<p>Try applying <a href="https://en.wikipedia.org/wiki/Occam%27s_razor" rel="nofollow noreferrer">Occam's Razor</a>. People are storing immense wealth on the Bitcoin network. If it were possible to create a valid-appearing signature for a given message without knowing the private key, any attacker using this technique would be able to steal any funds in bitcoin at will.</p>
<p>Which is the more likely explanation: a) ECDSA is not susceptible to the attack you propose, or b) such an attack exists, knowledge is widespread enough that you can just ask on a Q&amp;A platform to learn about it, but people still keep piling more and more value into Bitcoin, and yet there are no reports of any thefts that fit the characteristics?</p>

CC BY-SA 4.0
2021-12-13T15:01:47.440Z
2021-12-14T03:05:13.600Z
2021-12-14T03:05:13.600Z
Murch
<p>To add to the other answers...</p>
<p>It is obvious that you can't actually forge a signature on a message of your choice, under a public key you don't own. Otherwise the signature scheme is broken and useless.</p>
<p>However, there are some things you <em>can</em> do with ECDSA.</p>
<p>Firstly, given a public key <code>Y</code> for which you do not know the secret, you can choose two random numbers <code>a,b</code> and compute <code>R = [a]G + [b]Y</code>. I'll denote the x-coordinate of <code>R</code> as <code>R.x</code>. Then let <code>s = R.x/b</code>, and you have a valid signature <code>(R.x, s)</code> under public key <code>Y</code> on a <code>z</code> value <code>z = R.x * a/b</code>. Obviously, though, you won't feasibly be able to find a preimage for <code>z</code> under SHA-256 or whichever hash function used, so you haven't really found the message itself, just the hash of it. That is why the hash function is an important part of the scheme, and why you can't trust signatures on random hashes. This was described by Pieter Wuille <a href="https://twitter.com/pwuille/status/1063582706288586752" rel="nofollow noreferrer">here</a>.</p>
<p>Secondly, given a valid signature <code>(R.x, s)</code> on a message under a public key <code>Y</code>, you can <em>malleate</em> that signature in certain ways so it is still valid but isn't the same as the original signature. The most obvious way to do this is by simply negating <code>s</code> modulo the order of <code>G</code>, because <code>(R.x, -s)</code> will also be a valid signature. <a href="https://github.com/bitcoin/bips/blob/master/bip-0066.mediawiki" rel="nofollow noreferrer">BIP-66</a> and <a href="https://github.com/bitcoin/bips/blob/master/bip-0141.mediawiki" rel="nofollow noreferrer">BIP-141</a> both discuss malleability of Bitcoin transaction signatures.</p>

CC BY-SA 4.0
2021-12-14T04:22:01.487Z
There is a generalization of the s negation: if you have a valid signature (r,s) for pubkey P and message z and r=R.x, then for every value `a`, if r'=(aR).x, it holds that (r',r's/(r'a)) is a valid signature for P and message hash z'=r'z/r. With a=-1 this gives the normal malleability formula. For other values of a, this gives signatures "valid" for message hash without known preimage.
Pieter Wuille
CC BY-SA 4.0
2021-12-13T22:13:30.317Z
2021-12-13T22:13:30.317Z
meshcollider
<p>When third party C wishes to forge A's signature and sign the message m with it, they should follow these steps.
First, it must select an integer k ∈ [1, n - 1] and compute the integer r, as described in the ECDSA algorithm.  Next, it must solve for s the parity s ≡ k − 1 (h (m) + xr) mod n.  However, to achieve this it is absolutely necessary to know the x and the discrete logarithm point Q based on the point P.</p>
<p>The hash function h must be one-way.  Alternatively, an attacking C user could forge a digital signature in the following way:
(A) User C selects an arbitrary integer l and calculates r from the x-coordinate of Q + lP (mod n).</p>
<p>(B) User C sets s = r and calculates e = rl (mod n).
If C can find the message m such that e = h (m), then (r, s) is a valid signature for m.  In addition, the hash function h must be free of coincidence.  Otherwise, user C is forged as follows:</p>
<p>(A) First finds two messages m and m ′ such that
h (m) =  h(m′).</p>
<p>(B)) Next, Ask user A to sign the message m and so this signature will be valid for m ′.</p>
<p>Your question is unclear.</p>

CC BY-SA 4.0
2021-12-13T12:07:55.243Z
2021-12-13T12:15:03.170Z
2021-12-13T12:15:03.170Z
Pegasus
<p>I want to forge a signature with a fixed z value, what is the formula to do that</p>

CC BY-SA 4.0
2021-12-13T07:19:44.067Z
Hi! What do you mean by the z value? Do you mean the hash of the message being signed? It would be helpful to have a bit more info
meshcollider
CC BY-SA 4.0
2021-12-13T08:17:33.717Z
Yes hash of the message being signed
Gwer
CC BY-SA 4.0
2021-12-13T10:00:09.073Z
And when you say "forge", do you want to forge a signature on a given `z` under a specific public key (for which you don't know the secret)? Or just create a signature under any key on that given `z`
meshcollider
CC BY-SA 4.0
2021-12-13T13:49:39.703Z
I think he wants to know if it is possible to forge a signature for a fixed z or double sha256 of the unsigned transaction, without knowing the private key.
T M
CC BY-SA 4.0
2021-12-13T14:48:06.730Z
To the best of my knowledge, the only way to produce a "forged" signature that passes basic scrutiny is to successfully guess the actual private key and sign the message…—@TM: You showed up as an "interpreter" both on that related question by Guest34122123 and now this one again. If you know these people, could you please explain to them that they're wasting our time, and perchance suggest that they come up with a more fruitful pastime?
Murch
<transactions><hash><signature><ecdsa>
How to forge a signature with fixed Z value
Gwer
# How to forge a signature with fixed Z value

