# A Survey on Consensus Protocols and Attacks on Blockchain Technology
## 9 ECDSA [Elliptic Curve Digital Signature Algorithm]  
We are aware of the current widespread use of ECDSA in blockchain-based systems and cryptocurrencies [30]. Data integrity is guaranteed using the ECDSA method to avoid data manipulation. [PERSON] put forth this algorithm in 1992. In any network, the data integrity of the message is crucial because an attacker can alter the information as it is transmitted from source to destination. For the secure transmission of data, many blockchain-based systems used the ECDSA. The ECDSA is now used by several cryptocurrencies and blockchain-based platforms [29]. However, the ECDSA has a problem; the elliptic curve (EC) backdoors are utilized. In this section, we address the ECDSA, which is currently used in blockchain-based systems and cryptocurrency. We have preiosuly described how the ECDSA works in blockchain security.  
The EC works as follows:  
Let GF (f), be a prime field.  
Then let s, t GF (f) be constants, such that 4s3 + 27t2 = 0. An EC E(s, t), over GF(f) is considered as the set of points (x, y) \(\in\) GF (f) \(*\) GF (f) which fulfil the (1)'s requirement:  
\[y2=x3+Sx+T \tag{1}\]  
Here, S and T are constants and O is the point at infinity.  
In the elliptic curve discrete logarithm problem (ECDLP) it is well known that:  
If G is a group, then we use the ECDLP to get the integer a, for group elements S and T in such a way that T = aS.  
Current markets require algorithms that are faster in computation, and the ECDSA [29] is one of them.  
We know that the ECDSA has three steps:  
1. Generation of key
2. Generation of signature
3. Verification of signature.  
In the generation of key or parameter step, the required chosen EC is well-defined over a finite field Fc with the characteristic c, and with a base point G Ec(s, t) with an order of n.  
Then we select a random integer h so that \(1\leq h\leq n-1\).  
Then it computes T = hG.  
Here, the public key pair is (T, h).  
In the signature generation step for signing a message m, the signer follows the steps:  
Step 1 is selecting an integer k in such a way that \(1\leq k\leq n-1\).  
Step 2 is computing kG = (x1, y1).  
Step 3 is computing r = x1 mod n, and in the case of r = 0, then we have to select new k.  
Step 4 is calculating k\(-1\) mod n and e = h(m).  
Step 5 is computing s = p\(-1\)(e + kr), if s = 0 then it should go back to step 1.  
So (r, s) is the generated signature for the message m.  
In the verification of signature step for verifying the signature (r, s) of message m, verifier V follows these steps:  
Step 1 is V checks whether r, s \(\in[1,n-1]\).  
Step 2 is to compute e = h(m) and s \(-1\).  
Step 3 involves the computation of u = es \(-1\) mod n and v = rs \(-1\) mod n.  
Step 4 involves the computation of w = (x2, y2) = uG + vT, if w = 0 then stop, otherwise to compute t = x2 mod n.  
The signature is valid in one case, that is t = r.  
Proof of verification process is as below in (2):  
\[\begin{split}\text{kG}=\text{s}-1&(\text{e}+\text{ kr})\text{G}\bmod\text{n}\\ &=\text{s}-1&\text{eG}+\text{s}-1\text{rkG}\bmod \text{n}\\ &=\text{uG}+\text{vQ}\bmod\text{n}\end{split} \tag{2}\]  
Therefore, uG + vT = kG and so t = r, which is requisite.