<p>Example: <a href="https://blockchain.info/tx/463b93f613da09b51d692f48674137f303050e4a5f2cc60ebf349b3c45e192d6" rel="nofollow noreferrer">https://blockchain.info/tx/463b93f613da09b51d692f48674137f303050e4a5f2cc60ebf349b3c45e192d6</a></p>

<p><strong>First "Signature" (sans the public key) which contains the R and S values is:</strong></p>

<p><code>304402206878b5690514437a2342405029426cc2b25b4a03fc396fef845d656cf62bad2c022018610a8d37e3384245176ab49ddbdbe8da4133f661bf5ea7ad4e3d2b912d856f01</code></p>

<p><strong>This breaks down into:</strong></p>

<p><code>30</code></p>

<p><code>44</code></p>

<p><code>02</code></p>

<p><code>20</code></p>

<p><code>6878b5690514437a2342405029426cc2b25b4a03fc396fef845d656cf62bad2c</code></p>

<p><code>02</code></p>

<p><code>20</code></p>

<p><code>18610a8d37e3384245176ab49ddbdbe8da4133f661bf5ea7ad4e3d2b912d856f</code></p>

<p><code>01</code></p>

<p>The <code>30</code>, I think, is standard.</p>

<p>The <code>44</code> is the number of bytes that will be taken up by, R, S, and their preceding numbers.  44 in hex is 68 in decimal form.  Thus referencing that after this point until (but not including) the <code>01</code> there will be 68 bytes of data or 136 alpha numeric characters.</p>

<p>The <code>02</code> is a number which identifies the following value (in this case, R) as an integer (I think)</p>

<p>The <code>20</code> is the number which identifies the number of bytes (or number of hex characters/numbers times 2) of the following value (in this case, R).  This value is in hex (ie: 20 in hex is 32 in decimal, signifying 32 bytes or 64 alpha/numeric characters)</p>

<p>The <code>6878b5690514437a2342405029426cc2b25b4a03fc396fef845d656cf62bad2c</code> is the actual "R" value referenced by the preceding <code>0220</code>.</p>

<p>The second <code>02</code> identifies the following value as an integer (in this case, S).</p>

<p>The second <code>20</code> is the number which identifies the number of bytes (or number of hex characters/numbers times 2) of the following value (in this case, S).  This value is in hex (ie: 20 in hex is 32 in decimal, signifying 32 bytes or 64 alpha/numeric characters)</p>

<p>The <code>18610a8d37e3384245176ab49ddbdbe8da4133f661bf5ea7ad4e3d2b912d856f</code> is the "S" value referenced by the preceding <code>0220</code>.</p>

<p>I think the <code>01</code> is merely a reference as to the end of this part of the transaction data.</p>

<p>Some R and S values may be different lengths, the preceding numbers will tell you how long they are.</p>

<p>Information for additional reference:</p>

<p><code>R = 47253809947851177065887724633329625063088643784040492056218945870752194997548</code></p>

<p><code>S = 11026965355983493404719379810734327200902731292741433431270495068542334764399</code></p>

<p><strong>The Second Input in this Transaction</strong></p>

<p><code>304402205473f7d4c042bcada7ab63d3d9997bb7945353d388abbea2435d6536c84dca9b0220635f3c3660c375f34a8101b4040b8e046749e8b8517439b090b34bd14b41388301</code></p>

<p><strong>Breaks down to the following</strong></p>

<p><code>30</code></p>

<p><code>44</code></p>

<p><code>02</code></p>

<p><code>20</code></p>

<p><code>5473f7d4c042bcada7ab63d3d9997bb7945353d388abbea2435d6536c84dca9b</code></p>

<p><code>02</code></p>

<p><code>20</code></p>

<p><code>635f3c3660c375f34a8101b4040b8e046749e8b8517439b090b34bd14b413883</code></p>

<p><code>01</code></p>

<p><strong>To reference your comment in your question</strong></p>

<p>In the first part of the example transaction I showed, to rip the R value from the data, you would have to remove the first 3 bytes (or the <code>304402</code>, aka the first 6 individual numbers).  Then you would have to convert the subsequent first byte (or 2 digit number) being <code>20</code>.  You would then have to convert this into decimal (which would be 32).  Then erase the <code>20</code> and then read ONLY the next 32 bytes (aka the "R" value), which could also be described as reading the next 64 alphanumeric characters.  You could then start the whole thing over again and shift the values over to identify the S value instead of the R value.</p>

