Post
Topic
Board Development & Technical Discussion
Merits 1 from 1 user
Re: Deterministic Usage of DSA and ECDSA Digital Signature Algorithms (RFC 6979)
by
gmaxwell
on 07/10/2013, 21:12:56 UTC
⭐ Merited by ETFbitcoin (1)
Why should S be even? Any citation?
To prevent third parties from changing your txids out from under you and invalidating transactions spending your unconfirmed transactions by replacing S with the alternative value which also allows the signature to pass.  This malleability can be used to create enormous nuisances for Bitcoin users, causing stuck transactions and making innocent people look like malicious double-spenders, as well as can be abused to extort people in some escrow protocols.

See the second half of: http://www.mail-archive.com/bitcoin-development@lists.sourceforge.net/msg02721.html

There are multiple ways to remove this 1-bit of freedom. One way is to make S even. Another way, now used by bitcoin-qt git, is to make s < order/2. The advantage of this way of removing the vs others freedom is that it also reduces the average signature size slightly.  I now prefer the s < order/2 version of this just because it produces smaller signatures and the flip is even easier to implement than the even/odd version.