22 votes
Accepted

Is any 256-bit combination a Bitcoin private key?

A secp256k1 private key is an integer between 1 and 115792089237316195423570985008687907852837564279074904382605163141518161494336, inclusive. The latter can be written as 2256 - ...
Pieter Wuille's user avatar
21 votes
Accepted

What are the DER signature and SEC format

DER The Distinguished Encoding Rules (DER) format is used to encode ECDSA signatures in Bitcoin. An ECDSA signature is generated using a private key and a hash of the signed message. It consists of ...
Murch's user avatar
  • 74.4k
14 votes
Accepted

What is the maximum size of a DER encoded ECDSA signature?

A signature in Bitcoin (as used to sign transactions inside scriptSigs and scriptWitnesses), consists of a DER encoding of an ECDSA signature, plus a sighash type byte. Overall, this means they ...
Pieter Wuille's user avatar
13 votes
Accepted

Will Schnorr Multi-signatures completely replace ECDSA?

Schnorr signatures will not replace ECDSA. Schnorr signature verification is expected to be implemented with the Taproot soft-fork using SegWit witness version 1. This means only outputs that are ...
Ugam Kamat's user avatar
  • 7,398
11 votes
Accepted

BLS signatures vs Schnorr

How do BLS signatures (or other pairing-based schemes) compare to Schnorr signatures in terms of cryptographic assumptions? BLS needs a pairing-compatible elliptic curve, which imposes additional ...
Pieter Wuille's user avatar
10 votes
Accepted

Replacing ECDSA (SECP256k1) with Schnorr signatures

Schnorr will replace ECDSA, the signing algorithm, but both still use the same elliptic curve and thus the same public and private keys, etc. Regardless, compatibility with ECDSA must be kept too ...
meshcollider's user avatar
  • 11.8k
10 votes
Accepted

How is Public Key extracted from (message, digital signature, address)

An algorithm called Public Key Recovery exists for ECDSA, which lets you construct the public keys for which a given pair of message and signature would be valid. To explain the algorithm, remember ...
Pieter Wuille's user avatar
10 votes
Accepted

What is the O(n^2) signature hashing problem and how does SegWit solves it?

Moving signatures to a separate field does not actually solve it. However one of the things that segwit did was to redefine the message that is hashed and signed. This is specified in BIP 143. ...
Ava Chow's user avatar
  • 69.9k
9 votes
Accepted

How to verify Bitcoin Core Release Signing Keys

This answer depends on that you are using Bitcoin Core 0.13.1 and you have downloaded bitcoin-0.13.1-win64.zip, this answer will also work with any other bitcoin version or download with only change ...
BufferOverflow's user avatar
9 votes
Accepted

Why is the signature hash different for each input in a multi-input transaction?

Varying the signature per input helps prevents some attacks during multi-party transaction construction. Consider a coinjoin involving Alice and Bob. Alice selects one of her UTXOs for the coinjoin. ...
Russell O'Connor's user avatar
9 votes
Accepted

If I set assumevalid=0 after syncing the blockchain will Bitcoin Core go back and validate historical blocks?

No, it won't. That's also not possible without rebuilding the UTXO set from scratch, as the unspent outputs being spent need to be known to validate spends against. If you want to force a ...
Pieter Wuille's user avatar
9 votes
Accepted

Why does Bitcoin use ECDSA, instead of plain old hashing, to secure transaction outputs?

You must reveal the secret in order to spend the output, else there is no way other users could verify that your hash is indeed the correct one. Once you reveal that secret, anybody could attempt to ...
Mark H's user avatar
  • 3,334
9 votes
Accepted

Why is it important that nonces when signing not be related?

I'm going to use the Schnorr equation here (s = k + H(R||P||m)*d for signature (R,s), pubkey P = d*G, message m), but everything equally applies to ECDSA (which uses s = (H(m) + R.x*d) / k), or even ...
Pieter Wuille's user avatar
8 votes
Accepted

Signing transaction with SSL - private key to PEM

when I verify your self created privkey, I get this error: error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long I couldn't see how you created your privkey, but the way to go is ...
pebwindkraft's user avatar
  • 5,076
8 votes
Accepted

How can my private key be revealed if I use the same nonce while generating the signature?

