The serialization format used for ECDSA signatures requires 33 bytes to encode an r-value that falls into the upper half of the vary, however solely 32 bytes to encode one falling into the decrease half of the vary. Which means that by repeating the signing till you get an r-value within the decrease vary (“grinding the signature”), you possibly can lower the dimensions of your signature by 1 byte. This takes an anticipated two makes an attempt per signature and makes it simpler to estimate the required charges for transactions earlier than signing and reduces the blockspace footprint and charges for transactions.
Is that this an actual method utilized in follow? Just one byte in discount appears impractical. Nonetheless very attention-grabbing. – m1xolyd1an
Sure, and it isn’t simply 1 B, it is 1 B per signature.
On P2PKH, if you construct a transaction, it’s important to conservatively estimate inputs as 148 B, lest you maybe undershoot a goal feerate, though about half of the inputs can be 147 B and the opposite half can be 148 B. Utilizing signature grinding, you possibly can all the time estimate with 147 B.
For two-of-3 P2SH, you all the time need to estimate with 297 B, as a result of each signatures could possibly be high-r. Nevertheless, solely about 1/4 of the inputs finally ends up being 297 B, 1/2 can be 296 B, and 1/4 can be 293 B. Why 293? Nicely, if each signatures are low-r, you slide into the smaller varInt vary to specify the size of the scriptSig which saves one other two bytes. You possibly can due to this fact estimate with 4 B much less utilizing signature grinding, and save a median 2.5 B on every enter from hitting the blockchain.
So for P2PKH, it reduces the general price (enter+output dimension) you must conservatively estimate for by about 0.5% (181 B vs 182 B) and produces an about 0.25% discount of precise blockspace used (181 B vs 181.5 B). For two-of-3 P2SH, it is a few 1.2% discount of the charges (325 B vs 329 B), and a 0.75% discount of blockspace used (325 B vs 327.5 B). Implementation is simple, and the one on-going price is roughly doubling the signing effort. See e.g. Bitcoin Core’s implementation right here: All the time create signatures with Low R values #13666