ERC-8111: Bound Signatures

Bound Signatures

Bound signatures are ECDSA signatures bound to a specific v.
Constraining the y-parity allows signatures to fit into 64 bytes.

Background

ECDSA signatures recover two public keys for the same hash.
ECDSA signatures are recoverable when they indicate which of the public keys corresponds to the signing key.
Previous developers signaled which using a y-parity bit.
In Ethereum, this bit is encoded as v.

ECDSA signatures (r, s) are malleable; the s can be reflected across n/2 (where n is the elliptic curve’s order) to produce a new signature that would recover the same public keys.
This operation also flips the y-parity bit.

Therefore, if the y-parity bit is bound, the signature is recoverable and not malleable.

Links