ECDSA secp256k1: Bitcoin's Digital Signature Algorithm

function scalar_multiply(d, G):
    result = point_at_infinity
    for bit in binary(d) from most significant to least:
        result = double(result)
        if bit == 1:
            result = add(result, G)
    return result

3045022100DEADBEEF... (32 bytes r)022100CAFEBABE... (32 bytes s)01
│   │││               │││               │
│   │││               │││               └─ SIGHASH flag
│   │││               ││└─ s value (32 bytes)
│   │││               │└─ s marker
│   │││               └─ length of s
│   ││└─ r value (32 bytes)
│   │└─ r marker
│   └─ length of r
└─ SEQUENCE marker

pip install ecdsa cryptography

from ecdsa import SigningKey, SECP256k1
import hashlib

# Generate a private key
private_key = SigningKey.generate(curve=SECP256k1)
public_key = private_key.get_verifying_key()

# Message to sign
message = b"Send 1 BTC to address 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa"
message_hash = hashlib.sha256(message).digest()

# Sign
signature = private_key.sign_deterministic(message_hash, hashfunc=hashlib.sha256)

# Verify
verified = public_key.verify(signature, message_hash)
print(f"Signature valid: {verified}")

# Display keys
print(f"Private key (hex): {private_key.to_string().hex()}")
print(f"Public key (hex): {public_key.to_string('compressed').hex()}")
print(f"Signature (hex): {signature.hex()}")

import hashlib
import random
import hmac

# secp256k1 curve parameters
P = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
N = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
G_X = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798
G_Y = 0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8

def mod_inverse(a, p):
    """Modular inverse using Fermat's little theorem (p prime)"""
    return pow(a, p-2, p)

def point_add(p1, p2):
    """Add two points on secp256k1"""
    if p1 is None: return p2
    if p2 is None: return p1
    
    x1, y1 = p1
    x2, y2 = p2
    
    if x1 == x2 and y1 != y2:
        return None
    
    if x1 == x2 and y1 == y2:
        # Point doubling
        slope = (3 * x1 * x1) * mod_inverse(2 * y1, P) % P
    else:
        # Point addition
        slope = (y2 - y1) * mod_inverse(x2 - x1, P) % P
    
    x3 = (slope * slope - x1 - x2) % P
    y3 = (slope * (x1 - x3) - y1) % P
    return (x3, y3)

def scalar_multiply(k, point):
    """Multiply point by scalar using double-and-add"""
    result = None
    addend = point
    while k:
        if k & 1:
            result = point_add(result, addend)
        addend = point_add(addend, addend)
        k >>= 1
    return result

def private_key_to_public_key(private_key_hex):
    """Derive public key from private key"""
    d = int(private_key_hex, 16)
    G = (G_X, G_Y)
    public_point = scalar_multiply(d, G)
    if public_point is None:
        return None
    # Compressed public key format
    prefix = '02' if public_point[1] % 2 == 0 else '03'
    return prefix + format(public_point[0], '064x')

def deterministic_nonce(private_key_hex, msg_hash_hex):
    """RFC 6979 deterministic nonce generation"""
    private_key_bytes = bytes.fromhex(private_key_hex)
    msg_hash_bytes = bytes.fromhex(msg_hash_hex)
    
    v = b'\x01' * 32
    k = b'\x00' * 32
    
    k = hmac.new(k, v + b'\x00' + private_key_bytes + msg_hash_bytes, hashlib.sha256).digest()
    v = hmac.new(k, v, hashlib.sha256).digest()
    k = hmac.new(k, v + b'\x01' + private_key_bytes + msg_hash_bytes, hashlib.sha256).digest()
    v = hmac.new(k, v, hashlib.sha256).digest()
    
    while True:
        v = hmac.new(k, v, hashlib.sha256).digest()
        candidate = int.from_bytes(v, 'big')
        if 1 <= candidate < N:
            return candidate

def sign(private_key_hex, message):
    """ECDSA sign a message (deterministic nonce)"""
    # Hash message
    msg_hash = hashlib.sha256(message).digest()
    z = int.from_bytes(msg_hash, 'big')
    d = int(private_key_hex, 16)
    
