<blockquote>
  <p>What is the complement of s referring to?</p>
</blockquote>

<p>I haven't heard that term used like that before, but reading the code, it appears to compare <code>s</code> to see if it's more than <code>n/2</code> rounded down (where <code>n</code> is the order of the curve, <code>FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141</code>.)</p>

<p>If it is, it calculates <code>n - s</code> and uses that as <code>s</code>.</p>

CC BY-SA 3.0
2015-06-25T02:42:36.023Z
2015-06-25T02:42:36.023Z
Nick ODell
<p>In ECDSA <code>s</code> can be on either side of the curve and the signature will still be valid. The term "low <code>s</code>" is referring to the value literally being being below the curve order (<a href="https://www.wolframalpha.com/input/?i=0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D576E7357A4501DDFE92F46681B20A0" rel="noreferrer">0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D576E7357A4501DDFE92F46681B20A0</a>). The requirement of low-<code>s</code> is arbitrary (high <code>s</code> would have worked just fine as well), and is one of the new <a href="https://github.com/bitcoin/bips/blob/master/bip-0062.mediawiki#Low_S_values_in_signatures" rel="noreferrer">BIP62</a> validity rules that are intended to combat transaction malleability.</p>

<p>Absent this rule, any person is able to take a Bitcoin transaction, flip <code>s</code> in any of its signatures, and push the transaction out again with a different TXID. Being able to do this only changes the hash of the transaction, and does not alter its validity in any way. Being able to mutate transactions breaks a number of potentially interesting transaction types in Bitcoin like payment channels, where chains of transactions will suddenly be invalidated by a parent being mutated and an alternate form included in a block. </p>

<p>By forcing valid transactions to always have low <code>s</code> this ability is removed, though a person with the private key for a transaction is still able to mutate their own transactions by resigning them with a new nonce. </p>

CC BY-SA 3.0
2015-06-25T02:45:01.013Z
Fantastic! Can you write some pseudocode (or Python) which shows how to flip the s value? It's not just the negative value is it?
Wizard Of Ozzie
CC BY-SA 3.0
2015-06-25T04:46:41.900Z
The pseudocode is very simple:   `s2 = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141 - s1;`
amaclin
CC BY-SA 3.0
2015-06-25T05:14:43.817Z
@amaclin oh wow, so I was absolutely overthinking this. Of course, i see the logic to it now. Tangentially, why is [this](https://github.com/petertodd/python-bitcoinlib/blob/master/bitcoin/core/key.py%23L126-L156) code so *un-Pythonic*? Is it basically a Python "port" of the C++ code?
Wizard Of Ozzie
CC BY-SA 3.0
2015-06-25T20:12:05.010Z
`python-bitcoinlib` is unpythonic because it is emulating all of the structures that you find in Bitcoin Cores CPP codebase. You could make it more pythonic but it wouldn't be as useful that way.
Claris
CC BY-SA 3.0
2015-06-25T02:38:06.463Z
2015-06-25T02:45:49.957Z
2015-06-25T02:45:49.957Z
Claris
<p><a href="https://github.com/petertodd/python-bitcoinlib" rel="nofollow noreferrer">Bitcoinlib</a> refers to the requirement that if <code>s &gt; ORDER / 2</code>, then <a href="https://github.com/petertodd/python-bitcoinlib/blob/81ca8a3b8457e173c69c181afc4803f337d16fc3/bitcoin/core/script.py#L875" rel="nofollow noreferrer">the complement of <code>s</code> should be used instead since it's one byte shorter</a></p>

<p>This sounds like it's referring to the inverse or negative <code>s</code> value, but I also know complement can be a computer science term. </p>

<p>The relevant code can be found <a href="https://github.com/petertodd/python-bitcoinlib/blob/2b0c91a6e25cd8bd6dfa5b0a33e6f02807e554f3/bitcoin/core/key.py#L126-L156" rel="nofollow noreferrer">here</a> (perhaps someone adept with the Bitcoin Core code can chime in on what the code is doing), so, <strong>what is the complement of s referring to</strong>?</p>

<signature><ecdsa><python>
The complement of s (when s < curve order / 2)
Wizard Of Ozzie
# The complement of s (when s < curve order / 2)

(Asked by: username_0 on 2015-06-25)

[Bitcoinlib](https://github.com/petertodd/python-bitcoinlib) refers to the requirement that if `s > ORDER / 2`, then [the complement of `s` should be used instead since it's one byte shorter](https://github.com/petertodd/python-bitcoinlib/blob/81ca8a3b8457e173c69c181afc4803f337d16fc3/bitcoin/core/script.py#L875)

This sounds like it's referring to the inverse or negative `s` value, but I also know complement can be a computer science term.

The relevant code can be found [here](https://github.com/petertodd/python-bitcoinlib/blob/2b0c91a6e25cd8bd6dfa5b0a33e6f02807e554f3/bitcoin/core/key.py#L126-L156) (perhaps someone adept with the Bitcoin Core code can chime in on what the code is doing), so, **what is the complement of s referring to**?

**Tags:** signature, ecdsa, python


---

## 2 answers

### Answer by username_2 on 2015-06-25. Score: 5 | Accepted answer

In ECDSA `s` can be on either side of the curve and the signature will still be valid. The term "low `s`" is referring to the value literally being being below the curve order ([0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D576E7357A4501DDFE92F46681B20A0](https://www.wolframalpha.com/input/?i=0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D576E7357A4501DDFE92F46681B20A0)). The requirement of low-`s` is arbitrary (high `s` would have worked just fine as well), and is one of the new [BIP62](https://github.com/bitcoin/bips/blob/master/bip-0062.mediawiki#Low_S_values_in_signatures) validity rules that are intended to combat transaction malleability.

Absent this rule, any person is able to take a Bitcoin transaction, flip `s` in any of its signatures, and push the transaction out again with a different TXID. Being able to do this only changes the hash of the transaction, and does not alter its validity in any way. Being able to mutate transactions breaks a number of potentially interesting transaction types in Bitcoin like payment channels, where chains of transactions will suddenly be invalidated by a parent being mutated and an alternate form included in a block.

By forcing valid transactions to always have low `s` this ability is removed, though a person with the private key for a transaction is still able to mutate their own transactions by resigning them with a new nonce.

> **Comments:**
> **username_0**: Fantastic! Can you write some pseudocode (or Python) which shows how to flip the s value? It's not just the negative value is it?  
> **username_3**: The pseudocode is very simple:   `s2 = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141 - s1;`  
> **username_0**: @username_3 oh wow, so I was absolutely overthinking this. Of course, i see the logic to it now. Tangentially, why is [this](https://github.com/petertodd/python-bitcoinlib/blob/master/bitcoin/core/key.py%23L126-L156) code so *un-Pythonic*? Is it basically a Python "port" of the C++ code?  
> **username_2**: `python-bitcoinlib` is unpythonic because it is emulating all of the structures that you find in Bitcoin Cores CPP codebase. You could make it more pythonic but it wouldn't be as useful that way.  

---

### Answer by username_1 on 2015-06-25. Score: 2

> What is the complement of s referring to?

I haven't heard that term used like that before, but reading the code, it appears to compare `s` to see if it's more than `n/2` rounded down (where `n` is the order of the curve, `FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141`.)

If it is, it calculates `n - s` and uses that as `s`.


---

