<p>ECDSA signatures are pairs (r,s) such that <em>r = x(m/s*G + r/s*P) mod n</em>, where <em>P</em> is the public key and <em>m</em> is the message digest. <em>x()</em> in that equation means &quot;the X coordinate of&quot;.</p>
<p>In that equation, if you substitute <em>s = -s'</em>, you get <em>r = x(m/(-s')*G + r/(-s)*P) mod n</em>, or <em>r = x(-(m/s'*G + r/s'*P))</em>.</p>
<p>However, it is true that for any point <em>Q</em>, <em>x(Q) = x(-Q)</em>, as negating a point only affects the Y coordinate. Thus, <em>r = x(m/s'*G + r/s'*P) mod n</em>, or <em>(r,s')</em> is valid signature whenever <em>(r,s)</em> is.</p>

CC BY-SA 4.0
2019-01-05T22:31:49.293Z
Thank you very much. I understand negating a scalar over ff, but not why that negated scalar * point will result in a point with the same x-coord as scalar * point.
James C.
CC BY-SA 4.0
2022-10-19T13:19:53.110Z
@JamesC. That follows from the group law definition, which says that `(x,y) + (x,-y) = 0`. This can be rearranged to `(x,-y) = 0 - (x,y) = -(x,y)`. There isn't any particularly deep insight here, it's just how elliptic curve point addition is defined.
Pieter Wuille
CC BY-SA 4.0
2019-01-05T22:20:20.843Z
2022-12-21T20:28:36.030Z
2022-12-21T20:28:36.030Z
Pieter Wuille
<p>I am trying to find resources in previous malleability posts, but couldn't find derivations/proofs of this fact or how the exact low-s value is derived. Any pointers would greatly appreciated.</p>

<ecdsa><transaction-malleability>
In ECDSA, why is (r,−s mod n) complementary to (r, s)?
James C.
# In ECDSA, why is (r,−s mod n) complementary to (r, s)?

(Asked by: username_0 on 2019-01-05)

I am trying to find resources in previous malleability posts, but couldn't find derivations/proofs of this fact or how the exact low-s value is derived. Any pointers would greatly appreciated.

**Tags:** ecdsa, transaction-malleability


---

## 1 answers

### Answer by username_1 on 2019-01-05. Score: 4 | Accepted answer

ECDSA signatures are pairs (r,s) such that *r = x(m/s\*G + r/s\*P) mod n*, where *P* is the public key and *m* is the message digest. *x()* in that equation means "the X coordinate of".

In that equation, if you substitute *s = -s'*, you get *r = x(m/(-s')\*G + r/(-s)\*P) mod n*, or *r = x(-(m/s'\*G + r/s'\*P))*.

However, it is true that for any point *Q*, *x(Q) = x(-Q)*, as negating a point only affects the Y coordinate. Thus, *r = x(m/s'\*G + r/s'\*P) mod n*, or *(r,s')* is valid signature whenever *(r,s)* is.

> **Comments:**
> **username_0**: Thank you very much. I understand negating a scalar over ff, but not why that negated scalar * point will result in a point with the same x-coord as scalar * point.  
> **username_1**: @JamesC. That follows from the group law definition, which says that `(x,y) + (x,-y) = 0`. This can be rearranged to `(x,-y) = 0 - (x,y) = -(x,y)`. There isn't any particularly deep insight here, it's just how elliptic curve point addition is defined.  

---

