# Recovering the curve-point R from a signature ECDSA

When recovering the public key from ECDSA signature (r, s), the first step is recovering the point R.

You do this by plugging in (r + xn) into the curve equation where n is the order of the basepoint and x is some integer

my question is how do you find this x value, say for secp256k1 but also the general case

I have a vauge notion that this may be related to the cofactor of the curve (usually working with secp256k1 this shouldnt be important). But im failing to find more info on it.

Well, in the case of secp256k1, we have $$n \approx p$$, and so (with extremely high probability) $$r + n > p$$, and so we have $$x = 0$$.
Now, for curves with non-1 cofactors, we have $$n \approx p/h$$ (where $$h$$ is the cofactor), and so there may be several possible $$x$$ values for which $$r + xn < p$$, and so in the general case, this needs to be considered.
• Uh, I have trouble recognizing the question's "plugging in $(r + xn)$ into the curve equation where $n$ is the order of the basepoint" in the ECDSA signature verification steps. Where exactly would that be ?