# Tag Info

Accepted

### If someone wanted to pretend to be Satoshi by posting a fake signature to defraud people how could they?

Unfortunately, given the public's limited of understanding of cryptography this is apparently an easy fraud to pull off. The key trick is that non-technical people are prone to believe things that ...
Accepted

### ECDSA: (v, r, s), what is v?

This has nothing to do with RFC6979, but with ECDSA signing and public key recovery. The (r, s) is the normal output of an ECDSA signature, where r is computed as the X coordinate of a point R, ...

### How do you get a Bitcoin Public Key from a Private Key

I'll try answering this again in a different way, using small numbers to keep it readable. convert the private key to binary representation, so decimal number 105, which is 0x69 in hex, becomes ...
Accepted

### What are the potential attacks against ECDSA that would be possible if we used raw public keys as addresses?

The theory It is assumed that in order to forge an ECDSA signature you need to compute the private key for a given public key first (this operation is known as the "discrete logarithm" (DL), ...
Accepted

### How do you derive the private key from two signatures that share the same k value?

ECDSA signatures are pairs (r,s) where r=(kG).x mod n, and s = (m + rx)/k mod n, where x is the secret key, k is the random nonce, and m is the message. If you have two s values s1 and s2 for the same ...
Accepted

### What are the advantages of Schnorr vs ECDSA?

Your question seems to assume that the only goal is minimizing on-chain transaction size. Reducing size and related costs is certainly something that can be improved upon, but it's far from the only ...
Accepted

### Recovering private key when someone uses the same k twice in ECDSA signatures

Here is a fun thing about ECDSA signatures: you can always replace s with -s (mod N) and the signature is still valid. So when you are deducing the k value, it is possible that someone else flipped ...
Accepted

### Are Schnorr signatures quantum-computer resistant?

No, ECDSA and EC-Schnorr, as well as related schemes like EdDSA, all belong to the class of elliptic curve cryptography. Their security is based on the assumption that the EC discrete logarithm is ...
Accepted

### What is the origin of insecure 64-bit nonces in signatures in the Bitcoin chain?

Based on the time-frame and my impression of the capabilities of the various groups developing wallet software during that period my initial guess was that the Bitpay copay software might be the ...
Accepted

### How does the ECDSA verification algorithm work during transaction?

Let us take "pizza transaction" https://blockchain.info/tx/cca7507897abc89628f450e8b1e0c6fca4ec3f7b34cccf55f3f531c659ff4d79 ...
Accepted

### Will Schnorr Multi-signatures completely replace ECDSA?

Schnorr signatures will not replace ECDSA. Schnorr signature verification is expected to be implemented with the Taproot soft-fork using SegWit witness version 1. This means only outputs that are ...
Accepted

### Bitcoin private key, location on ECC curve

The basic elliptic curve operation is addition of points. The operation of applying this addition repeatedly is called the scalar multiplication of a point by an integer. The private key is the '...

### ECDSA Signature and the "z" value

note: what Nils Schneider calls 'z', i call 'm'. this gist implements all this: https://gist.github.com/nlitsme/dda36eeef541de37d996 the calculation ecdsa signing is done as follows: given a message '...
Accepted

### What is the maximum size of a DER encoded ECDSA signature?

A signature in Bitcoin (as used to sign transactions inside scriptSigs and scriptWitnesses), consists of a DER encoding of an ECDSA signature, plus a sighash type byte. Overall, this means they ...
Accepted

### What is the reasoning behind the choice of 2^256-2^32-977 for the prime on the secp256k1 curve?

Secp256k1 was designed to be a 256-bit size elliptic curve without cofactor and admitting an efficient endomorphism for optimization purposes. The choices of the relevant parameters are derived from ...
Accepted

### What is is minimum possible number for an ECDSA private key?

The all-zero bitstring doesn't have a corresponding public key per the standard (according to "Are all possible EC private keys valid?" on Crypto.SE), so it's 000…001.
Accepted

### Problems with deterministic ECDSA based on RFC6979 in Bitcoin

Not any serious efficiency concerns. Signing is done fairly infrequently for any particular client (only a few signatures per transaction usually). While possible that the signing might take slightly ...
Accepted

### Is libsecp256k1 faster than OpenSSL?

Yes it's a lot faster. For example from one of the core developers: reddit - Pieter Wuille / 2015-02-19 18:13 Just did a benchmark on libsecp256k1's current master, without GMP, without hand-...
Accepted

### Replacing ECDSA (SECP256k1) with Schnorr signatures

Schnorr will replace ECDSA, the signing algorithm, but both still use the same elliptic curve and thus the same public and private keys, etc. Regardless, compatibility with ECDSA must be kept too ...
Accepted

### Why was the Oct 2015 Transaction Malleability event possible in spite of BIP62/66?

Canonical DER signature implemented in BIP 66 fixes issue #1 of BIP 62 ( Non-DER encoded ECDSA signatures ) Amacilin's code exploits issue #5 in BIP 62 ( Inherent ECSDA signature malleability ), ...
Accepted

### How can someone verify the signature of a Bitcoin ECDSA signature without knowing the signer's public key?

Simple, the sender shows the pubkey when spending from whatever address the bitcoins are in. As part of the verification, the receiver (actually, every node in the network), can verify that the pubkey ...

### How do I convert Public Key x value to y in Python and verify?

First, you need to understand what the two formats actually are. The first is the compressed SEC format and the second is the uncompressed SEC format. The difference between the two is that the ...

### What is is minimum possible number for an ECDSA private key?

One is the minimum number. [This space intentionally left unblank.]
Accepted

### How do you invert an ECDSA multiplication to get the generator?

k is just a scalar, modulo the order of the elliptic curve group. Q = k*P thus: (1/k)*Q = (1/k)*k*P thus: (1/k)*Q = P You find P by multiplying Q with the multiplication inverse of k modulo the ...
Accepted

### How to sign raw transaction given a private key and SHA hash (in java)

This answer does not attempt to sign a transaction, but simply focuses on successfully calling the sign method of the ECKey class, i.e. making your code work. I am not yet familiar with the ...
Accepted

### Is normal ECDSA verification slower than a verification method based on Public Key Recovery?

Verification w/ Public key recovery is never going to be faster than normal verification however it is only marginally slower. I benchmarked it a while back and PubKey recovery added about 5% ...

### ECDSA x,y coordinate validity verification doesn't seem to work

The plain text format of this equation only makes sense when you understand the theory behind it. y ^ 2 = x ^ 3 + 7 mod P means "do all math in this equation using the finite number field with ...

### How do you get a Bitcoin Public Key from a Private Key

Here's a self-contained Python script that does the conversion. You can check its work by comparing to entering your private key as the "Secret Exponent" at Brainwallet. I took the script from this ...