CC BY-SA 3.0
2017-08-29T15:58:59.713Z
2017-08-29T16:28:27.440Z
2017-08-29T16:28:27.440Z
Mine
<p>The structure of a DER encoded ECDSA signature is as follows:</p>

<p><a href="https://i.sstatic.net/zarVk.jpg" rel="nofollow noreferrer"><img src="https://i.sstatic.net/zarVk.jpg" alt="enter image description here"></a></p>

<p><code>30</code> identifies a <code>SEQUENCE</code> in ASN1 encoding, which is followed by the length of <code>z</code> (the sequence). <code>r</code> and <code>s</code>can be either 32 or 33 bytes long, depending on how big the DER encoded values are. <code>r</code> and <code>s</code> are always leaded by <code>02</code>, which identify an integer value in ASN1. Finally, the tailing (<code>ht</code>) byte represents the hashtype</p>

<p>In order to parse a signature to extract both values you should check their length, which is always 1 byte long, and extract the value depending on the result. Here's the code to do so:</p>

<pre><code>def parse_element(hex_str, offset, element_size):
    """
    :param hex_str: string to parse the element from.
    :type hex_str: hex str
    :param offset: initial position of the object inside the hex_str.
    :type offset: int
    :param element_size: size of the element to extract.
    :type element_size: int
    :return: The extracted element from the provided string, and the updated offset after extracting it.
    :rtype tuple(str, int)
    """

    return hex_str[offset:offset+element_size], offset+element_size


def dissect_signature(hex_sig):
    """
    Extracts the r, s and ht components from a Bitcoin ECDSA signature.
    :param hex_sig: Signature in  hex format.
    :type hex_sig: hex str
    :return: r, s, t as a tuple.
    :rtype: tuple(str, str, str)
    """

    offset = 0
    # Check the sig contains at least the size and sequence marker
    assert len(hex_sig) &gt; 4, "Wrong signature format."
    sequence, offset = parse_element(hex_sig, offset, 2)
    # Check sequence marker is correct
    assert sequence == '30', "Wrong sequence marker."
    signature_length, offset = parse_element(hex_sig, offset, 2)
    # Check the length of the remaining part matches the length of the signature + the length of the hashflag (1 byte)
    assert len(hex_sig[offset:])/2 == int(signature_length, 16) + 1, "Wrong length."
    # Get r
    marker, offset = parse_element(hex_sig, offset, 2)
    assert marker == '02', "Wrong r marker."
    len_r, offset = parse_element(hex_sig, offset, 2)
    len_r_int = int(len_r, 16) * 2   # Each byte represents 2 characters
    r, offset = parse_element(hex_sig, offset, len_r_int)
    # Get s
    marker, offset = parse_element(hex_sig, offset, 2)
    assert marker == '02', "Wrong s marker."
    len_s, offset = parse_element(hex_sig, offset, 2)
    len_s_int = int(len_s, 16) * 2  # Each byte represents 2 characters
    s, offset = parse_element(hex_sig, offset, len_s_int)
    # Get ht
    ht, offset = parse_element(hex_sig, offset, 2)
    assert offset == len(hex_sig), "Wrong parsing."

    return r, s, ht


example_sig = None  # insert_sig_here
r, s, ht = dissect_signature(example_sig)
print "r: %s\ns: %s\nht: %s\n" % (r, s, ht)
</code></pre>

CC BY-SA 3.0
2018-03-27T07:24:42.490Z
Very helpful! Can I ask where you got your diagram? Might be a paper i'd be interested in reading
Malone
CC BY-SA 3.0
2018-03-27T08:31:54.310Z
https://eprint.iacr.org/2016/1184.pdf
sr_gi
CC BY-SA 4.0
2018-11-24T18:10:46.207Z
@sr-gi are you able to provide code for this?
GK89
CC BY-SA 4.0
2018-11-28T11:46:26.630Z
@GK89 I've included the code
sr_gi
CC BY-SA 4.0
2017-08-29T15:32:02.187Z
2018-11-28T11:46:08.093Z
2018-11-28T11:46:08.093Z
sr_gi
<p><a href="https://bitcoin.stackexchange.com/questions/2376/ecdsa-r-s-encoding-as-a-signature">ECDSA r, s encoding as a signature</a></p>

