47 votes
Accepted

ECDSA: (v, r, s), what is v?

This has nothing to do with RFC6979, but with ECDSA signing and public key recovery. The (r, s) is the normal output of an ECDSA signature, where r is computed as the X coordinate of a point R, ...
user avatar
37 votes
Accepted

What are the implications of Schnorr signatures?

Warning: I've never actually worked with the Schnorr signature scheme. The following is my analysis based on reading the Wikipedia article, the ed25519 page, and some discussions between devs in #...
user avatar
19 votes
Accepted

How to sign a transaction with multiple inputs?

I found the way to do it, so, if anyone is interested, here is how to do it: When you have more than 1 input, you don't have to remove the inputs that you are not going to sign, you have to remove ...
user avatar
18 votes
Accepted

What is a step by step way to insert data in OP_RETURN?

I wrote a little demo program which puts a snippet of data into an OP_RETURN script. It requires a bitcoin instance that accepts RPC connections, though it could be implemented without that. You can ...
user avatar
  • 28.7k
15 votes
Accepted

What are the DER signature and SEC format

DER The Distinguished Encoding Rules (DER) format is used to encode ECDSA signatures in Bitcoin. An ECDSA signature is generated using a private key and a hash of the signed message. It consists of ...
user avatar
  • 63.3k
13 votes
Accepted

How does the ECDSA verification algorithm work during transaction?

Let us take "pizza transaction" https://blockchain.info/tx/cca7507897abc89628f450e8b1e0c6fca4ec3f7b34cccf55f3f531c659ff4d79 ...
user avatar
  • 6,592
13 votes
Accepted

Will Schnorr Multi-signatures completely replace ECDSA?

Schnorr signatures will not replace ECDSA. Schnorr signature verification is expected to be implemented with the Taproot soft-fork using SegWit witness version 1. This means only outputs that are ...
user avatar
  • 6,908
12 votes

ECDSA Signature and the "z" value

note: what Nils Schneider calls 'z', i call 'm'. this gist implements all this: https://gist.github.com/nlitsme/dda36eeef541de37d996 the calculation ecdsa signing is done as follows: given a message '...
user avatar
12 votes
Accepted

What is the maximum size of a DER encoded ECDSA signature?

A signature in Bitcoin (as used to sign transactions inside scriptSigs and scriptWitnesses), consists of a DER encoding of an ECDSA signature, plus a sighash type byte. Overall, this means they ...
user avatar
11 votes
Accepted

How are SIGHASH flags encoded into a signature?

The SIGHASH type is serialized as a single byte and then simply appended to the DER-encoded signature. Example of a typical P2PKH scriptSig: ...
user avatar
10 votes
Accepted

Problems with deterministic ECDSA based on RFC6979 in Bitcoin

Not any serious efficiency concerns. Signing is done fairly infrequently for any particular client (only a few signatures per transaction usually). While possible that the signing might take slightly ...
user avatar
  • 13.7k
10 votes
Accepted

Replacing ECDSA (SECP256k1) with Schnorr signatures

Schnorr will replace ECDSA, the signing algorithm, but both still use the same elliptic curve and thus the same public and private keys, etc. Regardless, compatibility with ECDSA must be kept too ...
user avatar
  • 11.3k
9 votes

What are the implications of Schnorr signatures?

Yes you can do public key recovery with EC Schnorr. Consider R = kG, [r = R.x, s = k + H(r, m)d], Q = dG verify: sG = ?R + H(r, m)Q recovery: sG = kG + H(r, m) dG = R + H(r, m)Q so Q = 1 / H(r, ...
user avatar
9 votes
Accepted

Why was the Oct 2015 Transaction Malleability event possible in spite of BIP62/66?

Canonical DER signature implemented in BIP 66 fixes issue #1 of BIP 62 ( Non-DER encoded ECDSA signatures ) Amacilin's code exploits issue #5 in BIP 62 ( Inherent ECSDA signature malleability ), ...
user avatar
  • 2,052
9 votes
Accepted

Why can't bitcoin miners modify transaction outputs?

