<p>The semantics of multiplication are different in your two equations. </p>

<p>As for the first equation. The s-part of a signature is an element in a group (represented by a number) so the inverse exists and is easy to compute (or even well known)</p>

<p>In the second case you take the numerical value of the private key and compute the multiple of this with a base point. With that notation the "inverse" becomes equivalent to finding the discrete logarithm in this additive group. In ecc it is not known how to compute the discrete log efficiently </p>

<p>I guess this answer is somewhat frustrating. I recommend learning about Groupe theory to understand the differences in notation. </p>

CC BY-SA 4.0
2019-03-07T14:52:03.367Z
Thanks for the answer. I was hoping that was the case, but just wanted to confirm. But say given a signature, how do you calculate the inverse of it?
Ugam Kamat
CC BY-SA 4.0
2019-03-07T18:07:45.087Z
A signature doesn't really have an inverse. It consists of two distinct elements, r and s. r is a point on the curve so finding it's inverse would mean solving the elliptic curve discrete log problem. However s is just an integer in the group. Finding the inverse of this is easy, as stated in this answer.
Ava Chow
CC BY-SA 4.0
2019-03-07T20:19:44.363Z
Thanks Andrew I fixed my answer. Since the question was about S^(-1) I was sloppy naming that the signature. I know you know that but for the other readers I want to emphasize that r and s are both elements of groups. Just very different ones. While s comes from a prime field r comes from the elliptic curve.
Rene Pickhardt
CC BY-SA 4.0
2019-03-07T20:38:59.310Z
That's a good point. It was my bad to call the signature as S. I'll update the question to reflect S component of the signature. Thanks guys. Looks like I have some reading I need to do.
Ugam Kamat
CC BY-SA 4.0
2019-03-08T21:52:41.430Z
Note we write points in uppercase (G, Q) but numbers (or for F_2^m field elements) in lowercase (a, b, n, h, d, k, r, s) to help keep this distinction clear. @AndrewChow: in ECDSA r is actually the x-coordinate of a point (kG) mod n. But a given r corresponds to usually 2 and very rarely 4 points, and yes inverting those is equivalent to DLP.
dave_thompson_085
CC BY-SA 4.0
2019-03-07T14:12:47.713Z
2019-03-07T20:15:56.660Z
2019-03-07T20:15:56.660Z
Rene Pickhardt
<p>When verifying the signature in bitcoin, we calculate S^(-1) * hash(m) * G + S^(-1) * R * pub_key and verify that this is equal to the temporary public key. Given the same logic, why can't we use it to calculate private key from public key?</p>

<p>for example: pub_key = priv_key * G. Modify it to: priv_key^(-1) = pub_key^(-1)*G and then take get the priv_key by taking inverse of LHS.</p>

<p>I just want to understand the math that makes us calculate S^(-1) in the first case, but does not allow us to do it in the second case.</p>

<signature><cryptography>
How can you calculate the inverse of S component of signature, while you cannot do it in ECC to calculate private key from public key?
Ugam Kamat
# How can you calculate the inverse of S component of signature, while you cannot do it in ECC to calculate private key from public key?

(Asked by: username_0 on 2019-03-07)

When verifying the signature in bitcoin, we calculate S^(-1) \* hash(m) \* G + S^(-1) \* R \* pub\_key and verify that this is equal to the temporary public key. Given the same logic, why can't we use it to calculate private key from public key?

for example: pub\_key = priv\_key \* G. Modify it to: priv\_key^(-1) = pub\_key^(-1)\*G and then take get the priv\_key by taking inverse of LHS.

I just want to understand the math that makes us calculate S^(-1) in the first case, but does not allow us to do it in the second case.

**Tags:** signature, cryptography


---

## 1 answers

### Answer by username_1 on 2019-03-07. Score: 3 | Accepted answer

The semantics of multiplication are different in your two equations.

As for the first equation. The s-part of a signature is an element in a group (represented by a number) so the inverse exists and is easy to compute (or even well known)

In the second case you take the numerical value of the private key and compute the multiple of this with a base point. With that notation the "inverse" becomes equivalent to finding the discrete logarithm in this additive group. In ecc it is not known how to compute the discrete log efficiently

I guess this answer is somewhat frustrating. I recommend learning about Groupe theory to understand the differences in notation.

> **Comments:**
> **username_0**: Thanks for the answer. I was hoping that was the case, but just wanted to confirm. But say given a signature, how do you calculate the inverse of it?  
> **username_2**: A signature doesn't really have an inverse. It consists of two distinct elements, r and s. r is a point on the curve so finding it's inverse would mean solving the elliptic curve discrete log problem. However s is just an integer in the group. Finding the inverse of this is easy, as stated in this answer.  
> **username_1**: Thanks Andrew I fixed my answer. Since the question was about S^(-1) I was sloppy naming that the signature. I know you know that but for the other readers I want to emphasize that r and s are both elements of groups. Just very different ones. While s comes from a prime field r comes from the elliptic curve.  
> **username_0**: That's a good point. It was my bad to call the signature as S. I'll update the question to reflect S component of the signature. Thanks guys. Looks like I have some reading I need to do.  
> **username_3**: Note we write points in uppercase (G, Q) but numbers (or for F_2^m field elements) in lowercase (a, b, n, h, d, k, r, s) to help keep this distinction clear. @AndrewChow: in ECDSA r is actually the x-coordinate of a point (kG) mod n. But a given r corresponds to usually 2 and very rarely 4 points, and yes inverting those is equivalent to DLP.  

---

