<p>It's a custom format that encodes both a signature, and a parameter that allows the public key to be reconstructed from it.</p>

<p>Given a signature (an (r,s) pair), and the message it signs, there can be up to 4 different public keys for which it is valid. To know which one, the number is encoded along the signature.</p>

<p>The first byte is this recovery parameter plus 27. If the corresponding public key is to be a compressed one, 4 is added. The next 32 bytes encode r. The last 32 bytes encode s.</p>

<p>Note that this format is only used for message signatures. The scheme used for transaction signatures is older, doesn't support recovery, and uses DER encoding.</p>

CC BY-SA 3.0
2013-11-02T18:49:24.667Z
2013-11-02T20:04:21.293Z
2013-11-02T20:04:21.293Z
Pieter Wuille
<p>I understand that the public key (Q) can be extracted from a signature (r,s), but I'm having trouble understanding <a href="https://github.com/bitcoin/bitcoin/blob/master/src/key.cpp#L446" rel="nofollow">this line:</a></p>

<pre><code>if (!key.Recover(hash, &amp;vchSig[1], (vchSig[0] - 27) &amp; ~4))
</code></pre>

<p>The third variable is called "rec" and must 0 through 3.</p>

<ul>
<li><p>What is the purpose of this parameter (3rd one)?</p></li>
<li><p>Why is the signature starting a byte<a href="https://github.com/bitcoin/bitcoin/blob/master/src/key.cpp#L446" rel="nofollow">1</a> and not [0]?  Perhaps I'm not properly understanding "where" r and s is located in the Bitcoin signature.</p></li>
</ul>

<p>By any chance is the signature format encapsulated in any standard? PKCS..? etc.</p>

<development><encryption><c++>
In the sourcecode, what does this line mean that recovers the key from the signature?
makerofthings7
# In the sourcecode, what does this line mean that recovers the key from the signature?

(Asked by: username_0 on 2013-11-02)

I understand that the public key (Q) can be extracted from a signature (r,s), but I'm having trouble understanding [this line:](https://github.com/bitcoin/bitcoin/blob/master/src/key.cpp#L446)

```
if (!key.Recover(hash, &vchSig[1], (vchSig[0] - 27) & ~4))

```

The third variable is called "rec" and must 0 through 3.

* What is the purpose of this parameter (3rd one)?
* Why is the signature starting a byte[1](https://github.com/bitcoin/bitcoin/blob/master/src/key.cpp#L446) and not [0]? Perhaps I'm not properly understanding "where" r and s is located in the Bitcoin signature.

By any chance is the signature format encapsulated in any standard? PKCS..? etc.

**Tags:** development, encryption, c++


---

## 1 answers

### Answer by username_1 on 2013-11-02. Score: 2 | Accepted answer

It's a custom format that encodes both a signature, and a parameter that allows the public key to be reconstructed from it.

Given a signature (an (r,s) pair), and the message it signs, there can be up to 4 different public keys for which it is valid. To know which one, the number is encoded along the signature.

The first byte is this recovery parameter plus 27. If the corresponding public key is to be a compressed one, 4 is added. The next 32 bytes encode r. The last 32 bytes encode s.

Note that this format is only used for message signatures. The scheme used for transaction signatures is older, doesn't support recovery, and uses DER encoding.


---

