Talk:Elliptic Curve Digital Signature Algorithm

message: I realize that this is a very dense topic, but this article is barely readable.  The jargon should be trimmed down, and perhaps we can add some more encyclopedic content, like present-day usage of ECDSA (technologies like WAP and SSL to name a couple).  —Preceding unsigned comment added by 70.172.221.26 (talk) 00:30, 2 April 2008 (UTC)
thread_title:  Jargon / readability 

message: It is a common error to use the complete hash value with modular reduction in signature computation. The standards require instead a truncation (cf. the references given in the article).
Annie Yousar (talk) 13:03, 17 June 2009 (UTC)
thread_title:  Use the hash value $e$ or not? 

message: # Is it possible to show an example (with smaller numbers, of course) to demonstrate what operations are done? 
# if the private key is just a "random number" of n bits, how can the public key be calculated from it?
--RokerHRO (talk) 16:46, 14 September 2014 (UTC)
thread_title:  Example computation, like in RSA? 

message: Current text mentions "a security level of 80 bits (meaning an attacker requires a maximum of about 2 80 {\displaystyle 2^{80}} 2^{80} operations to find the private key)". That seems badly flawed to me. I'd like to be able to say minimum instead of maximum to define the security level, but I do not see how that would be possible.
However, average would be more useful and does seem possible; that is how the level is defined in other contexts. For example breaking a block cipher with an n-bit key by brute force takes 2n-1 encryptions on average. The minimum is 1 and the maximum 2n, but those numbers are not usually mentioned.
There may be other problems as well. Finding the private key is the most devastating attack, but far from the only one. For example, if it takes only, say, 240 effort to find a collision, then arguably the system has only 40-bit security no matter how expensive finding the key is. Pashley (talk) 16:51, 28 August 2017 (UTC)
replies: text: It's just a convention to talk about n-bits of security. From there you can estimate, for example, that 80-bit security is in the "possible to brute force, but at great expense" ballpark. But you're right, there are more informative ways to discuss specific aspects of resistance to attack. Maghnus (talk) 08:42, 9 June 2018 (UTC)
thread_title:  Security level 

message: More information please refer to 
* https://crypto.stackexchange.com/questions/42134/ecdsa-pubkey-recovery-issue
* https://stackoverflow.com/questions/19665491/how-do-i-get-an-ecdsa-public-key-from-just-a-bitcoin-signature-sec1-4-1-6-k
* https://crypto.stackexchange.com/questions/18105/how-does-recovering-the-public-key-from-an-ecdsa-signature-work
* https://bitcointalk dot org/index.php?topic=783694.0
Jack Jackzhp (talk) 03:37, 20 November 2017 (UTC)
thread_title: Public key can be recovered from signature

message: Currently, the wikipedia web site seems to be using TLS 1.2:
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1035_SHA256, 256 bit keys,
So, browsers show the lock icon because wikipedia signed something with ECDSA, and browser has verified the signature (and validate the certificate for the ECDSA signing key).
Is this fact worth putting into the main article (with a proper explanation)?  — Preceding unsigned comment added by DRLB (talk • contribs) 19:23, 24 November 2017 (UTC)
replies: text: Agree. David Spector (talk) 15:11, 2 September 2020 (UTC)

text: Using WP (or any other website) as an example doesn't seem like a great idea - it's inherently at the mercy of configuration changes. A better example might be a specific root certificate, or a some more slowly evolving system. For example the UK smart metering infrastructure mandates ECDSA over P256. I'm sure otehr examples exist. Ewx (talk) 16:17, 23 September 2021 (UTC)

text: I agree with the other editor that it was a bad example, for the reasons they gave. I suggested a couple of alternatives; you could use one of those? Ewx (talk) 20:07, 5 April 2022 (UTC)
thread_title: Example, this page (currently) authenticated using ECDSA

message: the signature size is the same for both DSA and ECDSA: approximately 4 t {\displaystyle 4t} 4t bits, where t {\displaystyle t} t is the security level measured in bits, that is, about 320 bits for a security level of 80 bits.
Huh? Just below it says: "The signature is the **pair** ( r , s ) {\displaystyle (r,s)} (r,s)", i.e., twice the curve order size, not 4 times.  — Preceding unsigned comment added by 45.2.119.34 (talk) 17:01, 19 January 2019 (UTC)
thread_title:  Size of signature is wrong? 

message: Please consider adding OpenZeppelin to the list of libraries that implement ECDSA.
 
https://docs.openzeppelin.com/contracts/2.x/api/cryptography  — Preceding unsigned comment added by Smdear (talk • contribs) 01:52, 30 August 2022 (UTC)
thread_title:  OpenZeppellin and ECDSA