<p>Bitcoin <em>transactions</em> use DER format for the signature (plus sighash byte), but bitcoin <em>messages</em> use 'plain' format (aka P1363, CVC, PKCS11, Microsoft, JWS and more) (plus recovery byte). The computation of the r,s <em>values</em> in an  ECDSA (which as Oscar correctly commented are <em>not</em> a point) is the same either way, but the data being signed for a message can never be the same as for a transaction so the signatures can never actually be the same value.</p>

<p>Your signature should not be and is not in DER format. The code you link to appears correct:</p>

<pre><code>    $signature = base64_decode($encodedSignature);

    $flag = hexdec(bin2hex(substr($signature, 0, 1)));

    $R = bin2hex(substr($signature, 1, 32));
    $S = bin2hex(substr($signature, 33));
</code></pre>

<p>That correctly parses a plain-format signature (not DER), from base64.</p>

<pre><code>    $derPubKey = Signature::getPubKeyWithRS($flag, $R, $S, $hash);
</code></pre>

<p>Without tracking down the code this calls, that looks like it should recover and encode the pubkey; whether it also verifies the signature is not obvious.</p>

CC BY-SA 4.0
2020-06-05T04:40:38.347Z
2020-06-05T04:40:38.347Z
dave_thompson_085
<p>this time is difficult for me to explain problem i was facing. i realize that R/S signature in DER signature is not match to the 1 in bitcoin signed message? Ok below is my say signed message.</p>

<pre><code>-----BEGIN BITCOIN SIGNED MESSAGE-----
c4ca4238a0b923820dcc509a6f75849b
-----BEGIN SIGNATURE-----
1BxqqjVC29fvCWin4qBuqZhBy4V7Ncdxby
        IPnTEOU713+XclrBrUEfTLeP0A7QIR4lObzQjBjyxGQExPwkalrQK1JOggIWk4xrfWIjHEC0RKGv3vtguDfto0o=
-----END BITCOIN SIGNED MESSAGE-----
</code></pre>

<p>my working way is $decoded_content = bin2hex(base64_decode(IPnTEOU713+XclrBrUEfTLeP0A7QIR4lObzQjBjyxGQExPwkalrQK1JOggIWk4xrfWIjHEC0RKGv3vtguDfto0o=))</p>

<p>then i manage to get R/S signature from $decoded_content. after that, i use R/S signature to generate DER signature. I realized that this DER signature is fail in signature verification. </p>

<p>shortly to say,</p>

<p>my program check valid signature using function in <a href="https://github.com/tuaris/CryptoCurrencyPHP/blob/master/Wallet.class.php#L225" rel="nofollow noreferrer">https://github.com/tuaris/CryptoCurrencyPHP/blob/master/Wallet.class.php#L225</a></p>

<p>if another party send me DER signature, how do i convert it into base64_encoded string? so end up i am able to use function i mention just now.</p>

<p>I try alot of methods but no luck, are R/S signature in both signed message and DER signature means to same?</p>

<p>please help</p>

CC BY-SA 4.0
2020-06-03T20:09:21.853Z
r and s are not points. They both are the signature, but not a point on the curve. r, however, is the x coordinate of the point R which calculated like this:  (z/s)G + (r/s)P = kG = R. G is the originator point of the secp256k1, P is the public key point on the curve. z is the signature hash of the transaction, and k is a "random" value to generate the signature (in reality k is deterministic).
Oscar Serna
<signature><message-signing><message-verification>
Relationship of R/S signature in between signed message and DER signature
Atlas Chiew
# Relationship of R/S signature in between signed message and DER signature

(Asked by: username_0 on 2020-06-03)

this time is difficult for me to explain problem i was facing. i realize that R/S signature in DER signature is not match to the 1 in bitcoin signed message? Ok below is my say signed message.

```
-----BEGIN BITCOIN SIGNED MESSAGE-----
c4ca4238a0b923820dcc509a6f75849b
-----BEGIN SIGNATURE-----
1BxqqjVC29fvCWin4qBuqZhBy4V7Ncdxby
        IPnTEOU713+XclrBrUEfTLeP0A7QIR4lObzQjBjyxGQExPwkalrQK1JOggIWk4xrfWIjHEC0RKGv3vtguDfto0o=
-----END BITCOIN SIGNED MESSAGE-----

```

my working way is $decoded\_content = bin2hex(base64\_decode(IPnTEOU713+XclrBrUEfTLeP0A7QIR4lObzQjBjyxGQExPwkalrQK1JOggIWk4xrfWIjHEC0RKGv3vtguDfto0o=))

then i manage to get R/S signature from $decoded\_content. after that, i use R/S signature to generate DER signature. I realized that this DER signature is fail in signature verification.

shortly to say,

my program check valid signature using function in <https://github.com/tuaris/CryptoCurrencyPHP/blob/master/Wallet.class.php#L225>

if another party send me DER signature, how do i convert it into base64\_encoded string? so end up i am able to use function i mention just now.

I try alot of methods but no luck, are R/S signature in both signed message and DER signature means to same?

please help

**Tags:** signature, message-signing, message-verification

> **Comments:**
> **username_1**: r and s are not points. They both are the signature, but not a point on the curve. r, however, is the x coordinate of the point R which calculated like this:  (z/s)G + (r/s)P = kG = R. G is the originator point of the secp256k1, P is the public key point on the curve. z is the signature hash of the transaction, and k is a "random" value to generate the signature (in reality k is deterministic).  

---

## 1 answers

### Answer by username_2 on 2020-06-05. Score: 2 | Accepted answer

Bitcoin *transactions* use DER format for the signature (plus sighash byte), but bitcoin *messages* use 'plain' format (aka P1363, CVC, PKCS11, Microsoft, JWS and more) (plus recovery byte). The computation of the r,s *values* in an ECDSA (which as username_1 correctly commented are *not* a point) is the same either way, but the data being signed for a message can never be the same as for a transaction so the signatures can never actually be the same value.

Your signature should not be and is not in DER format. The code you link to appears correct:

```
    $signature = base64_decode($encodedSignature);

    $flag = hexdec(bin2hex(substr($signature, 0, 1)));

    $R = bin2hex(substr($signature, 1, 32));
    $S = bin2hex(substr($signature, 33));

```

That correctly parses a plain-format signature (not DER), from base64.

```
    $derPubKey = Signature::getPubKeyWithRS($flag, $R, $S, $hash);

```

Without tracking down the code this calls, that looks like it should recover and encode the pubkey; whether it also verifies the signature is not obvious.


---

