ECDSA

To sign, ECDSA hashes the message (e = HASH(m)), picks a secret random nonce k, computes the point k·G from which it takes r, and derives s = k⁻¹ (e + r·priv) mod n. The signature is the pair (r, s) and verification recombines it with the public key. Two details are critical as good practice: reusing or biasing the nonce k leaks the private key, so a deterministic k per RFC 6979 is recommended; and the malleability of (r, s) and (r, n minus s) is neutralized by requiring the low value of s, as Bitcoin (low-S policy) and Ethereum do.

It is the algorithm with which Bitcoin and Ethereum prove ownership of funds without revealing the private key, with far shorter keys than RSA for equivalent security: 256-bit ECC approximates 3072-bit RSA. Ethereum adds a recovery value v to enable ecrecover.

It is standardized in ANSI X9.62, FIPS 186-5 (3 February 2023), IEEE P1363 and ISO/IEC 14888-3, and the secp256k1 curve is defined in SEC 2. Bitcoin and Ethereum have signed with ECDSA over secp256k1 since their origins; TLS commonly uses the secp256r1 (P-256) curve. As an evolution, Bitcoin Taproot (BIP-340, activated November 2021) adopts Schnorr signatures for their aggregation advantages.