3
1
I am trying to find resources in previous malleability posts, but couldn't find derivations/proofs of this fact or how the exact low-s value is derived. Any pointers would greatly appreciated.
In ECDSA, why is (r,−s mod n) complementary to (r, s)?
Answers
3
ECDSA signatures are pairs (r,s) such that r = x(m/sG + r/sP) mod n, where P is the public key and m is the message digest. x() in that equation means "the X coordinate of".
In that equation, if you substitute s = -s', you get *r = x(m/(-s')*G + r/(-s)P) mod n, or *r = x(-(m/s'*G + r/s'P)).
However, it is true that for any point Q, x(Q) = x(-Q), as negating a point only affects the Y coordinate. Thus, *r = x(m/s'*G + r/s'P) mod n, or (r,s') is valid signature whenever (r,s) is.
Thank you very much. I understand negating a scalar over ff, but not why that negated scalar point will result in a point with the same x-coord as scalar point. – James C. – 2019-01-05T22:31:49.293