Hot answers tagged

77 votes
Accepted

If someone wanted to pretend to be Satoshi by posting a fake signature to defraud people how could they?

Unfortunately, given the public's limited of understanding of cryptography this is apparently an easy fraud to pull off. The key trick is that non-technical people are prone to believe things that ...
user avatar
  • 7,479
47 votes
Accepted

ECDSA: (v, r, s), what is v?

This has nothing to do with RFC6979, but with ECDSA signing and public key recovery. The (r, s) is the normal output of an ECDSA signature, where r is computed as the X coordinate of a point R, ...
user avatar
45 votes

How do you get a Bitcoin Public Key from a Private Key

I'll try answering this again in a different way, using small numbers to keep it readable. convert the private key to binary representation, so decimal number 105, which is 0x69 in hex, becomes ...
user avatar
33 votes
Accepted

What are the potential attacks against ECDSA that would be possible if we used raw public keys as addresses?

The theory It is assumed that in order to forge an ECDSA signature you need to compute the private key for a given public key first (this operation is known as the "discrete logarithm" (DL), ...
user avatar
26 votes
Accepted

How do you derive the private key from two signatures that share the same k value?

ECDSA signatures are pairs (r,s) where r=(kG).x mod n, and s = (m + rx)/k mod n, where x is the secret key, k is the random nonce, and m is the message. If you have two s values s1 and s2 for the same ...
user avatar
21 votes
Accepted

What are the advantages of Schnorr vs ECDSA?

Your question seems to assume that the only goal is minimizing on-chain transaction size. Reducing size and related costs is certainly something that can be improved upon, but it's far from the only ...
user avatar
19 votes
Accepted

Recovering private key when someone uses the same k twice in ECDSA signatures

Here is a fun thing about ECDSA signatures: you can always replace s with -s (mod N) and the signature is still valid. So when you are deducing the k value, it is possible that someone else flipped ...
user avatar
19 votes
Accepted

Are Schnorr signatures quantum-computer resistant?

No, ECDSA and EC-Schnorr, as well as related schemes like EdDSA, all belong to the class of elliptic curve cryptography. Their security is based on the assumption that the EC discrete logarithm is ...
user avatar
17 votes
Accepted

What is the origin of insecure 64-bit nonces in signatures in the Bitcoin chain?

Based on the time-frame and my impression of the capabilities of the various groups developing wallet software during that period my initial guess was that the Bitpay copay software might be the ...
user avatar
  • 7,479
14 votes
Accepted

How does the ECDSA verification algorithm work during transaction?

Let us take "pizza transaction" https://blockchain.info/tx/cca7507897abc89628f450e8b1e0c6fca4ec3f7b34cccf55f3f531c659ff4d79 ...
user avatar
  • 6,622
13 votes
Accepted

Will Schnorr Multi-signatures completely replace ECDSA?

Schnorr signatures will not replace ECDSA. Schnorr signature verification is expected to be implemented with the Taproot soft-fork using SegWit witness version 1. This means only outputs that are ...
user avatar
  • 6,908
12 votes
Accepted

Bitcoin private key, location on ECC curve

The basic elliptic curve operation is addition of points. The operation of applying this addition repeatedly is called the scalar multiplication of a point by an integer. The private key is the '...
user avatar
12 votes

ECDSA Signature and the "z" value

note: what Nils Schneider calls 'z', i call 'm'. this gist implements all this: https://gist.github.com/nlitsme/dda36eeef541de37d996 the calculation ecdsa signing is done as follows: given a message '...
user avatar
12 votes
Accepted

What is the maximum size of a DER encoded ECDSA signature?

A signature in Bitcoin (as used to sign transactions inside scriptSigs and scriptWitnesses), consists of a DER encoding of an ECDSA signature, plus a sighash type byte. Overall, this means they ...
user avatar
12 votes
Accepted

What is the reasoning behind the choice of 2^256-2^32-977 for the prime on the secp256k1 curve?

Secp256k1 was designed to be a 256-bit size elliptic curve without cofactor and admitting an efficient endomorphism for optimization purposes. The choices of the relevant parameters are derived from ...
user avatar
  • 7,479
11 votes
Accepted

What is is minimum possible number for an ECDSA private key?

