54
votes
Accepted
ECDSA: (v, r, s), what is v?
This has nothing to do with RFC6979, but with ECDSA signing and public key recovery.
The (r, s) is the normal output of an ECDSA signature, where r is computed as the X coordinate of a point R, ...
- 99.3k
22
votes
Accepted
Is any 256-bit combination a Bitcoin private key?
A secp256k1 private key is an integer between 1 and 115792089237316195423570985008687907852837564279074904382605163141518161494336, inclusive. The latter can be written as 2256 - ...
- 99.3k
20
votes
Accepted
How to sign a transaction with multiple inputs?
I found the way to do it, so, if anyone is interested, here is how to do it:
When you have more than 1 input, you don't have to remove the inputs that you are not going to sign, you have to remove ...
- 758
19
votes
Accepted
What are the DER signature and SEC format
DER
The Distinguished Encoding Rules (DER) format is used to encode ECDSA signatures in Bitcoin. An ECDSA signature is generated using a private key and a hash of the signed message. It consists of ...
- 71.7k
14
votes
Accepted
What is the maximum size of a DER encoded ECDSA signature?
A signature in Bitcoin (as used to sign transactions inside scriptSigs and scriptWitnesses), consists of a DER encoding of an ECDSA signature, plus a sighash type byte.
Overall, this means they ...
- 99.3k
13
votes
Accepted
Will Schnorr Multi-signatures completely replace ECDSA?
Schnorr signatures will not replace ECDSA. Schnorr signature verification is expected to be implemented with the Taproot soft-fork using SegWit witness version 1. This means only outputs that are ...
- 7,308
11
votes
Accepted
BLS signatures vs Schnorr
How do BLS signatures (or other pairing-based schemes) compare to Schnorr signatures in terms of cryptographic assumptions?
BLS needs a pairing-compatible elliptic curve, which imposes additional ...
- 99.3k
10
votes
Accepted
Replacing ECDSA (SECP256k1) with Schnorr signatures
Schnorr will replace ECDSA, the signing algorithm, but both still use the same elliptic curve and thus the same public and private keys, etc.
Regardless, compatibility with ECDSA must be kept too ...
- 11.7k
10
votes
Accepted
How is Public Key extracted from (message, digital signature, address)
An algorithm called Public Key Recovery exists for ECDSA, which lets you construct the public keys for which a given pair of message and signature would be valid.
To explain the algorithm, remember ...
- 99.3k
10
votes
Accepted
What is the O(n^2) signature hashing problem and how does SegWit solves it?
Moving signatures to a separate field does not actually solve it. However one of the things that segwit did was to redefine the message that is hashed and signed. This is specified in BIP 143.
...
- 67.5k
9
votes
Accepted
Why can't bitcoin miners modify transaction outputs?
What is signed in the input scripts?
Depends.
The case of a P2PKH spending transaction, the scriptSig (input script) for each input will contain a ECDSA signature and a byte which donates what ...
- 15.3k
9
votes
Accepted
Why was the Oct 2015 Transaction Malleability event possible in spite of BIP62/66?
Canonical DER signature implemented in BIP 66 fixes issue #1 of BIP 62 ( Non-DER encoded ECDSA signatures )
Amacilin's code exploits issue #5 in BIP 62 ( Inherent ECSDA signature malleability ), ...
- 2,072
9
votes
Accepted
How to verify Bitcoin Core Release Signing Keys
This answer depends on that you are using Bitcoin Core 0.13.1 and you have downloaded bitcoin-0.13.1-win64.zip, this answer will also work with any other bitcoin version or download with only change ...
- 218
9
votes
Accepted
Why is the signature hash different for each input in a multi-input transaction?
Varying the signature per input helps prevents some attacks during multi-party transaction construction.
Consider a coinjoin involving Alice and Bob. Alice selects one of her UTXOs for the coinjoin. ...
- 466
9
votes
Accepted
Why does Bitcoin use ECDSA, instead of plain old hashing, to secure transaction outputs?
