<p>Alternatively, you could use <a href="https://github.com/bitcoin-core/secp256k1/" rel="nofollow noreferrer">libsecp256k1</a>. This is the code used by Bitcoin Core for signing, and will automatically create low-S signatures (disclaimer: I'm the main author of that library).
Perhaps a Go wrapper exists.</p>

<p>If you stick to OpenSSL, it is possible to manually adjust the S value after signing. This is what Bitcoin Core used to do before v0.10. Here is what it used to do: <a href="https://github.com/bitcoin/bitcoin/blob/v0.9.0/src/key.cpp#L204L224" rel="nofollow noreferrer">https://github.com/bitcoin/bitcoin/blob/v0.9.0/src/key.cpp#L204L224</a></p>

CC BY-SA 3.0
2017-09-22T18:42:20.710Z
Such a disclaimer though.
sr_gi
CC BY-SA 3.0
2017-09-21T19:59:03.903Z
2017-09-23T09:20:52.980Z
2017-09-23T09:20:52.980Z
Pieter Wuille
<p>Open SSL won't force it, you will have to do it yourself. From BIP 62:</p>

<blockquote>
  <p>The value S in signatures must be between 0x1 and 0x7FFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 5D576E73 57A4501D DFE92F46 681B20A0 (inclusive). If S is too high, simply replace it by S' = 0xFFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141 - S.</p>
</blockquote>

<p><a href="https://github.com/bitcoin/bips/blob/master/bip-0062.mediawiki#Low_S_values_in_signatures" rel="nofollow noreferrer">Source</a></p>

CC BY-SA 3.0
2017-09-22T06:57:38.957Z
The question then is: How can I set that s value using OpenSSL? I couldn't find a parameter to set it
soupdiver
CC BY-SA 3.0
2017-09-22T11:45:02.710Z
@soupdiver: those numbers are, not coincidentally, the order of the group for secp256k1 and one-half the order (rounded down). If you have an EC_GROUP for secp25k1 use EC_GROUP_get[0]_order; if you have an EC_KEY use EC_KEY_get0_group first. Once you have the order BN_dup BN_rshift1 BN_cmp and BN_sub on the value from the ECDSA_SIG should be sufficient.
dave_thompson_085
CC BY-SA 3.0
2017-09-22T11:46:57.580Z
I don't really understand the last comment
soupdiver
CC BY-SA 3.0
2017-09-22T11:52:58.010Z
@soupdiver you don't need to 'set it in OpenSSL', you just use it, the s value is a component of the final signature.
meshcollider
CC BY-SA 3.0
2017-09-22T13:02:17.643Z
yeah I understand this. I'm wondering if there is a way to set this value if it's too big and therefor rejected by the network
soupdiver
CC BY-SA 3.0
2017-09-22T22:50:53.993Z
@soupdiver I've explained what to do, calculate the low s value like I explained in my question and put that in the bitcoin transaction signature. That's all you need to do
meshcollider
CC BY-SA 3.0
2017-09-21T19:42:08.780Z
2017-09-21T19:42:08.780Z
meshcollider
<blockquote>
  <p>Is there a way to create proper signatures with OpenSSL except trying
  and hoping to get a small s value?</p>
</blockquote>

<p>If the speed is not significant - this is not bad idea. </p>

<p>update: take some pseudocode:</p>

<pre><code>while ( true )
{
  signature = createOpenSslSignature ( params );
  if ( !signature.toHex ( ).contains ( "022100" ) )
    return signature;
}
</code></pre>

CC BY-SA 3.0
2017-09-22T06:58:26.853Z
I would prefer to create "proper" signatures directly and not having to brute force it :)
soupdiver
CC BY-SA 3.0
2017-09-22T16:59:41.927Z
answer updated. this in not brute-forcing. and this is not best solution. but this is simplest implementation :)
amaclin
CC BY-SA 3.0
2017-09-21T19:04:01.150Z
2017-09-22T16:57:51.803Z
2017-09-22T16:57:51.803Z
amaclin
<p>I currently try to sign a tx using OpenSSL. After some tinkering I think I got most of the tx right but Electrum complains with <code>mandatory-script-verify-flag-failed (Non-canonical signature: S value is unnecessarily high)</code> which is probably because of <a href="https://github.com/bitcoin/bips/blob/master/bip-0062.mediawiki#low-s-values-in-signatures" rel="nofollow noreferrer">BIP62</a>.</p>