(Asked by: username_0 on 2021-12-13)

I want to forge a signature with a fixed z value, what is the formula to do that

**Tags:** transactions, hash, signature, ecdsa

> **Comments:**
> **username_1**: Hi! What do you mean by the z value? Do you mean the hash of the message being signed? It would be helpful to have a bit more info  
> **username_0**: Yes hash of the message being signed  
> **username_1**: And when you say "forge", do you want to forge a signature on a given `z` under a specific public key (for which you don't know the secret)? Or just create a signature under any key on that given `z`  
> **username_2**: I think he wants to know if it is possible to forge a signature for a fixed z or double sha256 of the unsigned transaction, without knowing the private key.  
> **username_3**: To the best of my knowledge, the only way to produce a "forged" signature that passes basic scrutiny is to successfully guess the actual private key and sign the message…—@TM: You showed up as an "interpreter" both on that related question by Guest34122123 and now this one again. If you know these people, could you please explain to them that they're wasting our time, and perchance suggest that they come up with a more fruitful pastime?  

---

## 3 answers

### Answer by username_3 on 2021-12-13. Score: 3

Try applying [Occam's Razor](https://en.wikipedia.org/wiki/Occam%27s_razor). People are storing immense wealth on the Bitcoin network. If it were possible to create a valid-appearing signature for a given message without knowing the private key, any attacker using this technique would be able to steal any funds in bitcoin at will.

Which is the more likely explanation: a) ECDSA is not susceptible to the attack you propose, or b) such an attack exists, knowledge is widespread enough that you can just ask on a Q&A platform to learn about it, but people still keep piling more and more value into Bitcoin, and yet there are no reports of any thefts that fit the characteristics?


---

### Answer by username_1 on 2021-12-13. Score: 2

To add to the other answers...

It is obvious that you can't actually forge a signature on a message of your choice, under a public key you don't own. Otherwise the signature scheme is broken and useless.

However, there are some things you *can* do with ECDSA.

Firstly, given a public key `Y` for which you do not know the secret, you can choose two random numbers `a,b` and compute `R = [a]G + [b]Y`. I'll denote the x-coordinate of `R` as `R.x`. Then let `s = R.x/b`, and you have a valid signature `(R.x, s)` under public key `Y` on a `z` value `z = R.x * a/b`. Obviously, though, you won't feasibly be able to find a preimage for `z` under SHA-256 or whichever hash function used, so you haven't really found the message itself, just the hash of it. That is why the hash function is an important part of the scheme, and why you can't trust signatures on random hashes. This was described by username_4 username_4 [here](https://twitter.com/pwuille/status/1063582706288586752).

Secondly, given a valid signature `(R.x, s)` on a message under a public key `Y`, you can *malleate* that signature in certain ways so it is still valid but isn't the same as the original signature. The most obvious way to do this is by simply negating `s` modulo the order of `G`, because `(R.x, -s)` will also be a valid signature. [BIP-66](https://github.com/bitcoin/bips/blob/master/bip-0066.mediawiki) and [BIP-141](https://github.com/bitcoin/bips/blob/master/bip-0141.mediawiki) both discuss malleability of Bitcoin transaction signatures.

> **Comments:**
> **username_4**: There is a generalization of the s negation: if you have a valid signature (r,s) for pubkey P and message z and r=R.x, then for every value `a`, if r'=(aR).x, it holds that (r',r's/(r'a)) is a valid signature for P and message hash z'=r'z/r. With a=-1 this gives the normal malleability formula. For other values of a, this gives signatures "valid" for message hash without known preimage.  

---

### Answer by username_5 on 2021-12-13. Score: 1

When third party C wishes to forge A's signature and sign the message m with it, they should follow these steps.
First, it must select an integer k ∈ [1, n - 1] and compute the integer r, as described in the ECDSA algorithm. Next, it must solve for s the parity s ≡ k − 1 (h (m) + xr) mod n. However, to achieve this it is absolutely necessary to know the x and the discrete logarithm point Q based on the point P.

The hash function h must be one-way. Alternatively, an attacking C user could forge a digital signature in the following way:
(A) User C selects an arbitrary integer l and calculates r from the x-coordinate of Q + lP (mod n).

(B) User C sets s = r and calculates e = rl (mod n).
If C can find the message m such that e = h (m), then (r, s) is a valid signature for m. In addition, the hash function h must be free of coincidence. Otherwise, user C is forged as follows:

(A) First finds two messages m and m ′ such that
h (m) = h(m′).

(B)) Next, Ask user A to sign the message m and so this signature will be valid for m ′.

Your question is unclear.


---