    # Deterministic nonce
    k = deterministic_nonce(private_key_hex, msg_hash.hex())
    
    # Compute r
    G = (G_X, G_Y)
    R = scalar_multiply(k, G)
    r = R[0] % N
    if r == 0:
        raise Exception("r is zero, try again")
    
    # Compute s
    k_inv = mod_inverse(k, N)
    s = (k_inv * (z + r * d)) % N
    if s == 0:
        raise Exception("s is zero, try again")
    
    # DER encode signature (simplified)
    r_hex = format(r, '064x')
    s_hex = format(s, '064x')
    return r_hex, s_hex

def verify(public_key_hex, message, r_hex, s_hex):
    """ECDSA verify a signature"""
    # Parse public key
    prefix = public_key_hex[:2]
    x = int(public_key_hex[2:], 16)
    # Recover y from x (simplified - assumes correct parity)
    y_sq = (pow(x, 3, P) + 7) % P
    y = pow(y_sq, (P+1)//4, P)
    if (prefix == '03' and y % 2 == 0) or (prefix == '02' and y % 2 == 1):
        y = P - y
    Q = (x, y)
    
    # Hash message
    msg_hash = hashlib.sha256(message).digest()
    z = int.from_bytes(msg_hash, 'big')
    
    r = int(r_hex, 16)
    s = int(s_hex, 16)
    
    if not (1 <= r < N and 1 <= s < N):
        return False
    
    w = mod_inverse(s, N)
    u1 = (z * w) % N
    u2 = (r * w) % N
    
    G = (G_X, G_Y)
    point1 = scalar_multiply(u1, G)
    point2 = scalar_multiply(u2, Q)
    point_sum = point_add(point1, point2)
    
    if point_sum is None:
        return False
    
    return (point_sum[0] % N) == r

# Example usage
if __name__ == '__main__':
    # Demo private key (don't use for real funds!)
    test_private_key = "4c3f3f5b2b5b2b5b2b5b2b5b2b5b2b5b2b5b2b5b2b5b2b5b2b5b2b5b2b5b"
    message = b"Send 1 BTC to address 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa"
    
    # Generate public key
    pub_key = private_key_to_public_key(test_private_key)
    print(f"Public key: {pub_key}")
    
    # Sign
    r, s = sign(test_private_key, message)
    print(f"Signature r: {r}")
    print(f"Signature s: {s}")
    
    # Verify
    valid = verify(pub_key, message, r, s)
    print(f"Signature valid: {valid}")

from ecdsa import SigningKey, VerifyingKey, SECP256k1, BadSignatureError
import hashlib

def safe_verify(public_key_hex, message, signature_hex):
    """
    Safely verify an ECDSA signature with proper error handling
    """
    try:
        # Convert hex to bytes
        pub_key_bytes = bytes.fromhex(public_key_hex)
        sig_bytes = bytes.fromhex(signature_hex)
        
        # Load the verifying key
        verifying_key = VerifyingKey.from_string(pub_key_bytes, curve=SECP256k1)
        
        # Hash the message (Bitcoin style: double SHA-256)
        msg_hash = hashlib.sha256(hashlib.sha256(message).digest()).digest()
        
        # Attempt verification
        verifying_key.verify(sig_bytes, msg_hash, hashfunc=hashlib.sha256)
        return True, "Signature is valid"
        
    except BadSignatureError:
        return False, "Signature verification failed - the signature does not match"
    except ValueError as e:
        return False, f"Invalid format: {e}"
    except Exception as e:
        return False, f"Unexpected error: {e}"

# Example usage
private_key = SigningKey.generate(curve=SECP256k1)
public_key = private_key.get_verifying_key()
message = b"Send 1 BTC"

# Good signature
sig = private_key.sign_deterministic(message, hashfunc=hashlib.sha256)
valid, msg = safe_verify(public_key.to_string().hex(), message, sig.hex())
print(f"Good signature: {msg}")

# Tampered message
tampered_message = b"Send 100 BTC"
valid, msg = safe_verify(public_key.to_string().hex(), tampered_message, sig.hex())
print(f"Tampered message: {msg}")

# Random bytes as signature
valid, msg = safe_verify(public_key.to_string().hex(), message, "deadbeef" * 32)
print(f"Corrupt signature: {msg}")