Wrong pub key from VerifyingKey.from_public_key_recovery_with_digest (bitcoin)

[opacey]

Hi,

I'm failing to recover the correct public key from a signature and message digest.
This is a bitcoin signature. Am I doing anything obviously wrong here?

#!/usr/bin/env python3
import hashlib
from hashlib import sha256
import ecdsa

# I have removed the sighash suffix of '01':
signature = "3044022075d13bd5285f9bb1aa432fb5e5626dc1da3da79c68cdda121ce58fe45832010d022024e341dc2fdacacfca42c31e01c5ca7446b3bdab810288a60a8ee69370f8c12d"

# This is the digest of the signed message (aka the txid):
digest = "18e2b281ba683bab73d915f89f9d303ff45bb585b6e020c2cebc4c919bb81222"

pubkey = ecdsa.keys.VerifyingKey.from_public_key_recovery_with_digest(
                bytes.fromhex(signature),
                bytes.fromhex(digest),
                ecdsa.SECP256k1,
                sha256,
                ecdsa.util.sigdecode_der,
                False
                )

print( pubkey[0].to_string('compressed').hex() )
print( pubkey[1].to_string('compressed').hex() )

[tomato42]

yes, it should be

bytes.fromhex(digest),

not

bytes.fromhex(data),

[opacey]

Sorry that was a typo when transcribing the code snippet, thanks for noticing it. Corrected it in the above post now.
N.B. the code I have does give keys, just not the right one(s).

[tomato42]

If that gives you unexpected keys, that means either:

1. the digest is not correct
2. you're comparing the keys incorrectly

as you can easily see, this code does return keys that can be used to verify that signature with that digest:

print(pubkey[0].verify_digest(bytes.fromhex(signature), bytes.fromhex(digest), ecdsa.util.sigdecode_der))
print(pubkey[1].verify_digest(bytes.fromhex(signature), bytes.fromhex(digest), ecdsa.util.sigdecode_der))

(both will print True)

[opacey]

Good sanity check, thanks. The source pubkey is rendered by the bitcoin wallet software as 02e538d72b6f059b6822b265fe78dc9619ca29bc664b513bca4e92c574fd7a0530, I can reproduce this with the following code:

#!/usr/bin/env python3
import base58
import ecdsa
base58PrivKey = "<redacted>"
rawPrivKey = base58.b58decode_check(base58PrivKey.encode())
rawPrivKey = rawPrivKey[1:-1] # Remove the \x80 version prefix and x\01 compression suffix.
privKey = ecdsa.keys.SigningKey.from_string(rawPrivKey, ecdsa.SECP256k1)
veriKey = privKey.get_verifying_key()
print(veriKey.to_string('compressed').hex())

So I guess this confirms that .to_string('compressed') is the appropriate format to use.

Perhaps then the digest really is wrong. I'll test this by generating my own message and sig pair tomorrow, and see if I can recover the correct pubkey from them.

[opacey]

I've now done this test too, and can successfully recover the correct pub key from a signature I make myself (using the same recovery code as above).
This must mean the original signature and/or digest are/is not being formed or formatted in the manner I expect.

I'll update this thread when I learn anything new or solve the issue completely.