This question already has an answer here:


$eG=P$, $kG=(r,y)$

ECDSA signature transmits (r,s) and does this calculation:

$u = \frac{z}{s}$, $v = \frac{r}{s}$

$uG+vP=(r,y)$ means the signature is valid

Why do we transmit $s$ and not $s^{-1}$?

Currently, $s=\frac{z+re}{k}$, why not $s=\frac{k}{z+re}$? The equations would all go through:

$u=zs$, $v=rs$


Given that finding the inverse is very expensive computationally, what are we gaining by transmitting $s$ instead of $s^{-1}$?


marked as duplicate by CodesInChaos Jun 27 '18 at 16:10

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.