r and S-values in Bitcoin ECDSA Signatures

Shows the distribution of low and high r and S-values in ECDSA signatures per day.
0 - moon
moving average

ECDSA signatures have in theory the same probability of being low-r as being high-r and the same probability of being low-S as being high-S. This caused an equal distribution of low and high values until 2014.

The Bitcoin Core v0.9.0 release in March 2014 included a malleability breaker for the Bitcoin Core Wallet. This malleability breaker made sure that all signatures generated by the Bitcoin Core wallet are low-S. As the malleability problem got bigger other wallets started producing low-S-only-signatures as well. With the release of Bitcoin Core v0.10.3 and Bitcoin Core v0.11.1 in October 2015 high-S signatures were made non-standard to removed the transaction malleability vector.

The Bitcoin Core v0.17.0 release in October 2018 included an improvement to the wallet code that would only produce low-r signatures. This has been picked up by other wallets such as the Electrum Bitcoin Wallet in late 2019.

Category: Bitcoin Script | Tags: ECDSA, r-value, S-value, Signature

Related Charts

S-values in ECDSA Signatures
Shows the distribution of low and high S-values in ECDSA signatures per day.
r-values in ECDSA Signatures
Shows the distribution of low and high r-values in ECDSA signatures per day.
DER encoded ECDSA Signatures
Shows the distribution of DER-encoded ECDSA signatures per day.
Length of ECDSA Signatures
Shows distribution of ECDSA signature length per day.