<p>Is there a way to create proper signatures with OpenSSL except trying and hoping to get a small <code>s</code> value?</p>

<p>The rest of my code is in Golang and I couldn't find a proper packages for the used ECDSA curve and so wrapped around OpenSSL.</p>

<transactions><signature><ecdsa><openssl>
Sign a tx with "low s" value using OpenSSL
soupdiver
# Sign a tx with "low s" value using OpenSSL

(Asked by: username_0 on 2017-09-21)

I currently try to sign a tx using OpenSSL. After some tinkering I think I got most of the tx right but Electrum complains with `mandatory-script-verify-flag-failed (Non-canonical signature: S value is unnecessarily high)` which is probably because of [BIP62](https://github.com/bitcoin/bips/blob/master/bip-0062.mediawiki#low-s-values-in-signatures).

Is there a way to create proper signatures with OpenSSL except trying and hoping to get a small `s` value?

The rest of my code is in Golang and I couldn't find a proper packages for the used ECDSA curve and so wrapped around OpenSSL.

**Tags:** transactions, signature, ecdsa, openssl


---

## 3 answers

### Answer by username_1 on 2017-09-21. Score: 5

Alternatively, you could use [libsecp256k1](https://github.com/bitcoin-core/secp256k1/). This is the code used by Bitcoin Core for signing, and will automatically create low-S signatures (disclaimer: I'm the main author of that library).
Perhaps a Go wrapper exists.

If you stick to OpenSSL, it is possible to manually adjust the S value after signing. This is what Bitcoin Core used to do before v0.10. Here is what it used to do: <https://github.com/bitcoin/bitcoin/blob/v0.9.0/src/key.cpp#L204L224>

> **Comments:**
> **username_2**: Such a disclaimer though.  

---

### Answer by username_3 on 2017-09-21. Score: 2

Open SSL won't force it, you will have to do it yourself. From BIP 62:

> The value S in signatures must be between 0x1 and 0x7FFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF 5D576E73 57A4501D DFE92F46 681B20A0 (inclusive). If S is too high, simply replace it by S' = 0xFFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141 - S.

[Source](https://github.com/bitcoin/bips/blob/master/bip-0062.mediawiki#Low_S_values_in_signatures)

> **Comments:**
> **username_0**: The question then is: How can I set that s value using OpenSSL? I couldn't find a parameter to set it  
> **username_4**: @username_0: those numbers are, not coincidentally, the order of the group for secp256k1 and one-half the order (rounded down). If you have an EC_GROUP for secp25k1 use EC_GROUP_get[0]_order; if you have an EC_KEY use EC_KEY_get0_group first. Once you have the order BN_dup BN_rshift1 BN_cmp and BN_sub on the value from the ECDSA_SIG should be sufficient.  
> **username_0**: I don't really understand the last comment  
> **username_3**: @username_0 you don't need to 'set it in OpenSSL', you just use it, the s value is a component of the final signature.  
> **username_0**: yeah I understand this. I'm wondering if there is a way to set this value if it's too big and therefor rejected by the network  
> **username_3**: @username_0 I've explained what to do, calculate the low s value like I explained in my question and put that in the bitcoin transaction signature. That's all you need to do  

---

### Answer by username_5 on 2017-09-21. Score: 0

Is there a way to create proper signatures with OpenSSL except trying
  and hoping to get a small s value?

If the speed is not significant - this is not bad idea. 
update: take some pseudocode:
while ( true )
{
  signature = createOpenSslSignature ( params );
  if ( !signature.toHex ( ).contains ( "022100" ) )
    return signature;
}

> **Comments:**
> **username_0**: I would prefer to create "proper" signatures directly and not having to brute force it :)  
> **username_5**: answer updated. this in not brute-forcing. and this is not best solution. but this is simplest implementation :)  

---

