โœ๏ธ ECDSA: How Bitcoin Signs Transactions

Understand the Elliptic Curve Digital Signature Algorithm powering crypto

โ†
Previous
How ECC Works

โœ๏ธ ECDSA Digital Signatures

ECDSA (Elliptic Curve Digital Signature Algorithm) proves you authorized a transaction without revealing your private key!

๐ŸŽฏ What Are Digital Signatures?

Think of a digital signature like a handwritten signature, but mathematically provable:

โœ๏ธ Traditional Signature:
  • โ€ขCan be forged with practice
  • โ€ขSame signature every time
  • โ€ขCan be copied to other documents
๐Ÿ” ECDSA Signature:
  • โ€ขMathematically impossible to forge
  • โ€ขDifferent for every message
  • โ€ขTied to specific message (can't copy)

๐ŸŽฎ Interactive: Sign a Message

In real life, this is a 256-bit number kept secret!

๐Ÿ” Signature Verification

Anyone can verify your signature using only your public key (no access to private key needed):

Verification Steps:
1.
Compute w = sโปยน

Modular inverse of s

2.
Compute uโ‚ = ew and uโ‚‚ = rw

Two scalar values from message hash and signature

3.
Compute point: P = uโ‚G + uโ‚‚Q

Where Q is your public key

4.
Check if P.x = r

If x-coordinate matches r, signature is valid!

๐ŸŽฏ The Magic:

Verification works because of the mathematical relationship between your private key (d), public key (Q = dG), and the signature (r, s). Only someone with private key d could have created a valid signature!

โš ๏ธ Critical Security Rules

๐Ÿšจ
NEVER Reuse Nonce (k)

If you use the same k for two different messages, attackers can calculate your private key! This is how PlayStation 3 was hacked in 2010.

๐Ÿšจ
k Must Be Truly Random

Predictable k values can leak your private key. Use cryptographically secure random number generators!

๐Ÿšจ
Never Share Private Key

Your private key is like your password. If someone gets it, they can sign transactions as you!

๐Ÿ“š ECDSA Summary

Signing (Private):
  • โ€ข Requires: Private key (d)
  • โ€ข Inputs: Message + Random k
  • โ€ข Output: Signature (r, s)
  • โ€ข Purpose: Prove authorization
Verification (Public):
  • โ€ข Requires: Public key (Q)
  • โ€ข Inputs: Message + Signature (r, s)
  • โ€ข Output: Valid or Invalid
  • โ€ข Purpose: Confirm authenticity