_gi's user avatar
  • 3,220
6 votes

Recovering ECDSA public key from the signature

when looking at a signed (P2PKH) tx, the signature looks like this: ...
pebwindkraft's user avatar
  • 5,086
6 votes
Accepted

How are compressed PubKeys generated?

There is no algorithm for generating compressed pubkeys from private keys keys specifically. In fact, all internal calculations involving points are done using the both the x and y coordinates of the ...
arubi's user avatar
  • 1,864
6 votes
Accepted

How to determine first byte (recovery ID) for signatures (message signing)?

FWIW this is what I have found regarding this question. Basically there are two ways of finding what libraries call "recid" or recovery ID. Most of them use the first method but there is ...
Coding Enthusiast's user avatar
6 votes

tiny-secp256k1 and ECDSA signing determinism

The secp256k1 library uses RFC6979 to generate deterministic nonce values (k). It essentially takes the hash of both the private key and the message being signed in order to get k. This means that ...
Ava Chow's user avatar
  • 70.5k
6 votes
Accepted

Elliptic Curve Point at Infinity

What exactly is the "point at infinity"? It's a point that is added to the points on the curve. Together they form a group. It has the following properties: (x,y) + (x,-y) = infinity (x,y) + ...
Pieter Wuille's user avatar
6 votes

Openssl magic values? Secp256k1 and ECDSA similarities? What makes secp256k1 special?

You are using the eliptic curve function of openssl and providing a serialized bytestring as an input. DER (Distinguished Encoding Rules) is a restricted variant of BER for producing unequivocal ...
Dontpanicburns's user avatar
6 votes
Accepted

What previously existing technologies made Bitcoin possible?

Arvind Narayanan and Jeremy Clark wrote an excellent paper about that: Bitcoin's Academic Pedigree. I recommend reading the paper in full, but the following briefly summarizes the paper's content. ...
Murch's user avatar
  • 75.4k
5 votes
Accepted

online tool to play around with ECDSA public keys, message signature verification?

Here are a few I'd recommend: https://bitcore.io/playground/#/address (private key - public key) https://brainwalletx.github.io/#generator (signing and verifying but bitcoin specific) Or play with ...
Justin O'Brien's user avatar
5 votes

Sign a tx with "low s" value using OpenSSL

Alternatively, you could use libsecp256k1. This is the code used by Bitcoin Core for signing, and will automatically create low-S signatures (disclaimer: I'm the main author of that library). Perhaps ...
Pieter Wuille's user avatar
5 votes
Accepted

Does MuSig have the same security as 2-2 multisig?

Yes or no, depending on your definition. You are right that the expected time to forge a 2-of-2 multisignature is twice that of a single signature, because you obviously need to use your forger ...
Pieter Wuille's user avatar
5 votes

Difference between Sign Message and Sign Transaction

Is the difference that for "Sign Message", first a digest is created, which is then signed, while for "Sign Transaction" (in the meaning written above), the input is already a digest, so it shouldn't ...
Ava Chow's user avatar
  • 70.5k

Only top scored, non community-wiki answers of a minimum length are eligible