I'm confused with the parameter $n$, whether the parameter $n$ is the support point FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F or what? for example I got

R =      0x00656073615d18ef82d884366dfcf8f84fd1a95ee7ae431ad8f23a30f7ecc5489c 
S =      0x00705324ea8a6f796c9c38df621ee07fd86515308a33e1f5acf2d6ae436c4a67ba 
Z =      0x00264e4672395b1fe67c9c6a6787ad69490585bc45ee7a046593620b1c0ccafb56 
PubKey = 0x0414aa791606c386003a5c3fbdf9c81f6fb1272597ed78f6524c79eee71112cbdb2ead122bd32427aa4f953324ce6b1eb6e83c3067b02cb8da0151b66e5c202188 

but I can't calculate value $K,N$ and $X$? I've tried many times but can't find the correct value?

Note on notation:

  • $X$ is the private key.
  • $Z$ is the hash of the message.
  • The rest follows standard notation.

1 Answer 1


As pointed out by the answer on Bitcoin.SE you don't calculate neither $N,K$ nor $X$.

$N$ is the order of the generator of the subgroup in which you perform ECDSA and is fixed for any given standard parameter set, such as secp256k1. That is, you use it as a constant just like you would use $a,b$ and $p$ of the parameter set as a constant. If you really wanted to compute it yourself, you have to use Schoof's algorithm, which however is really quite complex.

$K$ is a secret per-signed-message value, that you normally either generate uniformly at random from the range $[0,N)$ or use RFC 6979 to compute a value based upon your private key and the message and potentially some additional randomness. Note that given only a signature and other public information it is usually impossibly to infer $K$.

It appears that $X$ is supposed to be the private key of a given associated public key. Again $X$ is chosen uniformly at random from $[0,N)$ by the owner of the public / private key and it is in general impossible to recover $X$ given only public information, i.e. if you only know $R,S,N,Z$ and the public key, you can't infer $X$. However if you have a signature for which you know $K$ or a couple of signatures with non-uniform choice of $K$, then you can indeed infer $X$.

  • $\begingroup$ can help me sir for step by step ? I just started learning about ECDSA. i need teacher for helping me.. sorry for my bad english. i'm from indonesia. thanks help and best regards. @SEJPM $\endgroup$ Sep 14, 2018 at 13:22
  • $\begingroup$ @MasNdoloxz On the encoding of ECDSA signatures you may want to read this Q&A $\endgroup$
    – SEJPM
    Sep 14, 2018 at 13:45
  • $\begingroup$ @MasNdoloxz I can't help you outside of Crypto.SE but if you post other questions on the site, I'll do my best to clarify them for everyone involved so they can get answered, but please make less assumptions about variable-naming in the future if you can and formulate your question as clearly as you can. $\endgroup$
    – SEJPM
    Sep 14, 2018 at 13:55
  • $\begingroup$ Note bitcoin tweaks ECDSA by 'folding' S to be less than n/2; see bitcoin.stackexchange.com/questions/59820/… $\endgroup$ Sep 15, 2018 at 2:02
  • $\begingroup$ @SEJPM So this way, I actually have a private key. I just want to test it by finding the value of K and N ?? im still confused ... i'm try to calculate with [bitcoin.stackexchange.com/questions/25814/… . but this my test on 1 transaction $\endgroup$ Sep 18, 2018 at 7:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.