<p>You're seeing the effect of RFC6979.</p>

<p>When generating a signature, some randomness is needed (called the nonce), as there are multiple valid signatures for the same message/key pair. The algorithm used, ECDSA, is extraordinarily vulnerable to weak randomness. An attacker who knows just a slight bit of information about your nonces can learn your private key after observing many signatures.</p>

<p>However, someone figured out that it doesn't need to actually be random. The only thing required is that it is unpredictable for the attacker. As a result, a standard was created that suggested using basically the hash of your private key and the message as your nonce. That standard is called RFC6979, and Bitcoin Core switched to using it in version 0.10.0. Clones that forked off before that version typically don't use it.</p>

<p>I have no idea why pubkey recovery does not work without deterministic signatures. I think it should work fine.</p>

CC BY-SA 4.0
2020-12-01T12:18:03.267Z
If the signature remains the same for all messages, what's to prevent someone from spending funds from the address (given change goes back to the same place)?
Thanks
Ayush
CC BY-SA 4.0
2020-12-01T15:00:37.773Z
The signature is most definitely not the same for all messages. What makes you conclude that?
Pieter Wuille
CC BY-SA 4.0
2020-12-01T15:05:49.660Z
>Signing the same message with the same private key will result always in the same signature.

By all, I meant all same messages (the same amount going to the same address from the same address). Maybe I misunderstood the question. Could you kindly clarify it?
Ayush
CC BY-SA 4.0
2020-12-01T15:07:08.003Z
Signing the same message multiple times with the same key will give the same signature every time, yes. Different messages result in different signatures.
Pieter Wuille
CC BY-SA 4.0
2020-12-01T15:07:38.530Z
Every transaction is a different message, even if it transfers the same amount.
Pieter Wuille
CC BY-SA 4.0
2020-12-01T15:09:36.440Z
Is nonce(entropy) added to messages too?
Ayush
CC BY-SA 4.0
2020-12-01T15:10:45.483Z
Yes, ECDSA has a nonce. If the nonce is insecure, the signature is insecure. This answer is about the fact that the nonce can be made deterministic (picking the same nonce for the same message and key every time).
Pieter Wuille
CC BY-SA 3.0
2017-09-02T19:43:44.297Z
2017-09-02T19:43:44.297Z
Pieter Wuille
<p>Using the "message signing" feature in the Bitcoin and Dash it's static with the same message. Signing the same message with the same private key will result always in the same signature.</p>

<p>This behavior is not the same in Peercoin or in the old wallet of Bitcoin. In these wallets, the signature changes even if both messages are equal, for me it has some "nonce" inside. </p>

<hr>

<h2>Example:</h2>

<p>Message: <code>xxx</code></p>

<p>Address: <code>18ZbyqYYwgEmn5hVMtJpihPeYxsUpCLhr7</code></p>

<p><strong>Bitcoin 0.8.5-beta:</strong></p>

<pre><code>INbwudFmql3iOH6c1UWylOpgLu5zrrqGrcFCanirz+Zb/nmJkcDXSkug5J0s3Yawb1/GzZKqXVjRHRNVSenRdMI=
II7W5su7EBQ4u1ppSKMVcmy8etnJsSOsvQHZ3j+moJs2P/vjwpqMlZkvOQ+W5odCdmwOz/5wK2T0RDV6aiqaEQs=
H7XNf5of1kmpwvcvLqVKIYc3TY5eN3kIrZWJPlDYhKVZekZ7Xk2qnJWjNDdsODkYtLEYn5p6fJfIC9LR+/rQky0=
</code></pre>

<p><strong>Bitcoin 0.14.2:</strong></p>

<pre><code>IBl6SRpJwzGjXTDbO/IuUcHzlbxqbzN+MmeGRLRIAcPjKpQ9XgQG+gBOzo5PcgtBbtDqXhJIKnbUH9vEcQ5CNlM=
IBl6SRpJwzGjXTDbO/IuUcHzlbxqbzN+MmeGRLRIAcPjKpQ9XgQG+gBOzo5PcgtBbtDqXhJIKnbUH9vEcQ5CNlM=
IBl6SRpJwzGjXTDbO/IuUcHzlbxqbzN+MmeGRLRIAcPjKpQ9XgQG+gBOzo5PcgtBbtDqXhJIKnbUH9vEcQ5CNlM=
</code></pre>

<p>In the old <em>Bitcoin-qt</em> the same message with the same private key create different signatures. But in the new <em>Bitcoin-qt</em> it's result in the same signature.</p>

<hr>

<p>What is the difference between this signature method? Have an alternative to continue getting the PK from a signature in the second case? Have name of this specific change?</p>

<message-signing><message-verification>
Why the signature of the same message changes in some wallets, but not all?
Inkeliz
# Why the signature of the same message changes in some wallets, but not all?

