<p>Details are in <a href="https://github.com/bitcoin/bips/blob/master/bip-0146.mediawiki" rel="nofollow noreferrer">BIP 146</a>:</p>
<blockquote>
<p>We require that the S value inside ECDSA signatures is at most the curve order divided by 2...</p>
<p>...</p>
<p>A high S value in signature could be trivially replaced by S' = 0xFFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141 - S.</p>
</blockquote>
<p>Signatures encode two important values for verification <code>r</code> and <code>S</code>. If <code>(r, S)</code> is a valid signature, then so is <code>(r, -S)</code>, which is equivalent to <code>(r, curver_order -S)</code>.</p>

CC BY-SA 4.0
2019-04-09T14:26:51.357Z
Maybe I've understood. Before BIP 146, a relay node could invalidate my trx using the higher s value, which is mathematically equals, but it would have result in a completely different trx hash. So low-s value is a care for the trx malleability?
dcfg
CC BY-SA 4.0
2019-04-09T15:59:19.023Z
Yes, both transactions would be valid, but with different signatures and TX hash. Yes, it's against TX (and TXID) malleability @dc_Bita98
MCCCS
CC BY-SA 4.0
2019-04-09T13:51:50.057Z
2019-04-09T13:51:50.057Z
2020-06-16T11:10:03.350Z
MCCCS
<p>What are the problems related in using the "normal" ( bigger than N/2) value of the <strong>s</strong> number in transaction signature and why we use the lower one?
Is it about the math behind the ecdsa?</p>

<signature><cryptography><ecdsa><math>
Low-s value in bitcoin signature
dcfg
# Low-s value in bitcoin signature

(Asked by: username_0 on 2019-04-09)

What are the problems related in using the "normal" ( bigger than N/2) value of the **s** number in transaction signature and why we use the lower one?
Is it about the math behind the ecdsa?

**Tags:** signature, cryptography, ecdsa, math


---

## 1 answers

### Answer by username_1 on 2019-04-09. Score: 2 | Accepted answer

Details are in [BIP 146](https://github.com/bitcoin/bips/blob/master/bip-0146.mediawiki):

> We require that the S value inside ECDSA signatures is at most the curve order divided by 2...
>
> ...
>
> A high S value in signature could be trivially replaced by S' = 0xFFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141 - S.

Signatures encode two important values for verification `r` and `S`. If `(r, S)` is a valid signature, then so is `(r, -S)`, which is equivalent to `(r, curver_order -S)`.

> **Comments:**
> **username_0**: Maybe I've understood. Before BIP 146, a relay node could invalidate my trx using the higher s value, which is mathematically equals, but it would have result in a completely different trx hash. So low-s value is a care for the trx malleability?  
> **username_1**: Yes, both transactions would be valid, but with different signatures and TX hash. Yes, it's against TX (and TXID) malleability @dc_Bita98  

---

