<p>Good question! There are two concepts here. The finite field Fp, and the EC Group defined by secp256k1.</p>

<p>In Fp, elements are just numbers modulo p. Addition, Subtraction, Multiplication, and Division are all defined for this finite field.</p>

<p>In the EC Group, however, each element is a pair of elements in Fp, such as <code>(f1, f2)</code>. You can add and subtract these pairs to get different pairs, but the addition and subtraction has little to do with the addition and subtraction of elements of Fp (technically it uses those operations under the hood, but it's not direct addition. That would be pretty boring if <code>(f1, f2)</code> + <code>(g1, g2)</code> just gave you <code>(f1+g1, f2+g2)</code>). </p>

<p>Also note that since these pairs are a mathematical Group, rather than a field, there's no way to multiply two pairs. You may have seen the syntax <code>k*G</code> before, but this is just shorthand for adding <code>G</code> to itself <code>k</code> times, <code>k</code> is an integer rather than another element of the EC Group defined by secp256k1.</p>

<p>Additionally, if you look at the <a href="https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm" rel="nofollow">ECDSA algorithm</a>, you will see that here the final elements are (r, s), but just because it is a pair does not mean it is a pair that lives on the secp256k1 curve! This is a pair of integers mod n (the curve order), as defined by the algorithm, not a point on the curve.</p>

CC BY-SA 3.0
2015-08-20T04:37:37.073Z
`but just because it is a pair does not mean it is a pair that lives on the secp256k1 curve!` ***!* indeed**! I was going to ask this question now, actually: see I was thinking that r,s was the x,y point on the curve: I actually was great at math but this stuff is so different from the algebra/calculus I was good with.
Wizard Of Ozzie
CC BY-SA 3.0
2015-08-19T19:58:08.967Z
2015-08-19T20:04:04.223Z
2015-08-19T20:04:04.223Z
morsecoder
<p>The premise of your question is wrong.  In fact, Pieter <a href="https://bitcoin.stackexchange.com/questions/38351/ecdsa-v-r-s-what-is-v/38909#comment46061_38909">said</a> the opposite:</p>

<blockquote>
  <p>X and Y coordinates are numbers modulo p, the field size, which is around 2^256 - 2^32 for secp256k1. The value r and s in the signature however are modulo n, the group order, which is around 2^256 - 2^128.</p>
</blockquote>

<p>If things still aren't making sense to you, I would recommend reading the <a href="https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm" rel="nofollow noreferrer">Wikipedia ECDSA article</a> and <a href="http://www.secg.org/sec1-v2.pdf" rel="nofollow noreferrer">SEC1</a>, and then asking a new, clearer question.  It would be nice if your question included a brief definition of every number you are talking about (like Pieter's comment did) so we can make sure we are all talking about the same things.</p>

<p>The Wikipedia article has a short section explaining the correctness of the algorithm, and you would probably see that the math doesn't work if you try to change the way the signature is generated.</p>

<p>Also, I have written an <a href="https://github.com/DavidEGrayson/ruby_ecdsa" rel="nofollow noreferrer">implementation of ECDSA</a> in Ruby that should be pretty easy to read and modify if you want to try out your ideas.</p>

<h2>Alternative answer assuming you switched P and N in your question</h2>

<p>However, if I assume that you just accidentally switched P and N in your question, then my answer would be:</p>

<p>N is defined to be the the order of the secp256k1 group.  So it is the number of distinct points in the group, including the infinity point.  When you have a number like r or s that is between 0 and N - 1, it is actually the index of a particular point on the curve.  It's like a private key (which are between 1 and  N - 1), because you can use that number to generate secp256k1 point.  The secp256k1 group is isomorphic to the group of integers modulo N: adding two such integers is equivalent to adding their corresponding secp256k1 points.  The number 0 is equivalent to the infinity point.</p>

<p>So that should explain why it might be useful to have numbers in the algorithm that are between 0 and N - 1.  We use the modulus operator to convert arbitrary integers to that range.</p>

<p>Of course, this doesn't explain why r and s in particular are modulo N, but if you work through the math in the "Correctness of the Algorithm Section" of the <a href="https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm" rel="nofollow noreferrer">Wikipedia ECDSA article</a> you would probably see that the math doesn't work if you change the way the signature is generated.</p>

CC BY-SA 3.0
2015-08-20T04:25:50.810Z
Thanks mate, yeah, there was definite confusion on my part. I've edited the question title/content to reflect my intention, to wit, reversal `p` / `n`
Wizard Of Ozzie
CC BY-SA 3.0
2015-08-19T15:46:49.440Z
2015-08-19T16:31:08.467Z
2017-04-13T12:47:34.187Z
David Grayson
<p>As Peter Wuille <a href="https://bitcoin.stackexchange.com/questions/38351/ecdsa-v-r-s-what-is-v/38909#comment46061_38909">mentions here</a>, the ECDSA signature values (r, s) are modulo <code>N</code> (eg verifying ECDSA signatures, where <code>u1 = z * w % N</code>), whereas the rest of the ECDSA functionality in Bitcoin seems to be modulo <strong><code>P</code></strong>.</p>