(Asked by: username_0 on 2017-09-02)

Using the "message signing" feature in the Bitcoin and Dash it's static with the same message. Signing the same message with the same private key will result always in the same signature.

This behavior is not the same in Peercoin or in the old wallet of Bitcoin. In these wallets, the signature changes even if both messages are equal, for me it has some "nonce" inside.

---

## Example:

Message: `xxx`

Address: `18ZbyqYYwgEmn5hVMtJpihPeYxsUpCLhr7`

**Bitcoin 0.8.5-beta:**

```
INbwudFmql3iOH6c1UWylOpgLu5zrrqGrcFCanirz+Zb/nmJkcDXSkug5J0s3Yawb1/GzZKqXVjRHRNVSenRdMI=
II7W5su7EBQ4u1ppSKMVcmy8etnJsSOsvQHZ3j+moJs2P/vjwpqMlZkvOQ+W5odCdmwOz/5wK2T0RDV6aiqaEQs=
H7XNf5of1kmpwvcvLqVKIYc3TY5eN3kIrZWJPlDYhKVZekZ7Xk2qnJWjNDdsODkYtLEYn5p6fJfIC9LR+/rQky0=

```

**Bitcoin 0.14.2:**

```
IBl6SRpJwzGjXTDbO/IuUcHzlbxqbzN+MmeGRLRIAcPjKpQ9XgQG+gBOzo5PcgtBbtDqXhJIKnbUH9vEcQ5CNlM=
IBl6SRpJwzGjXTDbO/IuUcHzlbxqbzN+MmeGRLRIAcPjKpQ9XgQG+gBOzo5PcgtBbtDqXhJIKnbUH9vEcQ5CNlM=
IBl6SRpJwzGjXTDbO/IuUcHzlbxqbzN+MmeGRLRIAcPjKpQ9XgQG+gBOzo5PcgtBbtDqXhJIKnbUH9vEcQ5CNlM=

```

In the old *Bitcoin-qt* the same message with the same private key create different signatures. But in the new *Bitcoin-qt* it's result in the same signature.

---

What is the difference between this signature method? Have an alternative to continue getting the PK from a signature in the second case? Have name of this specific change?

**Tags:** message-signing, message-verification


---

## 1 answers

### Answer by username_1 on 2017-09-02. Score: 3 | Accepted answer

You're seeing the effect of RFC6979.

When generating a signature, some randomness is needed (called the nonce), as there are multiple valid signatures for the same message/key pair. The algorithm used, ECDSA, is extraordinarily vulnerable to weak randomness. An attacker who knows just a slight bit of information about your nonces can learn your private key after observing many signatures.

However, someone figured out that it doesn't need to actually be random. The only thing required is that it is unpredictable for the attacker. As a result, a standard was created that suggested using basically the hash of your private key and the message as your nonce. That standard is called RFC6979, and Bitcoin Core switched to using it in version 0.10.0. Clones that forked off before that version typically don't use it.

I have no idea why pubkey recovery does not work without deterministic signatures. I think it should work fine.

> **Comments:**
> **username_2**: If the signature remains the same for all messages, what's to prevent someone from spending funds from the address (given change goes back to the same place)? Thanks  
> **username_1**: The signature is most definitely not the same for all messages. What makes you conclude that?  
> **username_2**: >Signing the same message with the same private key will result always in the same signature.  By all, I meant all same messages (the same amount going to the same address from the same address). Maybe I misunderstood the question. Could you kindly clarify it?  
> **username_1**: Signing the same message multiple times with the same key will give the same signature every time, yes. Different messages result in different signatures.  
> **username_1**: Every transaction is a different message, even if it transfers the same amount.  
> **username_2**: Is nonce(entropy) added to messages too?  
> **username_1**: Yes, ECDSA has a nonce. If the nonce is insecure, the signature is insecure. This answer is about the fact that the nonce can be made deterministic (picking the same nonce for the same message and key every time).  

---

