0

In ECDSA, both signature(r,s) and (r,-s) are valid. However, in Bitcoin, it seems that the signature fails to be verified when s-part in the signature is bigger than half of the group order from this post https://bitcoin.stackexchange.com/questions/85946/low-s-value-in-bitcoin-signature I am wondering that if Ethereum is the same as Bitcoin. If yes, what is the reason that s needs to be a low-value?

| improve this question | |
1

Ethereum has had this requirement since the homestead hard fork. This requirement was introduced as part of EIP-2 (see point 2 of https://github.com/ethereum/EIPs/blob/master/EIPS/eip-2.md#specification)

Rather than me repeat what others have already answered, here is an answer which explains concisely why the low s requirement is needed: https://bitcoin.stackexchange.com/a/38253

| improve this answer | |
  • thanks! it's helpful. – tyyen May 10 '19 at 6:19
  • Could you mark it as the answer if you're happy with it? Thanks @tyyen – Zekik64 May 13 '19 at 8:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.