2
$\begingroup$

After going through the mathematical proof in confirming ECDSA, it doesn't seem apparent to me that "R" is necessary in calculating "S" for the signature.

In other words, what's the problem with using the following equation to calculate "S", $S = \frac{z + dA}{k}$

Let me explain in more detail... a few of the proofs I've found online use the following logic:

In creating the signature, the following equation is used to calculate S.

1) $S = \frac{z + dA(R)}{k}$ where k is random number, z is hash digest, dA is private key, R is x1 of P(x1,y1) = k (G), & G is base point.

In confirming the signature the following equation is used:

2) $P(x_1,y_1) = \frac{(z)(G) + R(Qa)}{S}$ where Qa is public key and R is x1 of P(x1,y1)

The proof that I found states the following. Since we are interested in using eq #2 to calculate D which equals (k)(G) where D is x1 and Qa = (dA)(G) then we can re-write equation #2 as the following:

$(k)(G) = \frac{(z)(G) + (R)(dA)(G)}{S}$ which can be reduced to the following:

$(S)(G) = \frac{(z + (R)(dA))*G}{k}$which is the same as

$S = \frac{z + (R)(dA)}{k}$ which is the same equation as equation #1.

In calculating S to create the signature, couldn't we also just use the following equation: $S = \frac{z + dA}{k}$ where the "R" is omitted? If you re-do the above proof it works without multiplying dA by "R" assuming you also omit "R" form Equation #2 to confirm the signature. The benefit or necessity of multiplying dA by "R" to calculate "S" is not apparent to me.

Thank you!

$\endgroup$
  • $\begingroup$ Kudos for the improved form! If time/motivation allows, you might want to improve to the point where your equation 1 becomes$$S = k^{-1}(z + d_A\,R)\bmod n\tag{1}$$ where $n$ is the order of $G$ (use right-click then show math as TeX commands to see the internals). It is not standard to use $\frac x k$ to denote multiplication of $x$ by the modular inverse of $k$ (as is the case here). Perhaps: use e.g. $\times$ to denote Elliptic Point multiplication, that helps to distinguish that from modular multiplication; and use $Q_A$ rather than $Q_a$ if you keep $d_A$. $\endgroup$ – fgrieu Sep 10 '18 at 6:07
  • $\begingroup$ I need to start using latex more frequently....I like it. $\endgroup$ – Ryan Laterza MD Sep 10 '18 at 6:20
  • $\begingroup$ My math skills are a bit rusty from my engineering days... you'll have to excuse me. $\endgroup$ – Ryan Laterza MD Sep 10 '18 at 6:20
  • 1
    $\begingroup$ if the signature was verified with the equation $$R = S^{-1}(z\times G+Q_A)$$ the adversary could easily determine whatever $R$ and $S$ is necessary to satisfy this equation if they knew the public key $Q_A$ and the hash digest $z$. $\endgroup$ – Ryan Laterza MD Sep 10 '18 at 7:56
  • 1
    $\begingroup$ Having $R \times Q_A$ in the standard equation: $R=S^{-1}(z \times G + R \times Q_A)$ is a one-way function in the numerator making it difficult for them to determine the $R$ value needed to solve the equation unless they knew the private key and could also calculate $S$. $\endgroup$ – Ryan Laterza MD Sep 10 '18 at 8:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.