<p>The value <code>r</code> is just a number and doesn't explicitly store or encode any point coordinates.  In a signature, <code>r</code> is set to the X coordinate of the point <code>R</code>, which is really <code>k*G</code>, where <code>k</code> is the secret nonce used during signing, then reduced mod the curve order.
In secp256k1, this <em>usually</em> means that <code>r</code> is in fact the X coordinate (because <code>r</code> itself is usually very big), but it is not always so.</p>

<p>During verification, the verifier attempts to reconstruct the original <code>R</code> point by from the signature values <code>(s, r)</code>, the message <code>z</code> and the signer's public key <code>P</code> by solving the equation <code>s*R' = z*G + r*P</code>, then reduce the X coordinate of <code>R'</code> mod the curve order and check that it is equal to <code>r</code> given in the signature.</p>

<p>I've never used openssl, but the process seems to be in <code>ossl_ecdsa_verify_sig()</code>.  So you can see <code>R'</code> being computed here :
<a href="https://github.com/openssl/openssl/blob/master/crypto/ec/ecdsa_ossl.c#L396-L404" rel="nofollow noreferrer">https://github.com/openssl/openssl/blob/master/crypto/ec/ecdsa_ossl.c#L396-L404</a></p>

<p>After these lines, the reduction mod the order is done and finally the equality test.  In simple signature verification, the Y coordinate of <code>R'</code> is not used, but it is available from the value <code>point</code> (which is <code>R'</code>) in openssl's implementation.</p>

<p>edit:<br>
Also, I just realized I should add a something about pubkey recovery since you mention the <code>v</code> or <code>recid</code> value in your question.
When doing pubkey recovery from message and signature (as in the case when the signer's pukey is not given), to get the Y coordinate from a possible <code>R'</code> point, you would try a few values based on <code>r</code> as the candidate X coordinates.</p>

<p>The possible X coordinates of <code>R'</code> will be <code>r</code> itself, or <code>r + curve_order</code> (and both can be valid X's).  You can then solve the curve's equation <code>y^2 = x^3 + 7</code> to get the possible Y values for each.</p>

CC BY-SA 4.0
2018-12-29T09:40:02.623Z
2018-12-29T10:13:24.157Z
2018-12-29T10:13:24.157Z
arubi
<p>I want to calculate the <strong>v</strong>-value from the signature obtained using the OpenSSL <a href="https://github.com/openssl/openssl/blob/4ace4ccda2934d2628c3d63d41e79abe041621a7/include/openssl/ec.h#L1178" rel="nofollow noreferrer">ECDSA_do_sign</a> function. I found that this value is calculated using the parity of <strong>y</strong>-coordinate of <strong>r</strong>. <a href="https://bitcoin.stackexchange.com/questions/38351/ecdsa-v-r-s-what-is-v">Here</a> I also found that the parity of <strong>y</strong> is equal to the parity of <strong>r</strong>. I want to understand whether it depends on the implementation. Can anyone tell exactly how the coordinates <strong>x</strong> and <strong>y</strong> are stored inside <strong>r</strong> in OpenSSL. I can't find it in the code.</p>

<p><strong>edited:</strong>
  I understand how v is calculated. My question is how to get the <strong>y</strong>-coordinate of <strong>r</strong> in the specific implementation of ECDSA in the OpenSSL library.</p>

<signature><source-code><openssl>
Representation of coordinates in signature. OpenSSL
Oroffe
# Representation of coordinates in signature. OpenSSL

(Asked by: username_0 on 2018-12-29)

I want to calculate the **v**-value from the signature obtained using the OpenSSL [ECDSA\_do\_sign](https://github.com/openssl/openssl/blob/4ace4ccda2934d2628c3d63d41e79abe041621a7/include/openssl/ec.h#L1178) function. I found that this value is calculated using the parity of **y**-coordinate of **r**. [Here](https://bitcoin.stackexchange.com/questions/38351/ecdsa-v-r-s-what-is-v) I also found that the parity of **y** is equal to the parity of **r**. I want to understand whether it depends on the implementation. Can anyone tell exactly how the coordinates **x** and **y** are stored inside **r** in OpenSSL. I can't find it in the code.

**edited:**
I understand how v is calculated. My question is how to get the **y**-coordinate of **r** in the specific implementation of ECDSA in the OpenSSL library.

**Tags:** signature, source-code, openssl


---

## 1 answers

### Answer by username_1 on 2018-12-29. Score: 2 | Accepted answer

The value `r` is just a number and doesn't explicitly store or encode any point coordinates. In a signature, `r` is set to the X coordinate of the point `R`, which is really `k*G`, where `k` is the secret nonce used during signing, then reduced mod the curve order.
In secp256k1, this *usually* means that `r` is in fact the X coordinate (because `r` itself is usually very big), but it is not always so.

During verification, the verifier attempts to reconstruct the original `R` point by from the signature values `(s, r)`, the message `z` and the signer's public key `P` by solving the equation `s*R' = z*G + r*P`, then reduce the X coordinate of `R'` mod the curve order and check that it is equal to `r` given in the signature.

I've never used openssl, but the process seems to be in `ossl_ecdsa_verify_sig()`. So you can see `R'` being computed here :
<https://github.com/openssl/openssl/blob/master/crypto/ec/ecdsa_ossl.c#L396-L404>

After these lines, the reduction mod the order is done and finally the equality test. In simple signature verification, the Y coordinate of `R'` is not used, but it is available from the value `point` (which is `R'`) in openssl's implementation.

edit:  
Also, I just realized I should add a something about pubkey recovery since you mention the `v` or `recid` value in your question.
When doing pubkey recovery from message and signature (as in the case when the signer's pukey is not given), to get the Y coordinate from a possible `R'` point, you would try a few values based on `r` as the candidate X coordinates.

The possible X coordinates of `R'` will be `r` itself, or `r + curve_order` (and both can be valid X's). You can then solve the curve's equation `y^2 = x^3 + 7` to get the possible Y values for each.


---

