45

This has nothing to do with RFC6979, but with ECDSA signing and public key recovery. The (r, s) is the normal output of an ECDSA signature, where r is computed as the X coordinate of a point R, modulo the curve order n. In Bitcoin, for message signatures, we use a trick called public key recovery. The fact is that if you have the full R point (not just its ...


36

Warning: I've never actually worked with the Schnorr signature scheme. The following is my analysis based on reading the Wikipedia article, the ed25519 page, and some discussions between devs in #bitcoin-dev. Likely Changes Changed op code behavior: we will need an op code to check Schnorr signatures. With a hard fork, we can redefine op_checksig and ...


17

I found the way to do it, so, if anyone is interested, here is how to do it: When you have more than 1 input, you don't have to remove the inputs that you are not going to sign, you have to remove only their scripts. So, if you want to sign the transaction posted in the question, the first hash would be calculated like so: 'version': 1, 'inputs': (2) { ...


16

I wrote a little demo program which puts a snippet of data into an OP_RETURN script. It requires a bitcoin instance that accepts RPC connections, though it could be implemented without that. You can find it on github here. It's been tested, but only on testnet. I'm going to go through the code and explain what it's doing. Start [...] logging.basicConfig() ...


14

My guess is that Satoshi did not know about the internals of ECDSA signatures, and simply used what OpenSSL gave him. If it didn't require a hard forking change (requiring every wallet and verifying node on the network to upgrade), we'd have changed it long ago.


13

DER The Distinguished Encoding Rules (DER) format is used to encode ECDSA signatures in Bitcoin. An ECDSA signature is generated using a private key and a hash of the signed message. It consists of two 32-byte numbers (r,s). As described by Pieter here the DER signature format has the following components: 0x30 byte: header byte to indicate compound ...


12

I'm not sure why you think RSA is much safer than ECDSA. As you can read here: https://crypto.stackexchange.com/questions/3216/signatures-rsa-compared-to-ecdsa ECDSA offers same levels of security as RSA, but with a much smaller footprint. In fact, the more you increase the security, the larger the RSA keys become compared to ECDSA. This makes RSA less ...


12

the output address is derived solely from the output script starting from step 4 in the wiki like so: first add leading zeros: 0012ab8dc588ca9d5787dde7eb29569da63c3a238c then hash with sha256 (if you look in the wiki this is actually part of the OP_HASH160 operation) to give: e158c4be10913422dadcf1c36843020ebb3ffe9d0cb13fb9e8c0a564a53c7832 then hashed ...


12

note: what Nils Schneider calls 'z', i call 'm'. this gist implements all this: https://gist.github.com/nlitsme/dda36eeef541de37d996 the calculation ecdsa signing is done as follows: given a message 'm', a sign-secret 'k', a private key 'x' R = G*k (elliptic curve scalar multiplication) r = xcoordinate(R) s = (m + x * r) / k (mod q) q = the ...


12

Schnorr signatures will not replace ECDSA. Schnorr signature verification is expected to be implemented with the Taproot soft-fork using SegWit witness version 1. This means only outputs that are locked in v1 SegWit version are expected to produce a valid Schnorr signatures. ECDSA will continue to be used for spending current non-SegWit and v0 SegWit outputs....


11

Let us take "pizza transaction" https://blockchain.info/tx/cca7507897abc89628f450e8b1e0c6fca4ec3f7b34cccf55f3f531c659ff4d79 ...


11

The SIGHASH type is serialized as a single byte and then simply appended to the DER-encoded signature. Example of a typical P2PKH scriptSig: 304402206e3729f021476102a06ea453cea0a26cb9c096cca641efc4229c1111ed3a96fd022037dce1456a93f53d3e868c789b1b750a48a4c1110cd5b7049779b5f4f3c8b62001 03ff1104b46b2141df1948dd0df2223720a3a471ec57404cace47063843a699a0f The ...


11

A signature in Bitcoin (as used to sign transactions inside scriptSigs and scriptWitnesses), consists of a DER encoding of an ECDSA signature, plus a sighash type byte. Overall, this means they consist of: DER encoded signature data, consisting of: 1-byte type 0x30 "Compound object" (the tuple of (R,S) values) 1-byte length of the compound object The ...


10

Not any serious efficiency concerns. Signing is done fairly infrequently for any particular client (only a few signatures per transaction usually). While possible that the signing might take slightly longer to generate the k value, it would not be noticeable, especially considering how infrequently it is used by any one particular client. It's the ...


10

Schnorr will replace ECDSA, the signing algorithm, but both still use the same elliptic curve and thus the same public and private keys, etc. Regardless, compatibility with ECDSA must be kept too even if Schnorr is used, because otherwise all old nodes would see the schnorr signatures as invalid signatures, and all old transactions would be seen as invalid ...


