1# ECDSA — derivation notes (paper §6.1)23Signing: R = kG, r = x(R) mod n, s = k⁻¹(z + r d) mod n. Verification: w = s⁻¹, u₁ = z w, u₂ = r w, X = u₁G + u₂P,4accept iff x(X) mod n = r. Correctness: X = s⁻¹(z + r d)G = kG = R.56Malleability: replacing s by −s negates w, u₁, u₂, hence X ↦ −X; x(−X) = x(X), so (r, −s) verifies (SymPy check S5,7Lean theorem in `formal/`). Bitcoin enforces low-s (BIP 62/146).89Nonce reuse (synthetic keys only, `src/wp34/ecdsa.py::recover_private_key_from_nonce_reuse`):10s₁ − s₂ = k⁻¹(z₁ − z₂) ⇒ k = (z₁ − z₂)/(s₁ − s₂), then d = (s₁k − z₁)/r.1112Hash-to-integer: z is the leftmost ⌈log₂ n⌉ bits of H(m); for secp256k1 all 256 bits, z may exceed n (reduced mod n13in s). RFC 6979 (`rfc6979_nonce`) derives k by HMAC-DRBG from (d, H(m)); verified against python-ecdsa.14