Score:0

Can form of elliptic curve digital signature equation be simpler?

cn flag

I am curious why equations for signing/validating with ECDSA have forms they have. Is it possible to use simpler equation that have same properties.

For example, this is an equation I found in the book on Bitcoin:

$$ s = (z + re)/k $$ where,

$r = x\_coordinate\_of(k \cdot G)$,

$e$ - private key,

$z$ - message hash,

$k$ - random number,

$(s, r)$ - signature

What is interesting is that original paper for ECDSA uses a little bit different formula:

$$ s = k / (z + re) $$

Question

But is it possible to use something even simpler? For example:

$$ s = k/ze $$

And then we can check on validation that next equation holds:

$$ s \cdot z \cdot P = r, $$ where $P = e \cdot G$ is public key.

Why do we need to incorporate $r$ in the formula? And why it should be incorporated via addition, but not multiplication, for example?

Mark avatar
ng flag
you've posted your question on [math.se](https://math.stackexchange.com/questions/4454500/can-form-of-elliptic-curve-digital-signature-equation-be-simpler/4457415#4457415) as well. I can't remember the standard spiel regarding this, but I believe it is discouraged.
kelalaka avatar
in flag
I’m voting to close this question because it was cross-posted and had answer other site, too.
kelalaka avatar
in flag
@Mark https://meta.stackexchange.com/questions/64068/is-cross-posting-a-question-on-multiple-stack-exchange-sites-permitted-if-the-qu
au flag
Maybe you want to have a look at korean ECDSA, a.k.a. EC-KCDSA.
kelalaka avatar
in flag
Forget ECDSA if you want to use it, use [deterministic ECDSA](https://www.rfc-editor.org/rfc/rfc6979) which is free from the biased nonce attacks ( coins use it now). And, Curveball ise [here](https://crypto.stackexchange.com/q/83308/18298) in details.
Score:3
ru flag

The issue here is that knowledge of the private key would not be necessary to produce signatures. In other words, forgeries would be trivial to produce.

If the verification process is $$\mathrm{x\_coordinate}(szP)=r$$ then I can simply choose any value of $s$, compute the RHS and claim that as the $r$ value for my signature. Note that knowledge of $e$ was not used.

Similarly, if the verification process is $$\mathrm{x\_coordinate}(srzP)=r$$ I can choose any value of $t$, compute $tzP$ and select the $x$-coordinate for $r$ then set $s=t/r$.

By not including both $G$ and $P$ in the verification process, you essentially remove any dependence on $e$. Similar issues arise with the curveball vulnerability.

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.