The all-zero bitstring doesn't have a corresponding public key per the standard (according to "Are all possible EC private keys valid?" on Crypto.SE), so it's 000…001.
user avatar
  • 63.5k
10 votes
Accepted

Problems with deterministic ECDSA based on RFC6979 in Bitcoin

Not any serious efficiency concerns. Signing is done fairly infrequently for any particular client (only a few signatures per transaction usually). While possible that the signing might take slightly ...
user avatar
  • 13.7k
10 votes
Accepted

Is libsecp256k1 faster than OpenSSL?

Yes it's a lot faster. For example from one of the core developers: reddit - Pieter Wuille / 2015-02-19 18:13 Just did a benchmark on libsecp256k1's current master, without GMP, without hand-...
user avatar
  • 6,189
10 votes
Accepted

Replacing ECDSA (SECP256k1) with Schnorr signatures

Schnorr will replace ECDSA, the signing algorithm, but both still use the same elliptic curve and thus the same public and private keys, etc. Regardless, compatibility with ECDSA must be kept too ...
user avatar
  • 11.3k
9 votes
Accepted

Why was the Oct 2015 Transaction Malleability event possible in spite of BIP62/66?

Canonical DER signature implemented in BIP 66 fixes issue #1 of BIP 62 ( Non-DER encoded ECDSA signatures ) Amacilin's code exploits issue #5 in BIP 62 ( Inherent ECSDA signature malleability ), ...
user avatar
  • 2,052
8 votes
Accepted

How can someone verify the signature of a Bitcoin ECDSA signature without knowing the signer's public key?

Simple, the sender shows the pubkey when spending from whatever address the bitcoins are in. As part of the verification, the receiver (actually, every node in the network), can verify that the pubkey ...
user avatar
  • 7,639
8 votes

How do I convert Public Key x value to y in Python and verify?

First, you need to understand what the two formats actually are. The first is the compressed SEC format and the second is the uncompressed SEC format. The difference between the two is that the ...
user avatar
  • 7,639
8 votes

What is is minimum possible number for an ECDSA private key?

One is the minimum number. [This space intentionally left unblank.]
user avatar
  • 7,479
7 votes
Accepted

How do you invert an ECDSA multiplication to get the generator?

k is just a scalar, modulo the order of the elliptic curve group. Q = k*P thus: (1/k)*Q = (1/k)*k*P thus: (1/k)*Q = P You find P by multiplying Q with the multiplication inverse of k modulo the ...
user avatar
7 votes
Accepted

How to sign raw transaction given a private key and SHA hash (in java)

This answer does not attempt to sign a transaction, but simply focuses on successfully calling the sign method of the ECKey class, i.e. making your code work. I am not yet familiar with the ...
user avatar
6 votes
Accepted

Is normal ECDSA verification slower than a verification method based on Public Key Recovery?

Verification w/ Public key recovery is never going to be faster than normal verification however it is only marginally slower. I benchmarked it a while back and PubKey recovery added about 5% ...
user avatar
6 votes

ECDSA x,y coordinate validity verification doesn't seem to work

The plain text format of this equation only makes sense when you understand the theory behind it. y ^ 2 = x ^ 3 + 7 mod P means "do all math in this equation using the finite number field with ...
user avatar
6 votes

How do you get a Bitcoin Public Key from a Private Key

Here's a self-contained Python script that does the conversion. You can check its work by comparing to entering your private key as the "Secret Exponent" at Brainwallet. I took the script from this ...
user avatar
  • 4,347
6 votes
Accepted

Signing a raw transaction with Python ECDSA (or OpenSSL)

OK, I figured out how to sign the raw Tx using Python ecdsa. I'll step through it: Recall: createrawtransaction '[{"txid" : "72b764383b99fb3d112ac8b474a5d7c4242b75dbfee2d4e9cf9a6703d90f805a", "vout" ...
user avatar
6 votes
Accepted

The shortest ECDSA signature

What is the value of k which produces r=1 ? It's impossible to know that. If you could derive r for arbitrary values then ECDSA would be fundamentally broken. The best you can do is grind k until you ...
user avatar
  • 15k

Only top scored, non community-wiki answers of a minimum length are eligible