<p>In DER-encoded signatures, the <em>r</em> and <em>s</em> values need to be prepended with 0x00 only if they start with the byte 0x80 or higher (i.e. have their first bit set). The <em>r</em>-value of the first signature starts with 0x02, so it doesn't need the extra byte.</p>
<p>This is unrelated to elliptic curve points falling above or below the X axis because 1. point coordinates on the secp256k1 curve are integers modulo <em>p</em> so they cannot be negative, and 2. because <em>p</em> is slightly less than 2<sup>256</sup> there are <em>r</em> and <em>s</em> values that fall into the upper half of the range but start with the byte 0x79.</p>

CC BY-SA 4.0
2024-03-07T08:13:22.347Z
Clearly the first sentence of my question was a lie - I need to do more study. Given what you mentioned about points on the curve being modulo p therefore they can't be negative, then how do we distinguish points above and below the x axis if not by calling them positive or negative?
user2334659
CC BY-SA 4.0
2024-03-14T07:29:12.273Z
In elliptic curves over finite fields there simply aren't any points below the X axis. The point coordinates can only take values between 0 (inclusive) and _p_ (exclusive).
Vojtěch Strnad
CC BY-SA 4.0
2024-03-06T05:12:15.377Z
2024-03-06T05:12:15.377Z
Vojtěch Strnad
<p>I have a conceptual understanding of the R value in so far as it can fall either above or below the X axis in the elliptical curve and that positive R values use an extra byte in the signature to indicate that they are in fact positive R values. I am trying to look at transactions to try and get my head around this in practice. For example:</p>
<p>TXID: 4a8f2d489008f60c7d02526b5f264ae70c465e1ea4fe710243f04ca6b1e3b103</p>
<pre><code>ScriptSig:
OP_PUSHBYTES_71 304402200222918fd7512cd5ecbdfda82dd48cb57677b5b6d42e17b5505fe2f2873d9651022032aab83fece0a48a338e8c003e2907fcd3d2a8798f16ddb5b206351452189cee01
OP_PUSHBYTES_33 034607e699d21f3a4b0c0523869eb185ba23a40a2ffaefe1c567b3b7a6eeb43026
</code></pre>
<p>Versus</p>
<p>TXID: 4247bbae1e7d08ed31aee8fc1f65bf4dc7411fe7ff5f64d2d7d0f4ad3117c148</p>
<pre><code>ScriptSig
OP_PUSHBYTES_72 3045022100ba76172000fa3c943a714b1152dc370060805b1cc8cbbd466710325e5874bfc002203e57b406e6af2f52ded43a45bfcb8402acff88f752a5806612bbbc3e80c49c1601
OP_PUSHBYTES_33 023ac3778b0e613501c0469c3232a0b3ff62e53b9849c891c446c44cffa74dd8ce
</code></pre>
<p>Does this mean that because the signature is only 71 bytes in the first transaction (as opposed to 72 in the second) that the R value for the first signature would be negative?</p>

<signature><ecdsa><elliptic-curve>
Low vs High R value signatures
user2334659
# Low vs High R value signatures

(Asked by: username_0 on 2024-03-06)

I have a conceptual understanding of the R value in so far as it can fall either above or below the X axis in the elliptical curve and that positive R values use an extra byte in the signature to indicate that they are in fact positive R values. I am trying to look at transactions to try and get my head around this in practice. For example:

TXID: 4a8f2d489008f60c7d02526b5f264ae70c465e1ea4fe710243f04ca6b1e3b103

```
ScriptSig:
OP_PUSHBYTES_71 304402200222918fd7512cd5ecbdfda82dd48cb57677b5b6d42e17b5505fe2f2873d9651022032aab83fece0a48a338e8c003e2907fcd3d2a8798f16ddb5b206351452189cee01
OP_PUSHBYTES_33 034607e699d21f3a4b0c0523869eb185ba23a40a2ffaefe1c567b3b7a6eeb43026

```

Versus

TXID: 4247bbae1e7d08ed31aee8fc1f65bf4dc7411fe7ff5f64d2d7d0f4ad3117c148

```
ScriptSig
OP_PUSHBYTES_72 3045022100ba76172000fa3c943a714b1152dc370060805b1cc8cbbd466710325e5874bfc002203e57b406e6af2f52ded43a45bfcb8402acff88f752a5806612bbbc3e80c49c1601
OP_PUSHBYTES_33 023ac3778b0e613501c0469c3232a0b3ff62e53b9849c891c446c44cffa74dd8ce

```

Does this mean that because the signature is only 71 bytes in the first transaction (as opposed to 72 in the second) that the R value for the first signature would be negative?

**Tags:** signature, ecdsa, elliptic-curve


---

## 1 answers

### Answer by username_1 on 2024-03-06. Score: 2

In DER-encoded signatures, the *r* and *s* values need to be prepended with 0x00 only if they start with the byte 0x80 or higher (i.e. have their first bit set). The *r*-value of the first signature starts with 0x02, so it doesn't need the extra byte.

This is unrelated to elliptic curve points falling above or below the X axis because 1. point coordinates on the secp256k1 curve are integers modulo *p* so they cannot be negative, and 2. because *p* is slightly less than 2256 there are *r* and *s* values that fall into the upper half of the range but start with the byte 0x79.

> **Comments:**
> **username_0**: Clearly the first sentence of my question was a lie - I need to do more study. Given what you mentioned about points on the curve being modulo p therefore they can't be negative, then how do we distinguish points above and below the x axis if not by calling them positive or negative?  
> **username_1**: In elliptic curves over finite fields there simply aren't any points below the X axis. The point coordinates can only take values between 0 (inclusive) and _p_ (exclusive).  

---

