比特币价值的ECDSA:什么是z?

我正在深入研究比特币及其工作原理。我目前正在学习椭圆曲线、签名和验证。

我在看书 the steps to for the signature generation algorithm .

上面写着:

让爱丽丝在留言上签名 m ,她遵循以下步骤:

1. 计算 e=HASH(m) (这里HASH是一个加密哈希函数,比如SHA-2,其输出被转换为整数。)
2. 允许 z 成为 L_n 最左边的部分 e 哪里 L_n 是组顺序的位长度 n (注意 Z 可以大于 N 但不会再长了。)

我不懂第二句中的两句话。

假设我有一个 hash 这样地:

import { keccakFromString } from 'ethereumjs-util';

// This is Wikipedia's `n`
const BTC_PRIME_MODULO =
  2n ** 256n -
  2n ** 32n -
  2n ** 9n -
  2n ** 8n -
  2n ** 7n -
  2n ** 6n -
  2n ** 4n -
  1n;

const message = 'Learning blockchain development is fun.';
const hash = keccakFromString(message).toString('hex'); // `e` from Wikipedia

const hexToBigInt = (hex: string) => BigInt('0x' + hex);
const bigIntToBinary = (int: bigint) => int.toString(2);

type getFirstNChars = (numberOfChars: number) => (string: string) => string;
const getFirstNChars: getFirstNChars = n => string => string.slice(0, n);
const getFirst256Chars = getFirstNChars(256);
const binaryToBigInt = (binary: string) => BigInt('0b' + binary);

const get256LeftmostBits = pipe(
  hexToBigInt,
  bigIntToBinary,
  getFirst256Chars,
  binaryToBigInt,
);


const z = get256LeftmostBits(hash) // ... Is this correct?

我现在该怎么办 Z ?

是比特币的分组顺序吗 FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141 因此比特长度是256?

“而且” Z 可以大于 N 但不再是“意思是 Z 可以是 BTC_PRIME_MODULO + 1n ,所以它更大,但有同样多的数字?怎么可能 Z 如果n是最左边的位,它会更大吗?

更多背景:

我正在努力实现 sign 基于维基百科的那篇文章,以下是我目前掌握的信息:

const BITCOIN_GENERATOR_POINT: EllipticCurvePoint = {
  x: 55_066_263_022_277_343_669_578_718_895_168_534_326_250_603_453_777_594_175_500_187_360_389_116_729_240n,
  y: 32_670_510_020_758_816_978_083_085_130_507_043_184_471_273_380_659_243_275_938_904_335_757_337_482_424n,
};

const generateRandomBigInt = () =>
  BigInt(`0x${randomBytes(32).toString('hex')}`);
const getK = pipe(
  generateRandomBigInt,
  maybeReducedModulo(BTC_PRIME_MODULO - 1n),
);

type sign = (privateKey: string, message: string) => string;
const sign: sign = (privateKey, message) => {
  const privateKeyBigInt = BigInt(privateKey);
  const hash = keccakFromString(message).toString('hex');
  let r = 0n;
  let s = 0n;
  const z = get256LeftmostBits(hash); // I'm unsure whether this is correct 🤔

  while (r === 0n || s === 0n) {
    const k = getK();
    const p1 = multiplyWithBasePoint(k);
    r = maybeReduceByBTCPrimeModulo(p1.x);
    s = maybeReduceByBTCPrimeModulo(
      invertByBTCPrimeModulo(k) * (z + r * privateKeyBigInt),
    );
  }

  return ''; // ... need to properly concat r and s ...
};

哪里

• maybeReducedModulo 鉴于 a 和 b 算计 a % b 但他补充道 B 如果 A. 这是负面的。
• multiplyWithBasePoint 与比特币生成点相乘 G .
• 和 invertByBTCPrimeModulo 计算 modular multiplicative inverse 和 BTC_PRIME_MODULO .