<p>According to Nils's post, the <code>z</code> values are the hashes that get signed in the ECDSA formula.  Background on what data goes into these hashes can be found on the <a href="https://en.bitcoin.it/wiki/OP_CHECKSIG" rel="nofollow">OP_CHECKSIG wiki page</a> and Krzysztof Okupski's excellent <a href="https://github.com/minium/Bitcoin-Spec" rel="nofollow">developer reference PDF</a>.</p>

<p>Bitcoin Core's code for generating the hashes is <a href="https://github.com/bitcoin/bitcoin/blob/master/src/script/sign.cpp#L94" rel="nofollow">here</a>.  Any other Bitcoin application that signs transactions (or verifies signatures) must have a compatible function (at least for the default SIGHASH_ALL), so you should be able to find an implementation in pretty much any popular programming language.</p>

CC BY-SA 3.0
2015-01-17T21:40:31.520Z
2015-01-17T21:40:31.520Z
David A. Harding
<p>paste your transaction into this page
<a href="https://2xoin.com/getRSZfromRawTX/" rel="nofollow noreferrer">https://2xoin.com/getRSZfromRawTX/</a></p>
<p>it will give you all the R,S and Z if it was able to decode the TX.</p>
<p>for example,
<code>0100000002f64c603e2f9f4daf70c2f4252b2dcdb07cc0192b7238bc9c3dacbae555baf701010000008a4730440220d47ce4c025c35ec440bc81d99834a624875161a26bf56ef7fdc0f5d52f843ad1022044e1ff2dfd8102cf7a47c21d5c9fd5701610d04953c6836596b4fe9dd2f53e3e014104dbd0c61532279cf72981c3584fc32216e0127699635c2789f549e0730c059b81ae133016a69c21e23f1859a95f06d52b7bf149a8f2fe4e8535c8a829b449c5ffffffffff29f841db2ba0cafa3a2a893cd1d8c3e962e8678fc61ebe89f415a46bc8d9854a010000008a4730440220d47ce4c025c35ec440bc81d99834a624875161a26bf56ef7fdc0f5d52f843ad102209a5f1c75e461d7ceb1cf3cab9013eb2dc85b6d0da8c3c6e27e3a5a5b3faa5bab014104dbd0c61532279cf72981c3584fc32216e0127699635c2789f549e0730c059b81ae133016a69c21e23f1859a95f06d52b7bf149a8f2fe4e8535c8a829b449c5ffffffffff01a0860100000000001976a91470792fb74a5df745bac07df6fe020f871cbb293b88ac00000000</code></p>
<p>will output</p>
<pre><code>[
  {
    &quot;sigR&quot;: &quot;d47ce4c025c35ec440bc81d99834a624875161a26bf56ef7fdc0f5d52f843ad1&quot;,
    &quot;sigS&quot;: &quot;44e1ff2dfd8102cf7a47c21d5c9fd5701610d04953c6836596b4fe9dd2f53e3e&quot;,
    &quot;sigZ&quot;: &quot;c0e2d0a89a348de88fda08211c70d1d7e52ccef2eb9459911bf977d587784c6e&quot;,
    &quot;pubKey&quot;: &quot;04dbd0c61532279cf72981c3584fc32216e0127699635c2789f549e0730c059b81ae133016a69c21e23f1859a95f06d52b7bf149a8f2fe4e8535c8a829b449c5ff&quot;,
    &quot;N&quot;: 0
  },
  {
    &quot;sigR&quot;: &quot;d47ce4c025c35ec440bc81d99834a624875161a26bf56ef7fdc0f5d52f843ad1&quot;,
    &quot;sigS&quot;: &quot;9a5f1c75e461d7ceb1cf3cab9013eb2dc85b6d0da8c3c6e27e3a5a5b3faa5bab&quot;,
    &quot;sigZ&quot;: &quot;17b0f41c8c337ac1e18c98759e83a8cccbc368dd9d89e5f03cb633c265fd0ddc&quot;,
    &quot;pubKey&quot;: &quot;04dbd0c61532279cf72981c3584fc32216e0127699635c2789f549e0730c059b81ae133016a69c21e23f1859a95f06d52b7bf149a8f2fe4e8535c8a829b449c5ff&quot;,
    &quot;N&quot;: 1
  }
]
`
</code></pre>

CC BY-SA 4.0
2019-03-07T16:49:17.560Z
2020-12-27T15:50:46.250Z
2020-12-27T15:50:46.250Z
Sean Bradley
<p>By following <a href="http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html" rel="nofollow noreferrer">Recovering Bitcoin private keys using weak signatures from the blockchain</a>, I am able to do other calculations, but I have no idea how to calculate <code>Z1</code> or <code>Z2</code>. There was a public code available by <a href="https://bitcoin.stackexchange.com/a/32546/2306">Sean Bradley</a>:</p>

<p><a href="http://2coin.org/tx.asmx?op=GetTXExtended" rel="nofollow noreferrer">http://2coin.org/tx.asmx?op=GetTXExtended</a></p>

<p>But it does not seems to work now. Is there some other public code to calculate <code>Z1</code> and <code>Z2</code> in any language. I can convert it to the language of my preference. Any help is appreciated.</p>

CC BY-SA 3.0
2015-01-17T19:14:42.317Z
Could you maybe describe what you want this for?  I don't want to unintentionally help someone steal other people's bitcoins.
David A. Harding
CC BY-SA 3.0
2015-01-17T21:11:32.430Z
@DavidA.Harding I am a security researcher and want to replicate this attack. All the vulnerable addresses are already on internet and empty. And vulnerable applications are already fixed. I just want to replicate this nothing else.
user1111111111111
CC BY-SA 3.0
2015-01-17T21:46:25.133Z
I provided an answer.  However, the attack Nils's describes is just a basic re-used `k` value attack.  If you really want to replicate it, you'll find it much simpler jettisoning Bitcoin's baggage and doing the math for your own arbitrary hashed data.  Even Wikipedia has [instructions for doing this](https://en.wikipedia.org/wiki/Elliptic_Curve_DSA#Signature_generation_algorithm).
David A. Harding
<private-key><ecdsa><recover-private-key>
Where can I find code that allows me to calculate Z1 and Z2 from an ECDSA signature?
user1111111111111
# Where can I find code that allows me to calculate Z1 and Z2 from an ECDSA signature?