You must reveal the secret in order to spend the output, else there is no way other users could verify that your hash is indeed the correct one. Once you reveal that secret, anybody could attempt to ...
- 3,304
9
votes
Accepted
Why is it important that nonces when signing not be related?
I'm going to use the Schnorr equation here (s = k + H(R||P||m)*d for signature (R,s), pubkey P = d*G, message m), but everything equally applies to ECDSA (which uses s = (H(m) + R.x*d) / k), or even ...
- 99.3k
8
votes
Accepted
Signing transaction with SSL - private key to PEM
when I verify your self created privkey, I get this error:
error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long
I couldn't see how you created your privkey, but the way to go is ...
- 5,086
8
votes
Accepted
How can my private key be revealed if I use the same nonce while generating the signature?
Let me rewrite your question in a different notation, where all lowercase values are integers and uppercase values are points.
The group generator is G (a known constant).
The private key is q, its ...
- 99.3k
8
votes
Accepted
If I set assumevalid=0 after syncing the blockchain will Bitcoin Core go back and validate historical blocks?
No, it won't.
That's also not possible without rebuilding the UTXO set from scratch, as the unspent outputs being spent need to be known to validate spends against.
If you want to force a ...
- 99.3k
8
votes
Accepted
What is signature grinding?
The serialization format used for ECDSA signatures requires 33 bytes to encode an r-value that falls into the higher half of the range, but only 32 bytes to encode one falling into the lower half of ...
- 71.7k
7
votes
Accepted
How to sign raw transaction given a private key and SHA hash (in java)
This answer does not attempt to sign a transaction, but simply focuses on successfully calling the sign method of the ECKey class, i.e. making your code work. I am not yet familiar with the ...
- 1,524
7
votes
Accepted
Why is my P2SH sigScript field prepended with 0x00?
OP_CHECKMULTISIG contains a bug which consumes one extra element from the stack. Due to this, an additional OP_FALSE (0x00) is pushed for multisig scripts to make the script evaluation valid.
- 16.9k
7
votes
Accepted
Why inputs' scriptSig are stripped before the whole transaction being signed?
Because they can't be.
The scriptSig values contain the signatures. If they were included in the message being signed, you'd need signatures that sign themselves. That's not possible.
- 99.3k
6
votes
ECDSA: (v, r, s), what is v?
As all the other answers already outline: v is required to recover the correct public key for a signature because there are sometimes (even with low probability) more than one valid public key to be ...
- 1,444
6
votes
How to verify Bitcoin Core Release Signing Keys
As of Bitcoin Core v22.0, the signing and signature verification procedure has changed. See "Verify your download" on bitcoincore.org/en/download for the official documentation.
Basically, ...
- 61
6
votes
Accepted
allowed DER encoding format violations for signatures in bitcoin: implications for libraries?
It isn't clear to me from your question what your goal is. If you want to accept all transactions and only transactions that Bitcoin would accept, libsecp256k1 alone is what you want. (You may need ...
- 7,676
6
votes
tiny-secp256k1 and ECDSA signing determinism
The secp256k1 library uses RFC6979 to generate deterministic nonce values (k). It essentially takes the hash of both the private key and the message being signed in order to get k. This means that ...
- 67.5k
6
votes
Accepted
Would signature aggregation reduce the largest feasible blocksize
SegWit blocks aren't limited in bytes anymore but rather in weight. The maximum weight for a block is 4M. The weight of non-witness data is 4x its number of bytes.
So, yes, decreasing the amount of ...
- 6,325
6
votes
Accepted
Can signature be re-used to cash out everything in the address?
When you sign the transaction with your private key, you include the hash of the entire transaction data as a message. This means the signature which is generated is specific to that transaction ...
- 7,308
6
votes
Accepted
Why is there no such thing as a redirected, forged, or fake transaction?
The Bitcoin protocol follows a Unspent Transaction Output system to track the existence and state of all Bitcoin in the system. These are known as UTXOs.
All transactions that transfer Bitcoin do so ...
- 16.9k
Only top scored, non community-wiki answers of a minimum length are eligible