New answers tagged


Negating an elliptic curve point means negating its Y coordinate (modulo the field size p), so -(x,y) = (x,-y). This implies that if you have a point R for which R.x mod n = k (where n is the curve order), then the same will be true for -R. Furthermore, and with negligable probability, it is possible that both R.x and R.x + n are valid X coordinates (only ...


Signing transaction is a bit more complicated than just signing the hash of unsigned transaction Look at the explanations here: Redeeming a raw transaction step by step example required How to redeem a basic Tx?


This is unrelated to segregated witness. Since Bitcoin Core version v0.17, signatures have low R signatures. The signing operating is repeated until an R value is constructed that's below 2255. On average this only takes 2 attempts, but it makes all signatures equally long (71 bytes; rather than 50% 71 bytes and 50% 72 bytes), making them more predictable ...


Your signatures don't verify because in JCE you are using algorithm SHA256withECDSA which hashes the supplied data (re-hashes, since you are supplying a hash) before doing the kG.x,kinv(h+rd) computation, or the similar verification computation, whereas the spongy/bouncy ECDSASigner used in bitcoinj only does the latter, assuming the input is already the ...

Top 50 recent answers are included