1 Introduction

Preface blog:

ECDSA VS Schnorr signature VS BLS signature

ECDSA, the full name of Elliptic curve Digital Signature Algorithm, is a digital signature algorithm implemented by Elliptic curve cryptography.

Public and private key pair $(p k, P)$ , where the public key $GP=pk\times G$ ， $G$ is the base point of the selected elliptic curve. (elliptic curve base point: a point on the curve that generates a subgroup of large prime order $n$ 。 $n\times G=\mathcal{O}$ , $\mathcal{O}$ is the identity element。）

1.1 ECDSA signature

ECDSA message $The signature process of m$ is:

1) Calculate message Hash value of $m$ $e = ha s h (m)$ . (hashThe function can be SHA-2 and the output converted to a numeric value.)
2) If group order The bit length of $n$ $L_n$ , then take $e$ value leftmost $L_n$ Assign bits to $z$ 。 (note, $The z$ value can be smaller than $n$ is larger, but the bit length cannot be larger than $The length of n$ . )
3) Select random number $k\in_R [1,n-1]$ . (Note, do not trust general random number generators, because bad RNG has too many failures and vulnerabilities, you can useRFC6979according to $p k$ and $m$ to calculate deterministic $k$ . ) (For example: In August 2013, the Android Bit0coin wallet used an incorrect random number generator, causing the private key to be leaked, resulting in a loss of funds; in December 2010, the Sony PS3 game console incorrectly used static instead of random. $k$ value, causing its ECDSA private key to be leaked. )
4）计算curve point $(x_1,y_1)=k\times G$ 。
5) Calculate $r=x_1\mod n$ , if $r = 0$ , then jump and continue to step 3).
6) Calculate $ns=(z+r\cdot pk)/k \mod n$ , if $s = 0$ , then jump and continue to step 3).
7) The final signature is $(r, s)$ . (Note that $(r,-s\mod n)$ is also a valid signature. )
[According toBIP-62andEIP-2 in the signature can be $s$ value is constrained and $The s$ value is not higher than half of the curve order. 】

Throughout the ECDSA signature process, it is required:

$The k$ value should be secret.
Different signatures should choose different $k$ value, otherwise the private key $p k$ 。

1.2 ECDSA signature verification

For the received signature $(r, s)$ , using the public key $The process of P’s$ signature verification is:

1) Verify public key $P$ is not equal to identity element $\mathcal{O}$ , and its coordinates are valid.
2) Verify public key $P$ lies on the curve。
3) Verify public key $The order of P$ is $n$ ，即 $n\times P=\mathcal{O}$ 。
4) Verify signature $(r, s)$ is valid, that is, it satisfies $r\in [1,n-1],s\in [1,n-1]$ 。
5) Calculate message $The hash value of m$ and the function usedhashshould be consistent with the signature. $e = ha s h (m)$ 。
6) The leftmost $L_n$ $of e$ $L_{n}$ Assign bits to $z$ 。
7）计算 $u_1=z/s\mod n,u_2=r/s\mod n$ 。
8）计算curve point $(x_1,y_1)=u_1\times G+u_2\times P$ _ Waka $(x_1,y_1)=\mathcal{O}$ , the signature is invalid.
9）若 $r\equiv x_1(\mod n)$ is established, the signature is valid, otherwise the signature is invalid.

Note that the above ECDSA signature verification algorithm can be improved as follows:

Calculate only once $1/s\mod n$ 。
使用Shamir’s trick，a sum of two scalar multiplication $u_1\times G+u_2\times P$ can be calculated faster than two scalar multiplications done independently。（参考2014年论文《The Double-Base Number System in Elliptic Curve Cryptograhy》）

The general signature and verification process of ECDSA can be shown as follows:
insert image description here

1.3 ECDSA的public key recovery

ECDSA also supports the public key recovery algorithm, provided that the signer's public key or public key hash value is known in advance, otherwise incorrect public key information may be recovered.
insert image description here

Ethereum implements the ecrecover precompiled contract at address 0x01, and its function prototype is:

function ecrecover(bytes32 hash, bytes8 v, bytes32 r, bytes32 s) returns (address);

ecrecoverWill return the address obtained by calculating the ECDSA recovery function based on the given signature.
An example call in the solidity contract is:

function recoverSignerFromSignature(uint8 v, bytes32 r, bytes32 s, bytes32 hash) external {
    address signer = ecrecover(hash, v, r, s);
    require(signer != address(0), "ECDSA: invalid signature");
}

In an Ethereum transaction, the last 65 bytes are the ecdsa signature, in order:

32 bytes of $r$
32 bytes $s$
1 byte $v$ : where $v$ is the recovery identifier. According to the Ethereum Yellow Paper, $The value range of v$ is 27~30 (ie 0x1b~0x1e).

References

[1] What is ecrecover in Solidity?
[2] Ethereum Virtual Machine (EVM) ECRECOVER PRECOMPILED CONTRACT
[3] Ethereum Digital Signatures
[4] ECRecover and Signature Verification in Ethereum
[5] ECDSA Malleability
[6] Precompiled
[7] ECDSA: Elliptic Curve Signatures

Ethereum’s ecrecover precompiled contract

1 Introduction

1.1 ECDSA signature

1.2 ECDSA signature verification

1.3 ECDSA的public key recovery

References

Guess you like