ECDSA

Also called: Elliptic Curve Digital Signature Algorithm, ECDSA signature, secp256k1 ECDSA, DER signature.

ECDSA (Elliptic Curve Digital Signature Algorithm) is the signature scheme Bitcoin has used since 2009, over secp256k1, for all pre-Taproot outputs.

ECDSA, the Elliptic Curve Digital Signature Algorithm, is the signature scheme Bitcoin has used from the start. A wallet signs a transaction with its private key, and nodes check the signature against the public key using the secp256k1 curve.

Where ECDSA is used

Every output type before Taproot relies on ECDSA through OP_CHECKSIG and OP_CHECKMULTISIG: P2PKH, P2SH scripts, P2WPKH and P2WSH. For SegWit version 0 inputs, BIP 143 changed what the signature commits to, including the amount being spent. P2TR outputs use Schnorr signatures instead.

Encoding and malleability

An ECDSA signature is a pair of numbers (r, s). Bitcoin encodes them in DER format, which makes them variable in length and up to 72 bytes, followed by a one-byte sighash flag. That flexibility caused problems:

Parsing differences. Nodes relied on OpenSSL to parse signatures, and a change in OpenSSL made some nodes reject the chain. BIP 66 made strict DER encoding a consensus rule from block 363,725 (July 2015).
Malleability. For any valid signature, replacing s with n - s (n being the curve order) gives another valid one. BIP 146 proposed requiring the "low S" form, and BIP 62 catalogued other sources of malleability. SegWit removed signatures from the TXID altogether.

ECDSA vs Schnorr

BIP 340 explains why Taproot moved on: Schnorr signatures have a stronger security proof, are non-malleable, have a fixed 64-byte size and allow key aggregation. ECDSA remains valid and widely used. BIP 461 proposes a deterministic ECDSA signing algorithm, with signatures of at most 70 bytes in DER, so users can cross-check hardware signers for hidden key leaks.

BIPs that define ECDSA

BIP 66: Strict DER signatures: Deployed. Required all signatures to follow one strict encoding format, known as DER. Different software interpreted loosely encoded signatures differently, which risked splitting the network and let…
BIP 143 (SegWit signature hashing): Transaction Signature Verification for Version 0 Witness Program: Deployed. Changes how signatures are calculated for SegWit transactions so that verifying them no longer requires re-hashing the same data many times. It also makes the signature commit to the amount being…
BIP 146: Dealing with signature encoding malleability: Closed. Tightens the rules on how digital signatures may be formatted, so a third party cannot slightly alter a signature's encoding and thereby change a transaction's ID. Removing this form of malleability…
BIP 62: Dealing with malleability: Closed. Proposed a set of rules to stop third parties from altering a transaction's ID without changing what it does, a problem called malleability. It was withdrawn after Segregated Witness (SegWit) solved…
BIP 340: Schnorr Signatures for secp256k1: Deployed. Defines a standard for Schnorr signatures, a simpler and more flexible signing method than the ECDSA scheme Bitcoin originally used, on the same elliptic curve. Schnorr signatures are compact (64…
BIP 461: Deterministic ECDSA Signatures: Draft. Specifies a way of producing ECDSA signatures, Bitcoin's original signature type, where the result depends only on the private key and the message, removing reliance on a good random number source.…

Related terms

Schnorr signatures: Schnorr signatures are the 64-byte digital signatures standardized in BIP 340 and used by Taproot. They are simpler and more flexible than ECDSA.
Private key: A private key is a secret 256-bit number that signs Bitcoin transactions. Whoever knows it can spend the coins it controls.
Public key: A public key is a point on the secp256k1 curve derived from a private key. Others use it to verify your signatures, and addresses are built from it.
Transaction malleability: Transaction malleability is the ability to change a transaction's ID without changing what it does, for example by re-encoding its signatures.
Sighash flags: Sighash flags are a byte on each Bitcoin signature saying which parts of the transaction it covers, such as SIGHASH_ALL (0x01) for all of it.