From Wikipedia:

  • Check that $Q_a$ is not equal to the identity element $O$, and its coordinates are otherwise valid.
  • Check that $Q_a$ lies on the curve.
  • Check that $n*Q_a = O$
  • Verify that $r$ and $s$ are integers in $[\![1;n-1]\!]$. If not, the signature is invalid.

What is the mathematical reason for these checks and what can an attacker do if these checks are not carried out properly?

  • 1
    $\begingroup$ first 3 is to make sure that we are working in the correct setup. 4th for preventing simple forgeries by sending $r+n$ and $s+n$ instead of $r$ and $s$ $\endgroup$ – kelalaka Sep 17 at 22:17
  • $\begingroup$ @kelalaka could you explain this in more detail? $\endgroup$ – enriquejr99 Sep 18 at 6:02

Your Answer


Browse other questions tagged or ask your own question.