0

This question already has an answer here:

In ECDSA, both signature(r,s) and (r,-s) are valid. However, in Bitcoin, it seems that the signature fails to be verified when s-part in the signature is bigger than half of the group order from this post https://bitcoin.stackexchange.com/questions/85946/low-s-value-in-bitcoin-signature I am wondering that if Ethereum is the same as Bitcoin. If yes, what is the reason that s needs to be a low-value?

|improve this question

marked as duplicate by Ismael, shane, Richard Horrocks, Achala Dissanayake, Linmao Song Jun 25 at 11:51

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1

Ethereum has had this requirement since the homestead hard fork. This requirement was introduced as part of EIP-2 (see point 2 of https://github.com/ethereum/EIPs/blob/master/EIPS/eip-2.md#specification)

Rather than me repeat what others have already answered, here is an answer which explains concisely why the low s requirement is needed: https://bitcoin.stackexchange.com/a/38253

|improve this answer
  • thanks! it's helpful. – tyyen May 10 at 6:19
  • Could you mark it as the answer if you're happy with it? Thanks @tyyen – Zekik64 May 13 at 8:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.