Informational BIP on Low-R Signature Grinding
4 messages, 9 Jun to 28 Jul 2026. Started by Sean Gilligan.
Sean Gilligan (2), Murch, Liam Gilligan
Hi Everyone,
I would like to propose a new informational BIP to formally document the Low-R signature algorithm used by Bitcoin Core and many other wallets.
It was implemented in 2018 in Bitcoin Core by PR 1366 [0]. The Low-r grinding page on Bitcoin Optech [1] references several other implementations.
While working on secp256k1-jdk [2] (a new wrapper for secp256k1 for Java/JDK/JVM-languages) we ended up looking at the C++ implementation for reference and at rust-secp256k1 for a test vector. Since all wallets should implement the algorithm identically (for privacy reasons) it would be helpful to have the behavior clearly documented in an informational BIP.
I have spoken with a handful of developers who think having a BIP would be a good idea and it was suggested on PR 13666.
It should be short and relatively simple and also have a nice collection of test vectors.
What do people think? Any suggestions on what should be included or pointers to test vectors?
Thanks,
Sean
[0] https://github.com/bitcoin/bitcoin/pull/13666 [1] https://bitcoinops.org/en/topics/low-r-grinding/ [2] https://github.com/bitcoinj/secp256k1-jdk
Hi Sean,
Thanks for proposing this idea. It would be splendid if someone were to write up the best practices for low-r signature grinding. You don’t need to worry about test vectors too much in advance, they are only required for advancing a BIP to the Complete status, so if people have more suggestions, those could also added to the document after the PR is open or even after it has been published in Draft.
Cheers, Murch
On 2026-06-09 00:02, Sean Gilligan wrote:
Quoted text (34 lines)
> Hi Everyone, > > I would like to propose a new informational BIP to formally document > the Low-R signature algorithm used by Bitcoin Core and many other > wallets. > > It was implemented in 2018 in Bitcoin Core by PR 1366 [0]. The Low-r > grinding page on Bitcoin Optech [1] references several other > implementations. > > While working on secp256k1-jdk [2] (a new wrapper for secp256k1 for > Java/JDK/JVM-languages) we ended up looking at the C++ implementation > for reference and at rust-secp256k1 for a test vector. Since all > wallets should implement the algorithm identically (for privacy > reasons) it would be helpful to have the behavior clearly documented > in an informational BIP. > > I have spoken with a handful of developers who think having a BIP > would be a good idea and it was suggested on PR 13666. > > It should be short and relatively simple and also have a nice > collection of test vectors. > > What do people think? Any suggestions on what should be included or > pointers to test vectors? > > Thanks, > > Sean > > [0] https://github.com/bitcoin/bitcoin/pull/13666 > [1] https://bitcoinops.org/en/topics/low-r-grinding/ > [2] https://github.com/bitcoinj/secp256k1-jdk >
Thanks Murch!
We will start work on a Draft. Worrying about the test vectors later sounds like a great idea. They are important and probably the hardest part of the effort, but aren't necessary for a draft.
As recommended in BIP 3, we'll create a PR against our fork of the BIPs repo and report back when we have made some progress.
Regards,
Sean
On 6/9/26 1:48 PM, Murch wrote:
Quoted text (48 lines)
> Hi Sean, > > Thanks for proposing this idea. It would be splendid if someone were > to write up the best practices for low-r signature grinding. You don’t > need to worry about test vectors too much in advance, they are only > required for advancing a BIP to the Complete status, so if people have > more suggestions, those could also added to the document after the PR > is open or even after it has been published in Draft. > > Cheers, > Murch > > On 2026-06-09 00:02, Sean Gilligan wrote: >> Hi Everyone, >> >> I would like to propose a new informational BIP to formally document >> the Low-R signature algorithm used by Bitcoin Core and many other >> wallets. >> >> It was implemented in 2018 in Bitcoin Core by PR 1366 [0]. The Low-r >> grinding page on Bitcoin Optech [1] references several other >> implementations. >> >> While working on secp256k1-jdk [2] (a new wrapper for secp256k1 for >> Java/JDK/JVM-languages) we ended up looking at the C++ implementation >> for reference and at rust-secp256k1 for a test vector. Since all >> wallets should implement the algorithm identically (for privacy >> reasons) it would be helpful to have the behavior clearly documented >> in an informational BIP. >> >> I have spoken with a handful of developers who think having a BIP >> would be a good idea and it was suggested on PR 13666. >> >> It should be short and relatively simple and also have a nice >> collection of test vectors. >> >> What do people think? Any suggestions on what should be included or >> pointers to test vectors? >> >> Thanks, >> >> Sean >> >> [0] https://github.com/bitcoin/bitcoin/pull/13666 >> [1] https://bitcoinops.org/en/topics/low-r-grinding/ >> [2] https://github.com/bitcoinj/secp256k1-jdk >> >
Hey everyone!
I went ahead and wrote up a draft and submitted a PR <https://github.com/bitcoin/bips/pull/2224>. If you have a chance, I would love feedback.
Thanks, Liam
On Tuesday, June 9, 2026 at 11:14:50 PM UTC Sean Gilligan wrote:
Thanks Murch!
We will start work on a Draft. Worrying about the test vectors later sounds like a great idea. They are important and probably the hardest part of the effort, but aren't necessary for a draft.
As recommended in BIP 3, we'll create a PR against our fork of the BIPs repo and report back when we have made some progress.
Regards,
Sean
On 6/9/26 1:48 PM, Murch wrote:
Quoted text (48 lines)
> Hi Sean, > > Thanks for proposing this idea. It would be splendid if someone were > to write up the best practices for low-r signature grinding. You don’t > need to worry about test vectors too much in advance, they are only > required for advancing a BIP to the Complete status, so if people have > more suggestions, those could also added to the document after the PR > is open or even after it has been published in Draft. > > Cheers, > Murch > > On 2026-06-09 00:02, Sean Gilligan wrote: >> Hi Everyone, >> >> I would like to propose a new informational BIP to formally document >> the Low-R signature algorithm used by Bitcoin Core and many other >> wallets. >> >> It was implemented in 2018 in Bitcoin Core by PR 1366 [0]. The Low-r >> grinding page on Bitcoin Optech [1] references several other >> implementations. >> >> While working on secp256k1-jdk [2] (a new wrapper for secp256k1 for >> Java/JDK/JVM-languages) we ended up looking at the C++ implementation >> for reference and at rust-secp256k1 for a test vector. Since all >> wallets should implement the algorithm identically (for privacy >> reasons) it would be helpful to have the behavior clearly documented >> in an informational BIP. >> >> I have spoken with a handful of developers who think having a BIP >> would be a good idea and it was suggested on PR 13666. >> >> It should be short and relatively simple and also have a nice >> collection of test vectors. >> >> What do people think? Any suggestions on what should be included or >> pointers to test vectors? >> >> Thanks, >> >> Sean >> >> [0] https://github.com/bitcoin/bitcoin/pull/13666 >> [1] https://bitcoinops.org/en/topics/low-r-grinding/ >> [2] https://github.com/bitcoinj/secp256k1-jdk >> >