> For the complete documentation index, see [llms.txt](https://whitepaper.opz.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://whitepaper.opz.io/keyfusion/key-concepts-and-techniques/ecdsa-signing-process.md).

# ECDSA Signing Process

The Process of ECDSA Signing in a Two-Party System

The Elliptic Curve Digital Signature Algorithm (ECDSA) involves a two-party process where neither party knows the private key $$x$$, yet they can jointly create a signature on a message $$m$$. Here's an overview of the ECDSA signing function:

1. **Nonce Generation and Computation**:
   * A random nonce $$k$$ is chosen, and $$R=k⋅G$$ is computed.
   * The "x-coordinate" of the elliptic-curve point $$R$$ is denoted as $$r$$.
2. **Signature Computation**:
   * The signature component $$s$$ is calculated as $$s=k−1⋅(H(m)+r⋅x)modq$$.
3. **Signature Output**:
   * The signature is output as a pair $$(r,s)$$.

**Additively Homomorphic Encryption in ECDSA**

* **Encryption Type**: The process uses additively homomorphic encryption, which allows for encrypted values to be efficiently added or multiplied by a scalar without decryption. Paillier encryption, a common form of this encryption, is often used.

**Two-Party Computation Steps**

* **Key Generation**:
  * Parties choose random $$1x1$$ and $$2x2$$ and exchange $$Q1=x1⋅G$$ and $$Q2=x2⋅G$$. Commitment schemes are used for security.
  * $$1P1$$ generates a Paillier key-pair $$(pk,sk)$$ and sends $$ckey​=Encpk​(x1)$$ to $$2P2$$, along with a zero-knowledge proof.
* **Signature Generation on Message** $$m$$:
  * Parties independently generate $$1k1$$ and $$2k2$$, and exchange $$R1=k1⋅G$$ and $$R2=k2⋅G$$.
  * The nonce $$k$$ and $$R$$ are set as $$k=k1⋅k2$$ and $$R=k1⋅R2=k2⋅R1$$.
  * $$2P2$$ computes a "partial signature" using the homomorphic properties of the encryption, performing a series of encrypted operations.
  * $$1P1$$ decrypts the received ciphertext, multiplies it by $$1−1k1−1​$$ to obtain $$s$$, and verifies the signature $$(r,s)$$.

**Security Considerations**

* **Protection Against Private Key Exposure**: The protocol ensures neither party knows $$k$$ or the private key $$x$$.
* **Handling Corrupt Parties**: If $$2P2$$ is corrupt, it can provide incorrect encryption, but since $$1P1$$ verifies the signature first, no advantage is gained by $$2P2$$ from this.