9

Yes you can do public key recovery with EC Schnorr. Consider R = kG, [r = R.x, s = k + H(r, m)d], Q = dG verify: sG = ?R + H(r, m)Q recovery: sG = kG + H(r, m) dG = R + H(r, m)Q so Q = 1 / H(r, m) * (sG - R). (And to compute R from r if R is point-compressed, R = (r,f(r)) R' = (r,-f(r)) and try both R and R' by checking if the signature is valid with ...


9

Canonical DER signature implemented in BIP 66 fixes issue #1 of BIP 62 ( Non-DER encoded ECDSA signatures ) Amacilin's code exploits issue #5 in BIP 62 ( Inherent ECSDA signature malleability ), and is explained here : https://github.com/bitcoin/bitcoin/commit/a81cd96805ce6b65cca3a40ebbd3b2eb428abb7b This issue was fixed by requiring signatures to have ...


9

An algorithm called Public Key Recovery exists for ECDSA, which lets you construct the public keys for which a given pair of message and signature would be valid. To explain the algorithm, remember that ECDSA signatures are pairs (r,s) for which sR = mG + rP. In this equation m is the message hash (which must be a hash of a known message), P is the public ...


9

You must reveal the secret in order to spend the output, else there is no way other users could verify that your hash is indeed the correct one. Once you reveal that secret, anybody could attempt to create a competing transaction which spends to a different output - miners in particular would be able to confirm this transaction into a block and ignore your ...


8

Bitcoin uses the Elliptic Curve Digital Signature Algorithm (ECDSA). Your private key is used to create the signature and your public key is used to verify the signature. This allows anybody to verify your signature as long as they have your public key. For more detailed information: Digital Signature Algorithm and Elliptic Curve DSA


8

This is a common misunderstanding. It just so happens that signing with RSA is the same as encrypting with the private key. But this is a quirk of the RSA algorithm. Bitcoin doesn't use RSA, it uses ECDSA. DSA is strictly a signature algorithm -- it has no encrypt operation at all. The ECDSA signature operation, like the DSA signature algorithm, requires a ...


8

Simple, the sender shows the pubkey when spending from whatever address the bitcoins are in. As part of the verification, the receiver (actually, every node in the network), can verify that the pubkey hashes to the address given and then and only then verifies the signature.


8

What is signed in the input scripts? Depends. The case of a P2PKH spending transaction, the scriptSig (input script) for each input will contain a ECDSA signature and a byte which donates what exactly was signed called the SIGHASH flag. In almost all cases this is SIGHASH_ALL, which means that the signature covers the entirety of the transaction outputs ...


8

This answer depends on that you are using Bitcoin Core 0.13.1 and you have downloaded bitcoin-0.13.1-win64.zip, this answer will also work with any other bitcoin version or download with only change signer public key, checksum file and bitcoin download name. First you need to import public key of the signer, in this case the key with id: 0x90C8019E36C2E964, ...


8

Let me rewrite your question in a different notation, where all lowercase values are integers and uppercase values are points. The group generator is G (a known constant). The private key is q, its corresponding public key is Q = qG. The nonce is n, its corresponding point is R = nG. The X coordinate of R is r. The hash function is h(x). A signature is (r,s)...


8

Moving signatures to a separate field does not actually solve it. However one of the things that segwit did was to redefine the message that is hashed and signed. This is specified in BIP 143. Signature verification requires three things: the public key, the signature, and the message that was signed. In Bitcoin, the public key and the signature are ...


7

The victim could send any "shady" or unauthorized donation back to the originating address, and the refund would be just as public as the initial donation. The process could also be automated with a custom wallet software, so that, for example, all donations above a certain amount which are not explicitly approved are automatically refunded after x days.


7

The problem stated here is that the message signed was only four uppercase letters: "DJFC." Apparently this is the person's Reddit username, but it's also a very tiny amount of data which can often be problematic. Mathematically speaking, the more entropy in your signed message the greater confidence it inspires. Simply signing your username is also not ...


7

Bitcoin uses ECDSA to sign messages. With ECDSA, signing requires as input the private key, the message, and also a random number k. Signing two different messages with the same k allows anyone with both signatures to easily recover your ECDSA private key. So every time you sign something with Bitcoin, a new k is generated, and this makes the signatures ...


7

You can sign a message to prove ownership of a particular private key, without sharing the private key or spending any funds. For example, you could sign a message that says "My name is John Doe". You could give this signed message to anybody, and they can verify it with your public key. This proves that whoever has your private key claimed to be John Doe at ...


Only top voted, non community-wiki answers of a minimum length are eligible