# Why doesn't the formula work when checking two ECDSA signatures?

There are two generated ECDSA signatures

X - Private key

S  = ((Z  + (X * R)) / K) mod n

S = ((Z + (X * R)) / K) mod n


G - Base point, of order n;

R  = K  * G
R = K * G


Why is this formula not working?

C = K - K

R = R + (C * G)


Where exactly do I make a mistake?

• I don't understand your question. I think these formulas are correct. So what? In what way are they “not working”? Feb 26, 2019 at 21:56

In ECDSA, the R value in the signature is not the elliptic curve point $$kG$$, but instead only its x-coordinate, that is, an integer.

So, what do you mean by R' + (C*G)? In particular, what do you mean by the operator +?

If you mean "the + is an integer modular addition, that is, we take the x-coordinate of the point $$CG$$, and then add it (modulo $$n$$) to $$R'$$", well, that'll give you an integer that's unrelated to $$R$$ (as $$R$$ and $$R'$$ are related as elliptic curve points not integers, and integer addition and elliptic curve operations have little to do with each other)

If you mean "the + is an elliptic curve addition, that is, we find one of the points with x-coordinate $$R'$$, and add it (using the elliptic curve addition operation) to the point $$C\cdot G$$), well, that'll work half the time; there are (usually) two elliptic curve points with x-coordinate $$R'$$, and it'll work if the one you pick just happens to be the original $$R'$$ point.

• Maybe I'm doing something wrong? For example, I want to take two ECDSA signatures: example Feb 26, 2019 at 23:22
• "I want to take two ECDSA signatures" and do what with them? Feb 26, 2019 at 23:50
• @IziTors: I believe you're being mislead by whatever software you are using; when it prints out a point (e.g. C*G), it lists it as a large integer. Actually, a point consists of both the X coordinate and a Y coordinate (as it is a solution to a specific cubic equation), and there's no obvious way to express both X and Y as a single integer. Feb 27, 2019 at 19:35

Are you sure you understand how ECDSA or ECC work in terms of operations? The * and + operations are not actually multiplication and addition (in the last 2 equations). They are the ECC trapdoor function. You can see an animation of such a function here (it should be a gif):

The * and + operations just mean applying the trapdoor function x times.

 R  = K  * G


Take the point G and apply the trapdoor function to it K times.

In ECC and ECDSA, a - operation (when refering to reversing the trapdoor function) is not possible in most scenarios, since that would mean reversing the trapdoor function, solving the Elliptic Curve Discrete Logarithm Porblem, making the cryptosystem obsolete (in most cases its not possible, but some attacks on weak curves exist).

You can find a bunch of python libraries to do these function multiplications like ECPy

• You can use a $-$, both on scalars and EC points. It is the discrete logarithm (the "division" of two points) that is intractable: "find $x$ given $X$,$G$ such that $X=x\cdot G$". Feb 27, 2019 at 13:17
• Yes, I meants doing a ‘-‘ operation on a point to reverse the trapdoor function and solve the ECDLP. Feb 27, 2019 at 13:19
• Read my example and after you understand how a "+" or "*" work in ECDSA, read the wikipedia page for ECDSA. That is why I posted it, trying to explain these operations. Feb 27, 2019 at 13:32
• Here, for example, in my example, I minus: K = 247441A043B4DFD16A39D3834C596B351D1C3337BB48DC8D1113E9CAB2DE53A0 K = F9A0A1E22636D8662957B3D62066F182CD1FA37D3457E423CFC8EDB58793DED0 C = K - K I receive: C = D52C6041E281F894BF1DE052D40D864DB0037045790F0796BEB503EAD4B58B30 Then I get (C * G) = DDAAE15676A86275A5D793E5435329C5C3DFE8782E8CB825ED0D0E46E7AA1533 Right? Feb 27, 2019 at 13:58
• @Tudor: I suggest that you fix "In ECC and ECDSA, a - operation is not possible..." which is untenable. What you appear to mean is that we can't divide by a point, e.g. compute R / G yielding K. Note that we can divide by a scalar, e.g. compute R / K yielding G (we can do this by computing the inverse of K modulo the order). Thus we can't say there is no /.
– fgrieu
Feb 27, 2019 at 14:23