r and S-values in Bitcoin ECDSA Signatures
Shows the distribution of low and high r and S-values in ECDSA signatures per day.ECDSA signatures have in theory the same probability of being low-r as being high-r and the same probability of being low-S as being high-S. This caused an equal distribution of low and high values until 2014.
The Bitcoin Core v0.9.0 release in March 2014 included a malleability breaker for the Bitcoin Core Wallet. This malleability breaker made sure that all signatures generated by the Bitcoin Core wallet are low-S. As the malleability problem got bigger other wallets started producing low-S-only-signatures as well. With the release of Bitcoin Core v0.10.3 and Bitcoin Core v0.11.1 in October 2015 high-S signatures were made non-standard to removed the transaction malleability vector.
The Bitcoin Core v0.17.0 release in October 2018 included an improvement to the wallet code that would only produce low-r signatures. This has been picked up by other wallets such as the Electrum Bitcoin Wallet in late 2019.