I'm trying to understand the process of ECDSA signing. I already figured out the process of generating a public key out of a private key by multiplying the private key with G.

The equation for ECDSA signing is as follows: $S = k^{-1} (\text{hash} + dA * R) \pmod p$. What I'm trying to understand is the process of multiplying $dA$ (my private key) by $R$ ($x$ of public key generated from random private key). Is it a "simple" multiplication (such as 5*5 = 25) or the same way we multiply $k$ by $G$ to generate a public key?

  • $\begingroup$ The public key is G added to itself repeatedly, with the number of G in the sum defined by the private key (and a speedup method for large number), which IMHO is more multiplying G by the private key than it is "multiplying the private key with G". $\endgroup$ – fgrieu Jan 11 '18 at 11:11
  • $\begingroup$ @fgrieu: point multiplication is used for Q and R, but not S. $\endgroup$ – dave_thompson_085 Jan 12 '18 at 4:37
  • $\begingroup$ @dave_thompson_085: yes; I was criticizing the vocabulary used in the question's first sentence. $\endgroup$ – fgrieu Jan 12 '18 at 8:57

Is it a "simple" multiplication (such as 5*5 = 10) or the same way we multiply k by G to generate a public key?

It's multiplication modulo the curve order. For example, if dA = 9, R = 7 and p = 13, then dA * R = 9 * 7 mod 13 = 63 mod 13 = 11.

| improve this answer | |
  • $\begingroup$ Conventionally we use n for the order of the group = order of G on the curve, and p for the modulus of the underlying field if $F_p$ (and occasionally the reducing polynomial if $F_{2^m}$). These are not the same, although for cofactor 1 (common for ECDSA as used, like Suite B and Bitcoin) they are close due to Hasse. $\endgroup$ – dave_thompson_085 Jan 12 '18 at 4:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.