3
$\begingroup$

This question already has an answer here:

Given:

$eG=P$, $kG=(r,y)$

ECDSA signature transmits (r,s) and does this calculation:

$u = \frac{z}{s}$, $v = \frac{r}{s}$

$uG+vP=(r,y)$ means the signature is valid

Why do we transmit $s$ and not $s^{-1}$?

Currently, $s=\frac{z+re}{k}$, why not $s=\frac{k}{z+re}$? The equations would all go through:

$u=zs$, $v=rs$

$uG+vP=zsG+rsP=zsG+rseG=(zs+rse)G=s(z+re)G=\frac{k(z+re)}{z+re}G=kG=(r,y)$

Given that finding the inverse is very expensive computationally, what are we gaining by transmitting $s$ instead of $s^{-1}$?

$\endgroup$

marked as duplicate by CodesInChaos Jun 27 '18 at 16:10

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.