# Can a message hash be recovered from a signature?

A message can be signed and its signing public key recovered given the signature and message hash...

`signature = web3.personal.sign(<account>,<message hash>)`

`pubKey = web3.personal.ecRecover(<message hash>, <signature>)`

Is there a way of recovering the message hash given a signature and public key?

## 1 Answer

No, you cannot recover the message hash from an ECDSA signature. The siagnture is calculated by generating `(x, y) = kG` where `k` is the secret nonce and `G` is the generator for the curve. Then `r = x` and `s = k^(-1)(z + rd)` where `z` is the message and `d` is the private key. We can retrieve the public key `dG` by seeing that `r^(-1) (kGs - zG) = dG`. But trying to do the same for `z` will only ever result in `zG`, since we do not know `k`, only `kG`. Finding `z` given `zG` is exactly the DLP on the elliptic curve and is not feasible to compute.

Edit 2: It should be noted that while computing the message hash is infeasible, it is possible to check guesses, if the message was not salted before hashing (which it usually isn't). So if the message comes from a small set of possibilities then it can be recovered.

Edit: links for further reading

https://en.m.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm

https://crypto.stackexchange.com/questions/18105/how-does-recovering-the-public-key-from-an-ecdsa-signature-work

• Can you please provide a link for this? I posted an answer here which said the same but without this level of detail. I'm interested in reading more around this. Thanks. – Malone Nov 12 '17 at 23:31