In the Yellow paper, appendix F "Signing Transactions", it says a valid signature must satisfy:
(281) 0 < s < secp256k1n ÷ 2 + 1
However, in both the cited paper here (ECDSA SIGNATURE VERIFICATION heading) and
wikipedia, it is said that
s must be verified to be in
[1, n-1], which is understandable given that they are results of a modulo n operation.
So why does Ethereum restrict
s to only half of its usual range?
And how should a wallet proceed if a signature it generates contains an invalid
s as per the paper? Generating a new one with different
Edit 1: Not Duplicate clarification
I honestly can't see how this question is a duplicate of the linked question, but here goes:
- This question is about
sin the signature triplet
(v, r, s), while the linked question is about
v, specifically the recovery id contained in
This question is about a validity check of
s, which is more restrictive than original ECDSA scheme, whereas the linked question doesn't even have any mention about such check in both the question and accepted answer. In fact, the validity check in question requires
s < n/2 + 1, while the linked question's answer provided a sample code of how to produce recovery id in the case
s > n/2(quoted below), which suggests the validity check in question does not apply, because otherwise such code would be pointless.
if (s > curve.n / 2) id = id ^ 1; // Invert id if s of signature is over half the n