ECDSA signature

ECDSA is how Bitcoin and pre-Taproot Ethereum prove ownership of funds: the holder of a private key produces a signature (r, s) over a message hash, and anyone can verify it against the public key without ever learning the key. It is the elliptic-curve analogue of the older DSA.

To sign a hash z with private key d: choose a random per-signature nonce k in [1, n−1], compute the point kG, set r = (kG).x mod n, then s = k^(−1)·(z + r·d) mod n; the signature is (r, s). To verify against public key Q = dG: compute u1 = z·s^(−1), u2 = r·s^(−1), and check that (u1·G + u2·Q).x mod n equals r. Ethereum bundles a recovery id v with (r, s) so the ecrecover precompile can recover the signer's address directly from the signature.

Two infamous pitfalls dominate ECDSA's security. First, the nonce k must be uniformly random and never reused: two signatures sharing a k (or even a slightly biased k) let an attacker solve for the private key with simple algebra — this is how the Sony PlayStation 3 signing key leaked and how many wallets have been drained. Second, malleability: both (r, s) and (r, n−s) are valid signatures, so the signature — and therefore a Bitcoin transaction ID derived from it — can be altered without the key; Bitcoin's low-s rule (BIP-62) and SegWit fixed this.