python – What is the probability that an ECDSA signature is less than 71 bytes?

adminMay 18, 2024

The following Python program calculates all possible total lengths as accurately as computationally possible.

from fractions import Fraction

P = 2**256 - 2**32 - 977
N = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141

def lentable(table, low, high):
    # For every value v in (low, high), increment table(l), where l is the length
    # of the encoding of v. Returns the number of values in range.
    total = 0
    while low <= high:
        lowlen = 1 + (low.bit_length() // 8)
        maxval = 2**(8*lowlen - 1) - 1
        highnow = min(high, maxval)
        while len(table) <= lowlen:
            table.append(0)
        table(lowlen) += highnow - low + 1
        total += highnow - low + 1
        low = highnow + 1
    return total

def analyze(low_r, low_s):
    # Table of probabilities of S length
    slen = ()
    stotal = 0
    if low_s:
        stotal = lentable(slen, 1, N // 2)
        # High s (range n/2 + 1 .. N-1) is just mapped to 1 .. N/2 again.
    else:
        stotal = lentable(slen, 1, N-1)

    # Table of probabilities of R length
    rlen = ()
    rtotal = 0
    if low_r:
        rtotal = lentable(rlen, 0, 2**255-1)
        # High r cause a retry until one in 0..2**255-1 is hit.
    else:
        rtotal = lentable(rlen, 0, P-1)

    # Table of signature lengths
    dlen = (0 for _ in range(len(slen) + len(rlen) + 5))
    for sl in range(len(slen)):
        for rl in range(len(rlen)):
            dlen(sl + rl + 6) += Fraction(slen(sl) * rlen(rl), rtotal * stotal)

    return dlen

for low_r in (0, 1):
    for low_s in (0, 1):
        print("low_r=%i low_s=%i" % (low_r, low_s))
        for dl, freq in enumerate(analyze(low_r, low_s)):
            print("* siglen=%i: %.15g" % (dl, freq))
        print()

Output includes:

low_r=0 low_s=0