BIP Draft: Low-R Grinding for ECDSA Signatures #2224

pull liamgilligan wants to merge 1 commits into bitcoin:master from liamgilligan:bip-low-r-grinding changing 1 files +98 −0

liamgilligan commented at 2:59 PM on July 28, 2026: none

Informational BIP describing low-R grinding: re-deriving the ECDSA nonce under a counter until r has its high bit unset, so the DER encoding needs no leading null byte.

This was discussed on the mailing list: https://groups.google.com/g/bitcoindev/c/boEZRlqczvw

Reference implementation and test vectors are TODO.

Feedback is very welcome.

Add BIP: Low-R Grinding for ECDSA Signatures

Informational BIP describing low-R grinding: re-deriving the ECDSA
nonce under a counter until r has its high bit unset, so the DER
encoding needs no leading null byte.

0ad92c766a

jonatack added the label New BIP on Jul 28, 2026
jonatack commented at 3:45 PM on July 28, 2026: member
For reviewers, see also discussion in https://github.com/bitcoinj/secp256k1-jdk/issues/419 and the following posts by @Sjors (ordered by date inc) in the relevant Bitcoin Core PR:
murchandamus renamed this:
~~Add BIP bip-low-r-grinding: Low-R Grinding for ECDSA Signatures~~
BIP Draft: Low-R Grinding for ECDSA Signatures
on Jul 28, 2026
murchandamus commented at 11:27 PM on July 28, 2026: member

Thanks, adding this to my to-read list.
craigraw commented at 8:16 AM on July 29, 2026: contributor

Another important motivation is that signatures produced according to a standardised approach will be byte-identical. This means signers can be compared to ensure they are not leaking secrets by embedding them in signatures (e.g. Dark Skippy).

Contributors

Labels