Skip to content
hashkey.bond

Archivecryptography

ECDSA Signatures Are Malleable

For every valid ECDSA signature there is a second valid one. Systems that assume uniqueness get burned.

Published
Reading time
1 min read

An ECDSA signature is (r, s). Because the curve equation is symmetric in y, replacing s with n - s produces another signature that verifies against the same message and key. Same signer, same message, different bytes.

Why that matters

  • Transaction IDs: early Bitcoin wallets produced two valid encodings of one transaction, so a txid could change after broadcast. The fix was to require low-s signatures (BIP-62) and to make txids independent of signatures (SegWit).
  • Replay and dedup logic: if you deduplicate by signature bytes, an attacker can resubmit the same authorization with a different encoding.
  • Signature counters: "one signature per message" is false unless you canonicalize.

The fixes

  1. Canonicalize: reject s > n/2.
  2. Use Ed25519, whose signatures are deterministic and non-malleable by construction.
  3. Never treat signature bytes as a unique identifier.

Takeaway: signatures prove authorization, not identity of bytes. Hash the signed payload if you need a stable ID.