<p>Yes, but that is hard. This is known as a collision, and you would be finding a collision in SHA256. Because you would be reusing a known hash, what you would be doing is performing a preimage attack. Since SHA256 has no known preimage attack for all 64 rounds done in a normal SHA256 hash, you would need to do 2^256 hashes in order to be guaranteed to have found a colliding preimage for that hash.</p>

<p>This is why a cryptographically secure hash is used for signing operations.</p>

CC BY-SA 3.0
2017-08-28T01:41:52.793Z
2017-08-28T01:41:52.793Z
Ava Chow
<p>From <a href="https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm#Signature_generation_algorithm" rel="nofollow noreferrer">here</a> you get that in step 2 of ECDSA sign process, you use 
<em>z</em>, the <em>Ln</em>  leftmost bits of <em>e</em> = HASH(message/transaction) in both the process of generating and verifing the signature.</p>

<p>I understand that in bitcoin transactions signature and verification you do almost the same algorithm.</p>

<p>So...</p>

<p>You know that adress <strong>A</strong> has a transaction <em>x</em> to it that values in 1 BTC not spent.</p>

<p>You know also a transaction <em>y1</em> from <strong>A</strong> with a certain signature and a certain value <em>z1</em>, as the algorithm in the link says.</p>

<p>Could you create a transaction <em>y2</em> so that it sends the 1 BTC from <strong>A</strong> to adress <strong>B</strong> by creating it in a way that it had the same <em>z1</em> (mentioned above) and consequently the same signature of <em>y1</em>? (since signature depends only on message (<em>z</em>), private key and the random value <em>k</em>)</p>

<p>This transaction <em>y2</em> would be valid?</p>

<transactions><ecdsa><validation>
Possibility of contructing a valid transaction without knowning private key
Legust
# Possibility of contructing a valid transaction without knowning private key

(Asked by: username_0 on 2017-08-28)

From [here](https://en.wikipedia.org/wiki/Elliptic_Curve_Digital_Signature_Algorithm#Signature_generation_algorithm) you get that in step 2 of ECDSA sign process, you use
*z*, the *Ln* leftmost bits of *e* = HASH(message/transaction) in both the process of generating and verifing the signature.

I understand that in bitcoin transactions signature and verification you do almost the same algorithm.

So...

You know that adress **A** has a transaction *x* to it that values in 1 BTC not spent.

You know also a transaction *y1* from **A** with a certain signature and a certain value *z1*, as the algorithm in the link says.

Could you create a transaction *y2* so that it sends the 1 BTC from **A** to adress **B** by creating it in a way that it had the same *z1* (mentioned above) and consequently the same signature of *y1*? (since signature depends only on message (*z*), private key and the random value *k*)

This transaction *y2* would be valid?

**Tags:** transactions, ecdsa, validation


---

## 1 answers

### Answer by username_1 on 2017-08-28. Score: 3 | Accepted answer

Yes, but that is hard. This is known as a collision, and you would be finding a collision in SHA256. Because you would be reusing a known hash, what you would be doing is performing a preimage attack. Since SHA256 has no known preimage attack for all 64 rounds done in a normal SHA256 hash, you would need to do 2^256 hashes in order to be guaranteed to have found a colliding preimage for that hash.

This is why a cryptographically secure hash is used for signing operations.


---

