Post
Topic
Board Development & Technical Discussion
Re: Deterministic Usage of DSA and ECDSA Digital Signature Algorithms (RFC 6979)
by
plaprade
on 07/10/2013, 21:16:10 UTC
I noticed that the problem came from the parity of 'S'. The 'S' component is odd in your last test vector.

Why should S be even? Any citation?

From the bitcoind reference implementation:

https://github.com/bitcoin/bitcoin/blob/master/src/script.cpp (line 295)

Code:
    if (flags & SCRIPT_VERIFY_EVEN_S) {
        if (S[nLenS-1] & 1)
            return error("Non-canonical signature: S value odd");
    }

However there's a flag to activate this check. Most of the unit tests in the reference implementation do not take even 'S' into account yet.