<p>this link doesnt seem to add up, any suggestions?</p>

CC BY-SA 3.0
2017-08-29T13:49:03.777Z
Could you clarify what "doesn't seem to add up" and what you want suggestions for? Your question is very unclear.
Ava Chow
CC BY-SA 3.0
2017-08-29T14:10:54.300Z
yeah, trying to make this work for 8 or more hours, feeling a bit off
im trying to figure out how to edit out the parts from the signature so i could get the raw R's and S's
what confises me is the part when the length is an uneven number of bytes, lets say 33, is there a way to circumvent this?
is there a bitcoin suit that is "gettable" from the net that does all of that for you?
user3700810
CC BY-SA 3.0
2017-08-29T15:16:11.920Z
What about the length being odd confuses you? It is just an array of bytes which you then interpret as an integer.
Ava Chow
<ecdsa>
how do you figure out the r and s out of a signature using python
user3700810
# how do you figure out the r and s out of a signature using python

(Asked by: username_0 on 2017-08-29)

[ECDSA r, s encoding as a signature](https://bitcoin.stackexchange.com/questions/2376/ecdsa-r-s-encoding-as-a-signature)

this link doesnt seem to add up, any suggestions?

**Tags:** ecdsa

> **Comments:**
> **username_1**: Could you clarify what "doesn't seem to add up" and what you want suggestions for? Your question is very unclear.  
> **username_0**: yeah, trying to make this work for 8 or more hours, feeling a bit off im trying to figure out how to edit out the parts from the signature so i could get the raw R's and S's what confises me is the part when the length is an uneven number of bytes, lets say 33, is there a way to circumvent this? is there a bitcoin suit that is "gettable" from the net that does all of that for you?  
> **username_1**: What about the length being odd confuses you? It is just an array of bytes which you then interpret as an integer.  

---

## 2 answers

### Answer by username_3 on 2017-08-29. Score: 6 | Accepted answer

The structure of a DER encoded ECDSA signature is as follows:

[![enter image description here](https://i.sstatic.net/zarVk.jpg)](https://i.sstatic.net/zarVk.jpg)

`30` identifies a `SEQUENCE` in ASN1 encoding, which is followed by the length of `z` (the sequence). `r` and `s`can be either 32 or 33 bytes long, depending on how big the DER encoded values are. `r` and `s` are always leaded by `02`, which identify an integer value in ASN1. Finally, the tailing (`ht`) byte represents the hashtype

In order to parse a signature to extract both values you should check their length, which is always 1 byte long, and extract the value depending on the result. Here's the code to do so:

```
def parse_element(hex_str, offset, element_size):
    """
    :param hex_str: string to parse the element from.
    :type hex_str: hex str
    :param offset: initial position of the object inside the hex_str.
    :type offset: int
    :param element_size: size of the element to extract.
    :type element_size: int
    :return: The extracted element from the provided string, and the updated offset after extracting it.
    :rtype tuple(str, int)
    """

    return hex_str[offset:offset+element_size], offset+element_size

def dissect_signature(hex_sig):
    """
    Extracts the r, s and ht components from a Bitcoin ECDSA signature.
    :param hex_sig: Signature in  hex format.
    :type hex_sig: hex str
    :return: r, s, t as a tuple.
    :rtype: tuple(str, str, str)
    """

    offset = 0
    # Check the sig contains at least the size and sequence marker
    assert len(hex_sig) > 4, "Wrong signature format."
    sequence, offset = parse_element(hex_sig, offset, 2)
    # Check sequence marker is correct
    assert sequence == '30', "Wrong sequence marker."
    signature_length, offset = parse_element(hex_sig, offset, 2)
    # Check the length of the remaining part matches the length of the signature + the length of the hashflag (1 byte)
    assert len(hex_sig[offset:])/2 == int(signature_length, 16) + 1, "Wrong length."
    # Get r
    marker, offset = parse_element(hex_sig, offset, 2)
    assert marker == '02', "Wrong r marker."
    len_r, offset = parse_element(hex_sig, offset, 2)
    len_r_int = int(len_r, 16) * 2   # Each byte represents 2 characters
    r, offset = parse_element(hex_sig, offset, len_r_int)
    # Get s
    marker, offset = parse_element(hex_sig, offset, 2)
    assert marker == '02', "Wrong s marker."
    len_s, offset = parse_element(hex_sig, offset, 2)
    len_s_int = int(len_s, 16) * 2  # Each byte represents 2 characters
    s, offset = parse_element(hex_sig, offset, len_s_int)
    # Get ht
    ht, offset = parse_element(hex_sig, offset, 2)
    assert offset == len(hex_sig), "Wrong parsing."

    return r, s, ht

example_sig = None  # insert_sig_here
r, s, ht = dissect_signature(example_sig)
print "r: %s\ns: %s\nht: %s\n" % (r, s, ht)