Let me rewrite your question in a different notation, where all lowercase values are integers and uppercase values are points. The group generator is G (a known constant). The private key is q, its ...
Pieter Wuille's user avatar
8 votes
Accepted

What is signature grinding?

The serialization format used for ECDSA signatures requires 33 bytes to encode an r-value that falls into the higher half of the range, but only 32 bytes to encode one falling into the lower half of ...
Murch's user avatar
  • 74.4k
8 votes
Accepted

Why are hashSequence and hashPrevouts computed separately?

The reason is increasing the ability to precompute and/or cache those hash values once for the whole transaction (potentially allowing them to be used for many signatures). In "normal" (...
Pieter Wuille's user avatar
7 votes

How to verify Bitcoin Core Release Signing Keys

As of Bitcoin Core v22.0, the signing and signature verification procedure has changed. See "Verify your download" on bitcoincore.org/en/download for the official documentation. Basically, ...
kajoseph's user avatar
7 votes
Accepted

How to sign raw transaction given a private key and SHA hash (in java)

This answer does not attempt to sign a transaction, but simply focuses on successfully calling the sign method of the ECKey class, i.e. making your code work. I am not yet familiar with the ...
Sven Williamson's user avatar
7 votes
Accepted

Why is my P2SH sigScript field prepended with 0x00?

OP_CHECKMULTISIG contains a bug which consumes one extra element from the stack. Due to this, an additional OP_FALSE (0x00) is pushed for multisig scripts to make the script evaluation valid.
Raghav Sood's user avatar
7 votes
Accepted

Segwit includes the input amount in the SignatureHash. What possible attack can this prevent?

Consider a transaction that has 2 inputs and 1 output. Let's say that the inputs are both 1 BTC and the output is 1.5 BTC. This would mean that the transaction pays a 0.5 BTC fee, which is ridiculous. ...
Ava Chow's user avatar
  • 69.9k
7 votes
Accepted

Why inputs' scriptSig are stripped before the whole transaction being signed?

Because they can't be. The scriptSig values contain the signatures. If they were included in the message being signed, you'd need signatures that sign themselves. That's not possible.
Pieter Wuille's user avatar
6 votes

ECDSA: (v, r, s), what is v?

As all the other answers already outline: v is required to recover the correct public key for a signature because there are sometimes (even with low probability) more than one valid public key to be ...
q9f's user avatar
  • 1,444
6 votes
Accepted

allowed DER encoding format violations for signatures in bitcoin: implications for libraries?

It isn't clear to me from your question what your goal is. If you want to accept all transactions and only transactions that Bitcoin would accept, libsecp256k1 alone is what you want. (You may need ...
G. Maxwell's user avatar
  • 7,727
6 votes

tiny-secp256k1 and ECDSA signing determinism

The secp256k1 library uses RFC6979 to generate deterministic nonce values (k). It essentially takes the hash of both the private key and the message being signed in order to get k. This means that ...
Ava Chow's user avatar
  • 69.9k
6 votes
Accepted

Would signature aggregation reduce the largest feasible blocksize

SegWit blocks aren't limited in bytes anymore but rather in weight. The maximum weight for a block is 4M. The weight of non-witness data is 4x its number of bytes. So, yes, decreasing the amount of ...
Jannes's user avatar
  • 6,334
6 votes
Accepted

Can signature be re-used to cash out everything in the address?

When you sign the transaction with your private key, you include the hash of the entire transaction data as a message. This means the signature which is generated is specific to that transaction ...
Ugam Kamat's user avatar
  • 7,398
6 votes
Accepted

Why is there no such thing as a redirected, forged, or fake transaction?

The Bitcoin protocol follows a Unspent Transaction Output system to track the existence and state of all Bitcoin in the system. These are known as UTXOs. All transactions that transfer Bitcoin do so ...
Raghav Sood's user avatar
6 votes
Accepted

Are UTXOs signed with a private key?

That's correct. UTXOs are just entries with the following fields: txid of the transaction that created it output position in that transaction that created this output the output itself (consisting of ...
Pieter Wuille's user avatar
6 votes

SegWit signing algorithm and its improvement

To be clear, this is talking about the way the message that is signed is computed. It is unrelated to transaction or block hashes and the signature algorithm itself, just how Bitcoin determines what ...
Ava Chow's user avatar
  • 69.9k

Only top scored, non community-wiki answers of a minimum length are eligible