(Asked by: username_0 on 2015-01-17)

By following [Recovering Bitcoin private keys using weak signatures from the blockchain](http://www.nilsschneider.net/2013/01/28/recovering-bitcoin-private-keys.html), I am able to do other calculations, but I have no idea how to calculate `Z1` or `Z2`. There was a public code available by [username_2](https://bitcoin.stackexchange.com/a/32546/2306):

<http://2coin.org/tx.asmx?op=GetTXExtended>

But it does not seems to work now. Is there some other public code to calculate `Z1` and `Z2` in any language. I can convert it to the language of my preference. Any help is appreciated.

**Tags:** private-key, ecdsa, recover-private-key

> **Comments:**
> **username_1**: Could you maybe describe what you want this for?  I don't want to unintentionally help someone steal other people's bitcoins.  
> **username_0**: @DavidA.Harding I am a security researcher and want to replicate this attack. All the vulnerable addresses are already on internet and empty. And vulnerable applications are already fixed. I just want to replicate this nothing else.  
> **username_1**: I provided an answer.  However, the attack Nils's describes is just a basic re-used `k` value attack.  If you really want to replicate it, you'll find it much simpler jettisoning Bitcoin's baggage and doing the math for your own arbitrary hashed data.  Even Wikipedia has [instructions for doing this](https://en.wikipedia.org/wiki/Elliptic_Curve_DSA#Signature_generation_algorithm).  

---

## 2 answers

### Answer by username_1 on 2015-01-17. Score: 4

According to Nils's post, the `z` values are the hashes that get signed in the ECDSA formula. Background on what data goes into these hashes can be found on the [OP\_CHECKSIG wiki page](https://en.bitcoin.it/wiki/OP_CHECKSIG) and Krzysztof Okupski's excellent [developer reference PDF](https://github.com/minium/Bitcoin-Spec).

Bitcoin Core's code for generating the hashes is [here](https://github.com/bitcoin/bitcoin/blob/master/src/script/sign.cpp#L94). Any other Bitcoin application that signs transactions (or verifies signatures) must have a compatible function (at least for the default SIGHASH\_ALL), so you should be able to find an implementation in pretty much any popular programming language.


---

### Answer by username_2 on 2019-03-07. Score: 0

paste your transaction into this page
https://2xoin.com/getRSZfromRawTX/
it will give you all the R,S and Z if it was able to decode the TX.
for example,
0100000002f64c603e2f9f4daf70c2f4252b2dcdb07cc0192b7238bc9c3dacbae555baf701010000008a4730440220d47ce4c025c35ec440bc81d99834a624875161a26bf56ef7fdc0f5d52f843ad1022044e1ff2dfd8102cf7a47c21d5c9fd5701610d04953c6836596b4fe9dd2f53e3e014104dbd0c61532279cf72981c3584fc32216e0127699635c2789f549e0730c059b81ae133016a69c21e23f1859a95f06d52b7bf149a8f2fe4e8535c8a829b449c5ffffffffff29f841db2ba0cafa3a2a893cd1d8c3e962e8678fc61ebe89f415a46bc8d9854a010000008a4730440220d47ce4c025c35ec440bc81d99834a624875161a26bf56ef7fdc0f5d52f843ad102209a5f1c75e461d7ceb1cf3cab9013eb2dc85b6d0da8c3c6e27e3a5a5b3faa5bab014104dbd0c61532279cf72981c3584fc32216e0127699635c2789f549e0730c059b81ae133016a69c21e23f1859a95f06d52b7bf149a8f2fe4e8535c8a829b449c5ffffffffff01a0860100000000001976a91470792fb74a5df745bac07df6fe020f871cbb293b88ac00000000
will output
[
  {
    "sigR": "d47ce4c025c35ec440bc81d99834a624875161a26bf56ef7fdc0f5d52f843ad1",
    "sigS": "44e1ff2dfd8102cf7a47c21d5c9fd5701610d04953c6836596b4fe9dd2f53e3e",
    "sigZ": "c0e2d0a89a348de88fda08211c70d1d7e52ccef2eb9459911bf977d587784c6e",
    "pubKey": "04dbd0c61532279cf72981c3584fc32216e0127699635c2789f549e0730c059b81ae133016a69c21e23f1859a95f06d52b7bf149a8f2fe4e8535c8a829b449c5ff",
    "N": 0
  },
  {
    "sigR": "d47ce4c025c35ec440bc81d99834a624875161a26bf56ef7fdc0f5d52f843ad1",
    "sigS": "9a5f1c75e461d7ceb1cf3cab9013eb2dc85b6d0da8c3c6e27e3a5a5b3faa5bab",
    "sigZ": "17b0f41c8c337ac1e18c98759e83a8cccbc368dd9d89e5f03cb633c265fd0ddc",
    "pubKey": "04dbd0c61532279cf72981c3584fc32216e0127699635c2789f549e0730c059b81ae133016a69c21e23f1859a95f06d52b7bf149a8f2fe4e8535c8a829b449c5ff",
    "N": 1
  }
]
`


---