```

> **Comments:**
> **username_4**: Very helpful! Can I ask where you got your diagram? Might be a paper i'd be interested in reading  
> **username_3**: https://eprint.iacr.org/2016/1184.pdf  
> **username_5**: @username_3 are you able to provide code for this?  
> **username_3**: @username_5 I've included the code  

---

### Answer by username_2 on 2017-08-29. Score: 4

Example: <https://blockchain.info/tx/463b93f613da09b51d692f48674137f303050e4a5f2cc60ebf349b3c45e192d6>

**First "Signature" (sans the public key) which contains the R and S values is:**

`304402206878b5690514437a2342405029426cc2b25b4a03fc396fef845d656cf62bad2c022018610a8d37e3384245176ab49ddbdbe8da4133f661bf5ea7ad4e3d2b912d856f01`

**This breaks down into:**

`30`

`44`

`02`

`20`

`6878b5690514437a2342405029426cc2b25b4a03fc396fef845d656cf62bad2c`

`02`

`20`

`18610a8d37e3384245176ab49ddbdbe8da4133f661bf5ea7ad4e3d2b912d856f`

`01`

The `30`, I think, is standard.

The `44` is the number of bytes that will be taken up by, R, S, and their preceding numbers. 44 in hex is 68 in decimal form. Thus referencing that after this point until (but not including) the `01` there will be 68 bytes of data or 136 alpha numeric characters.

The `02` is a number which identifies the following value (in this case, R) as an integer (I think)

The `20` is the number which identifies the number of bytes (or number of hex characters/numbers times 2) of the following value (in this case, R). This value is in hex (ie: 20 in hex is 32 in decimal, signifying 32 bytes or 64 alpha/numeric characters)

The `6878b5690514437a2342405029426cc2b25b4a03fc396fef845d656cf62bad2c` is the actual "R" value referenced by the preceding `0220`.

The second `02` identifies the following value as an integer (in this case, S).

The second `20` is the number which identifies the number of bytes (or number of hex characters/numbers times 2) of the following value (in this case, S). This value is in hex (ie: 20 in hex is 32 in decimal, signifying 32 bytes or 64 alpha/numeric characters)

The `18610a8d37e3384245176ab49ddbdbe8da4133f661bf5ea7ad4e3d2b912d856f` is the "S" value referenced by the preceding `0220`.

I think the `01` is merely a reference as to the end of this part of the transaction data.

Some R and S values may be different lengths, the preceding numbers will tell you how long they are.

Information for additional reference:

`R = 47253809947851177065887724633329625063088643784040492056218945870752194997548`

`S = 11026965355983493404719379810734327200902731292741433431270495068542334764399`

**The Second Input in this Transaction**

`304402205473f7d4c042bcada7ab63d3d9997bb7945353d388abbea2435d6536c84dca9b0220635f3c3660c375f34a8101b4040b8e046749e8b8517439b090b34bd14b41388301`

**Breaks down to the following**

`30`

`44`

`02`

`20`

`5473f7d4c042bcada7ab63d3d9997bb7945353d388abbea2435d6536c84dca9b`

`02`

`20`

`635f3c3660c375f34a8101b4040b8e046749e8b8517439b090b34bd14b413883`

`01`

**To reference your comment in your question**

In the first part of the example transaction I showed, to rip the R value from the data, you would have to remove the first 3 bytes (or the `304402`, aka the first 6 individual numbers). Then you would have to convert the subsequent first byte (or 2 digit number) being `20`. You would then have to convert this into decimal (which would be 32). Then erase the `20` and then read ONLY the next 32 bytes (aka the "R" value), which could also be described as reading the next 64 alphanumeric characters. You could then start the whole thing over again and shift the values over to identify the S value instead of the R value.


---

