Over the past few months, I have been reading and trying to understand how ECDSA works and how safe is it. So now something does not add up between its signature verification and generation. But maybe its my code so here:

import ecdsa
import random
import libnum
import hashlib
import bitcoin
from ecdsa import SECP256k1
from ecdsa.ellipticcurve import Point
from sympy import mod_inverse

curve = SECP256k1.curve
G = ecdsa.SECP256k1.generator
order = G.order()
n = order

def genp(k=None):
    if k is None:
        k = random.randrange(2**11,2**12)
    return k, bitcoin.fast_multiply(bitcoin.G,k)

def addp(P,Q):
    point1 = Point(curve, P[0], P[1])
    point2 = Point(curve, Q[0], Q[1])
    result_point = point1 + point2
    return result_point.x(),result_point.y()
def gensig(d,k,h):
    x = bitcoin.fast_multiply(bitcoin.G, k)
    r = x[0] % n
    k_inv = mod_inverse(k, n)
    s = (k_inv * (h+(r*d))) % n
    return r,s

a = 367582
b = 500
d = 879879234765
z = 101702141701147655756371337761706999949138440657757423525978471151371012985654    
x,pq = genp(d)
k = (x*b+a)

r,s = gensig(x,k,z)

#Going in reverse
w = mod_inverse(s, n)
bn = w*r 
an = w*z 

The above code generates signatures correctly but the values bn and an are not the same as original b and a why? From what i understood the verification equation is:

r.x = (U1*G)+(U2*P)

which is equivalent to:

r.x = (U1+U2*d)*G

In my case:

k = d*b+a == k = U2*d+U1 == U1 = (z/s) and U2 = (r/s)

So please help me understand why can't i get my values back.

  • $\begingroup$ I don't know why you did not selected a uniform random $k$. It is crucial part of security and even tiny bias can break this. Moreover, the are not the $a$ and $b$ that you used. The $a$ and $b$., stated as $u_1$ and $u_2$ in Wikipeida, is used to verify the signature. My advice, do not arbitrarily rename the variables and keep to be consistent with one site. Plus, you did not check that $r=0$ condition and moreover, your $an$ and $bn$ need modulus since we are in $p \bmod n$. $\endgroup$
    – kelalaka
    Oct 30, 2023 at 8:09


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.