<p>Why is this so?</p>

CC BY-SA 3.0
2015-08-19T20:09:45.420Z
You should probably update your question to accurately state what Pieter Wuille said. His comment does not say that r, and s are modulo P, he specifically says: `r and s in the signature however are modulo n, the group order`.
morsecoder
CC BY-SA 3.0
2015-08-20T00:53:04.597Z
I'll take a look now. I must've misspoke or misunderstood what he said
Wizard Of Ozzie
<ecdsa>
Why are r and s modulo N? (not P)
Wizard Of Ozzie
# Why are r and s modulo N? (not P)

(Asked by: username_0 on 2015-08-19)

As Peter Wuille [mentions here](https://bitcoin.stackexchange.com/questions/38351/ecdsa-v-r-s-what-is-v/38909#comment46061_38909), the ECDSA signature values (r, s) are modulo `N` (eg verifying ECDSA signatures, where `u1 = z * w % N`), whereas the rest of the ECDSA functionality in Bitcoin seems to be modulo **`P`**.

Why is this so?

**Tags:** ecdsa

> **Comments:**
> **username_1**: You should probably update your question to accurately state what Pieter Wuille said. His comment does not say that r, and s are modulo P, he specifically says: `r and s in the signature however are modulo n, the group order`.  
> **username_0**: I'll take a look now. I must've misspoke or misunderstood what he said  

---

## 2 answers

### Answer by username_1 on 2015-08-19. Score: 3 | Accepted answer

Good question! There are two concepts here. The finite field Fp, and the EC Group defined by secp256k1.

In Fp, elements are just numbers modulo p. Addition, Subtraction, Multiplication, and Division are all defined for this finite field.

In the EC Group, however, each element is a pair of elements in Fp, such as `(f1, f2)`. You can add and subtract these pairs to get different pairs, but the addition and subtraction has little to do with the addition and subtraction of elements of Fp (technically it uses those operations under the hood, but it's not direct addition. That would be pretty boring if `(f1, f2)` + `(g1, g2)` just gave you `(f1+g1, f2+g2)`).

Also note that since these pairs are a mathematical Group, rather than a field, there's no way to multiply two pairs. You may have seen the syntax `k*G` before, but this is just shorthand for adding `G` to itself `k` times, `k` is an integer rather than another element of the EC Group defined by secp256k1.

Additionally, if you look at the [ECDSA algorithm](https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm), you will see that here the final elements are (r, s), but just because it is a pair does not mean it is a pair that lives on the secp256k1 curve! This is a pair of integers mod n (the curve order), as defined by the algorithm, not a point on the curve.

> **Comments:**
> **username_0**: `but just because it is a pair does not mean it is a pair that lives on the secp256k1 curve!` ***!* indeed**! I was going to ask this question now, actually: see I was thinking that r,s was the x,y point on the curve: I actually was great at math but this stuff is so different from the algebra/calculus I was good with.  

---

### Answer by username_2 on 2015-08-19. Score: 1

The premise of your question is wrong. In fact, Pieter [said](https://bitcoin.stackexchange.com/questions/38351/ecdsa-v-r-s-what-is-v/38909#comment46061_38909) the opposite:

> X and Y coordinates are numbers modulo p, the field size, which is around 2^256 - 2^32 for secp256k1. The value r and s in the signature however are modulo n, the group order, which is around 2^256 - 2^128.

If things still aren't making sense to you, I would recommend reading the [Wikipedia ECDSA article](https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm) and [SEC1](http://www.secg.org/sec1-v2.pdf), and then asking a new, clearer question. It would be nice if your question included a brief definition of every number you are talking about (like Pieter's comment did) so we can make sure we are all talking about the same things.

The Wikipedia article has a short section explaining the correctness of the algorithm, and you would probably see that the math doesn't work if you try to change the way the signature is generated.

Also, I have written an [implementation of ECDSA](https://github.com/DavidEGrayson/ruby_ecdsa) in Ruby that should be pretty easy to read and modify if you want to try out your ideas.

## Alternative answer assuming you switched P and N in your question

However, if I assume that you just accidentally switched P and N in your question, then my answer would be:

N is defined to be the the order of the secp256k1 group. So it is the number of distinct points in the group, including the infinity point. When you have a number like r or s that is between 0 and N - 1, it is actually the index of a particular point on the curve. It's like a private key (which are between 1 and N - 1), because you can use that number to generate secp256k1 point. The secp256k1 group is isomorphic to the group of integers modulo N: adding two such integers is equivalent to adding their corresponding secp256k1 points. The number 0 is equivalent to the infinity point.

So that should explain why it might be useful to have numbers in the algorithm that are between 0 and N - 1. We use the modulus operator to convert arbitrary integers to that range.

Of course, this doesn't explain why r and s in particular are modulo N, but if you work through the math in the "Correctness of the Algorithm Section" of the [Wikipedia ECDSA article](https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm) you would probably see that the math doesn't work if you change the way the signature is generated.

> **Comments:**
> **username_0**: Thanks mate, yeah, there was definite confusion on my part. I've edited the question title/content to reflect my intention, to wit, reversal `p` / `n`  

---

