<p>A digital signature scheme, like ECDSA, is formally defined as a collection of three algorithms:</p>
<ul>
<li>A <em>key generation</em> algorithm which creates a (private key, public key) pair.</li>
<li>A <em>signing</em> algorithm which given a message and a private key, computes a signature.</li>
<li>A <em>verification</em> algorithm which given a message and a public key, verifies that the signature was created by the corresponding private key.</li>
</ul>
<p>These three algorithms are used at distinct times in the lifetime of a Bitcoin transaction:</p>
<ul>
<li>The <strong>ECDSA key generation algorithm</strong> (*) is used when a receiver wants to create an address. The private and public key are stored in the wallet, and the public key is transformed into an address, which is then handed to the sender. The sender then constructs a transaction crediting that address.</li>
<li>When the receiver wants to spend the received coins, they need to construct a transaction which &quot;redeems&quot; them. This involves the <strong>ECDSA signing algorithm</strong> to authorize the transaction to spend those coins, showing the owner of the coins consents to it.</li>
<li>When that transactions is broadcast to the network, Bitcoin nodes and wallets will verify the transaction, as invalid transactions are not allowed. This involves the use of the <strong>ECDSA verification algorithm</strong>.</li>
</ul>
<p>So to answer your question: it depends which algorithm you're talking about. The key generation algorithm is used once per address. The signing algorithm is used once per transaction input. The verification algorithm is performed by <em>every node</em> once for every transaction input.</p>
<p>(*) = In modern Bitcoin wallets, the addresses are not actually randomly generated anymore, but derived from a seed instead. This could be seen as choosing to use a distinct, but compatible, key generation algorithm. It's also worth noting that key generation for ECDSA isn't actually ECDSA-specific, as every 256-bit number is a valid private key, and the conversion algorithm from private key to public key is (mostly) shared across all EC-based algorithms (e.g. it is compatible with BIP340 Schnorr signatures, and the ECDH key agreement protocol).</p>

CC BY-SA 4.0
2022-02-04T22:32:31.257Z
Ah! I didn't realise it was three separate algorithms under the ECDSA name. Thank you! And your clarification at the end was extremely helpful :)
compp
CC BY-SA 4.0
2022-02-04T22:29:13.480Z
2022-02-04T22:33:30.060Z
2022-02-04T22:33:30.060Z
Pieter Wuille
<p>I'm currently a little confused about where exactly ECDSA is used in the transaction process... some resources seem to say it's used once, whereas others seem to say it's used three times.</p>
<p>Which is correct here?</p>
<p>A:
ECDSA is just used to generate the public key, which is then used in the creation of the digital signature (thus ECDSA is indirectly used to create the signature). Verification then only requires the public key of the recipient.</p>
<p>or, B:
ECDSA is used to generate the public key, then again to create the digital signature together with the public key and some hashing, then a third time to verify the signature.</p>
<p>I don't have a programming / computer science background, so am looking for a general description of the process as opposed to a code-based explanation (although if it really helps clarify, I don't mind!). I do know the basics of how ECDSA works.</p>

<hash><public-key><signature><transaction-verification><ecdsa>
How many times and where exactly is ECDSA used in Bitcoin?
compp
# How many times and where exactly is ECDSA used in Bitcoin?

(Asked by: username_0 on 2022-02-04)

I'm currently a little confused about where exactly ECDSA is used in the transaction process... some resources seem to say it's used once, whereas others seem to say it's used three times.

Which is correct here?

A:
ECDSA is just used to generate the public key, which is then used in the creation of the digital signature (thus ECDSA is indirectly used to create the signature). Verification then only requires the public key of the recipient.

or, B:
ECDSA is used to generate the public key, then again to create the digital signature together with the public key and some hashing, then a third time to verify the signature.

I don't have a programming / computer science background, so am looking for a general description of the process as opposed to a code-based explanation (although if it really helps clarify, I don't mind!). I do know the basics of how ECDSA works.

**Tags:** hash, public-key, signature, transaction-verification, ecdsa


---

## 1 answers

### Answer by username_1 on 2022-02-04. Score: 4 | Accepted answer

A digital signature scheme, like ECDSA, is formally defined as a collection of three algorithms:

* A *key generation* algorithm which creates a (private key, public key) pair.
* A *signing* algorithm which given a message and a private key, computes a signature.
* A *verification* algorithm which given a message and a public key, verifies that the signature was created by the corresponding private key.

These three algorithms are used at distinct times in the lifetime of a Bitcoin transaction:

* The **ECDSA key generation algorithm** (\*) is used when a receiver wants to create an address. The private and public key are stored in the wallet, and the public key is transformed into an address, which is then handed to the sender. The sender then constructs a transaction crediting that address.
* When the receiver wants to spend the received coins, they need to construct a transaction which "redeems" them. This involves the **ECDSA signing algorithm** to authorize the transaction to spend those coins, showing the owner of the coins consents to it.
* When that transactions is broadcast to the network, Bitcoin nodes and wallets will verify the transaction, as invalid transactions are not allowed. This involves the use of the **ECDSA verification algorithm**.

So to answer your question: it depends which algorithm you're talking about. The key generation algorithm is used once per address. The signing algorithm is used once per transaction input. The verification algorithm is performed by *every node* once for every transaction input.

(\*) = In modern Bitcoin wallets, the addresses are not actually randomly generated anymore, but derived from a seed instead. This could be seen as choosing to use a distinct, but compatible, key generation algorithm. It's also worth noting that key generation for ECDSA isn't actually ECDSA-specific, as every 256-bit number is a valid private key, and the conversion algorithm from private key to public key is (mostly) shared across all EC-based algorithms (e.g. it is compatible with BIP340 Schnorr signatures, and the ECDH key agreement protocol).

> **Comments:**
> **username_0**: Ah! I didn't realise it was three separate algorithms under the ECDSA name. Thank you! And your clarification at the end was extremely helpful :)  

---