What is signed in the input scripts? Depends. The case of a P2PKH spending transaction, the scriptSig (input script) for each input will contain a ECDSA signature and a byte which donates what ...
user avatar
  • 15k
9 votes
Accepted

How is Public Key extracted from (message, digital signature, address)

An algorithm called Public Key Recovery exists for ECDSA, which lets you construct the public keys for which a given pair of message and signature would be valid. To explain the algorithm, remember ...
user avatar
9 votes
Accepted

Why does Bitcoin use ECDSA, instead of plain old hashing, to secure transaction outputs?

You must reveal the secret in order to spend the output, else there is no way other users could verify that your hash is indeed the correct one. Once you reveal that secret, anybody could attempt to ...
user avatar
  • 3,220
9 votes
Accepted

Why is it important that nonces when signing not be related?

I'm going to use the Schnorr equation here (s = k + H(R||P||m)*d for signature (R,s), pubkey P = d*G, message m), but everything equally applies to ECDSA (which uses s = (H(m) + R.x*d) / k), or even ...
user avatar
8 votes
Accepted

How can someone verify the signature of a Bitcoin ECDSA signature without knowing the signer's public key?

Simple, the sender shows the pubkey when spending from whatever address the bitcoins are in. As part of the verification, the receiver (actually, every node in the network), can verify that the pubkey ...
user avatar
  • 7,629
8 votes
Accepted

How to verify Bitcoin Core Release Signing Keys

This answer depends on that you are using Bitcoin Core 0.13.1 and you have downloaded bitcoin-0.13.1-win64.zip, this answer will also work with any other bitcoin version or download with only change ...
user avatar
8 votes
Accepted

Why is the signature hash different for each input in a multi-input transaction?

Varying the signature per input helps prevents some attacks during multi-party transaction construction. Consider a coinjoin involving Alice and Bob. Alice selects one of her UTXOs for the coinjoin. ...
user avatar
8 votes
Accepted

How can my private key be revealed if I use the same nonce while generating the signature?

Let me rewrite your question in a different notation, where all lowercase values are integers and uppercase values are points. The group generator is G (a known constant). The private key is q, its ...
user avatar
8 votes
Accepted

What is the O(n^2) signature hashing problem and how does SegWit solves it?

Moving signatures to a separate field does not actually solve it. However one of the things that segwit did was to redefine the message that is hashed and signed. This is specified in BIP 143. ...
user avatar
  • 61.3k
7 votes
Accepted

What should I say when I "sign" a message, to prove that I own an address?

The problem stated here is that the message signed was only four uppercase letters: "DJFC." Apparently this is the person's Reddit username, but it's also a very tiny amount of data which can often be ...
user avatar
  • 14.3k
7 votes
Accepted

Why does re-signing a message in bitcoin-qt produce a different hash

Bitcoin uses ECDSA to sign messages. With ECDSA, signing requires as input the private key, the message, and also a random number k. Signing two different messages with the same k allows anyone with ...
user avatar
  • 8,694
7 votes
Accepted

For what purposes do we need "Sign message"?

You can sign a message to prove ownership of a particular private key, without sharing the private key or spending any funds. For example, you could sign a message that says "My name is John Doe". You ...
user avatar
7 votes
Accepted

How to sign raw transaction given a private key and SHA hash (in java)

This answer does not attempt to sign a transaction, but simply focuses on successfully calling the sign method of the ECKey class, i.e. making your code work. I am not yet familiar with the ...
user avatar
7 votes
Accepted

Signing transaction with SSL - private key to PEM

when I verify your self created privkey, I get this error: error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long I couldn't see how you created your privkey, but the way to go is ...
user avatar
  • 5,006
7 votes
Accepted

Why is my P2SH sigScript field prepended with 0x00?

OP_CHECKMULTISIG contains a bug which consumes one extra element from the stack. Due to this, an additional OP_FALSE (0x00) is pushed for multisig scripts to make the script evaluation valid.
user avatar
  • 16.5k
7 votes
Accepted

If I set assumevalid=0 after syncing the blockchain will Bitcoin Core go back and validate historical blocks?

No, it won't. That's also not possible without rebuilding the UTXO set from scratch, as the unspent outputs being spent need to be known to validate spends against. If you want to force a ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible