A Bitcoin signature consists of two numbers, r and s. The procedure that produces them can be done in five lines, the verification in three, and the reason it works boils down to a single algebraic substitution. This lesson covers all three.
Let's start with the inputs. The signed message is the transaction, summarized by SHA-256 and read as a number, called z. The private key is the number d, and the public key is the point Q, which equals d times G. There's also a third ingredient, randomly chosen at the moment, the nonce k.
Signing involves four steps. Randomly choose k between one and n minus one. Calculate the point k times G and take its x-coordinate, reduced modulo n: that's r. Calculate s as the inverse of k multiplied by the sum of z and r times d, all modulo n. The signature is the pair r, s. If r or s is zero, choose another k — which practically never happens.
Notice that the private key d appears only once, in the third line, mixed with z and protected by multiplication with the inverse of k. Nothing in r or s allows it to be isolated — as long as k is different each time, and the next lesson is entirely about what happens when it isn't.
Verification involves three steps, and the verifier only has the transaction, the public key Q, and the pair r, s. Calculate the inverse of s modulo n. Multiply z by it and call it u1; multiply r by it and call it u2. Add the points u1 times G and u2 times Q. The signature is valid if the x-coordinate of the resulting point, reduced modulo n, equals r.
Now for the substitution that explains everything. The point calculated in verification is u1 times G plus u2 times Q. Replacing Q with d times G, this becomes the inverse of s multiplying the sum of z and r times d, all times G. But s was defined exactly as the inverse of k times that same sum — so the inverse of s times the sum is simply k. The point produced by verification is k times G: precisely the point the signer calculated in the second step, and whose x-coordinate became the r being compared.
That's why verification works without revealing anything. The verifier doesn't discover d, doesn't discover k, and never knows what the random choice was. They simply reconstruct the same point through a different path and confirm that the two paths meet.
Three practical details wrap up the topic.
The first is that r only retains the x-coordinate of the point, and the height is discarded. Since each x corresponds to two points, one above and one below the axis, the signature alone doesn't indicate which one it was. That's why recovering the public key from a signature requires an extra recovery bit, and why a common transaction carries the public key instead of deducing it.
The second is an inconvenient consequence of symmetry. For every valid signature with the value s, the value n minus s is also valid — two different pairs proving the same thing. This allowed altering the identifier of a transaction without invalidating it, the flaw mentioned in the block size war. Since 2016, the network requires the smaller of the two values, and the other path is closed.
The third is the packaging. The two numbers travel in a format inherited from certificate standards, DER, which uses seventy to seventy-two bytes due to length and type markers. The Schnorr signature, which Taproot introduced, has a fixed sixty-four bytes with no embellishments — part of the efficiency of that update lies here.
The math in this lesson is solid and has never been broken. What has been broken, with real losses and in more than one famous case, is the random choice in the third line. In the next lesson, the repeated nonce and the high school algebra that gives away the private key.