Using the terminology of https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm

Why is the second part of the ECDSA signature defined as:

$s = k^{-1}(z+rd_A)\text{ mod n}$

Could the scheme not work just as well without multiplying $d_A$ by $r$?

In other words we would have:

$s = k^{-1}(z+d_A)\text{ mod n}$

  • 1
    $\begingroup$ Hint: how would you proceed with verification of a signature? $\endgroup$ – fgrieu Feb 25 '19 at 15:12
  • $\begingroup$ (again using terminology of wikipedia) would just define $u_2 = w$ (instead of $u_2 = rw$) and should work no? $\endgroup$ – Yoni Berger Feb 26 '19 at 7:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.