ECDSA signatures

ECDSA is the signature scheme Bitcoin used from the start. A signature is two numbers, r and s. Learn how it works and why nonce reuse is fatal.

Two numbers

An ECDSA signature is a pair (r, s). Roughly:

1. Pick a secret random number k (the nonce) and compute the point k·G. Its x-coordinate becomes r.
2. Combine r, the message hash and your private key to get s.
3. The verifier uses r, s, the hash and your public key to check that the maths lines up.

Encoding

In Bitcoin, ECDSA signatures are encoded in a format called DER plus a one-byte sighash flag: usually 71 to 72 bytes in total.

The nonce must never repeat

If the same k is used for two different messages, anyone can compute your private key from the two signatures. This has really happened, for example with faulty random number generators in some early wallets. Modern wallets derive k deterministically from the key and message (RFC 6979), which removes the risk. See Randomness and entropy.

Malleability

ECDSA signatures can be tweaked into another valid form (for example by negating s). Before Segregated Witness (SegWit) this changed the txid. Bitcoin now requires the "low s" form for standard transactions, and SegWit removed signatures from the txid.

The PlayStation lesson

In 2010, researchers showed that Sony signed its PlayStation 3 software with ECDSA using the same nonce every time, which let them compute Sony's private key. The same mistake in a Bitcoin wallet would let anyone take the funds. That is why deterministic nonces (RFC 6979) became standard.

Low-S signatures

Each ECDSA signature has two valid forms: s and n − s. Bitcoin's relay policy accepts only the lower one, removing that source of malleability for non-SegWit transactions.