Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
When recovering the public key from ECDSA signature (r, s), the first step is recovering the point R.
You do this by plugging in (r + xn) into the curve equation where n is the order of the basepoint and x is some integer
my question is how do you find this x value, say for secp256k1 but also the general case
I have a vauge notion that this may be related to the cofactor of the curve (usually working with secp256k1 this shouldnt be important). But im failing to find more info on it.
my question is how do you find this x value, say for secp256k1 but also the general case
Well, in the case of secp256k1, we have $n \approx p$, and so (with extremely high probability) $r + n > p$, and so we have $x = 0$.
Now, for curves with non-1 cofactors, we have $n \approx p/h$ (where $h$ is the cofactor), and so there may be several possible $x$ values for which $r + xn < p$, and so in the general case, this needs to be considered.
