/tags/ecdsa/ Recent content in ECDSA on truegav Hugo en-us Wed, 10 Apr 2024 14:00:00 +0530 /posts/every-signature-has-a-twin/ Wed, 10 Apr 2024 14:00:00 +0530 /posts/every-signature-has-a-twin/ <h2 id="the-sibling">The sibling</h2> <p>Every ECDSA signature <code>(r, s, v)</code> possesses an identical twin <code>(r, n - s, v XOR 1)</code>. Same private key signed both. Same message was hashed. <code>ecrecover</code> returns the identical address for both. Your protocol processes them as distinct authorizations because the raw bytes differ.</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python"><span class="line"><span class="cl"><span class="n">r</span><span class="p">,</span> <span class="n">s</span><span class="p">,</span> <span class="n">v</span> <span class="o">=</span> <span class="n">original_sig</span> </span></span><span class="line"><span class="cl"><span class="n">s2</span> <span class="o">=</span> <span class="p">(</span><span class="o">-</span><span class="n">s</span><span class="p">)</span> <span class="o">%</span> <span class="n">SECP256K1_ORDER</span> </span></span><span class="line"><span class="cl"><span class="n">v2</span> <span class="o">=</span> <span class="n">v</span> <span class="o">^</span> <span class="mi">1</span> </span></span><span class="line"><span class="cl"><span class="c1"># (r, s2, v2) recovers to the same address</span> </span></span></code></pre></div><p>The secp256k1 curve is symmetric. For every valid point <code>(x, y)</code> that exists on the curve, <code>(x, -y)</code> also exists. The <code>s</code> component of the signature encodes which y-coordinate was selected during the signing process. Flip <code>s</code> modulo the curve order and flip the parity bit in <code>v</code>. You have now manufactured a second, completely valid, cryptographically indistinguishable signature for the identical message from the identical key. You never touched the private key. You performed modular arithmetic that a motivated fourteen year old could execute.</p>