user90088: I am trying to find resources in previous malleability posts, but couldn't find derivations/proofs of this fact or how the exact low-s value is derived. Any pointers would greatly appreciated.

user208: ECDSA signatures are pairs (r,s) such that r = x(m/s*G + r/s*P) mod n, where P is the public key and m is the message digest. x() in that equation means "the X coordinate of".
In that equation, if you substitute s = -s', you get r = x(m/(-s')*G + r/(-s)*P) mod n, or r = x(-(m/s'*G + r/s'*P)).
However, it is true that for any point Q, x(Q) = x(-Q), as negating a point only affects the Y coordinate. Thus, r = x(m/s'*G + r/s'*P) mod n, or (r,s') is valid signature whenever (r,s) is.

90088: <p>I am trying to find resources in previous malleability posts, but couldn't find derivations/proofs of this fact or how the exact low-s value is derived. Any pointers would greatly appreciated.</p>
 208: <p>ECDSA signatures are pairs (r,s) such that <em>r = x(m/s*G + r/s*P) mod n</em>, where <em>P</em> is the public key and <em>m</em> is the message digest. <em>x()</em> in that equation means &quot;the X coordinate of&quot;.</p>
<p>In that equation, if you substitute <em>s = -s'</em>, you get <em>r = x(m/(-s')*G + r/(-s)*P) mod n</em>, or <em>r = x(-(m/s'*G + r/s'*P))</em>.</p>
<p>However, it is true that for any point <em>Q</em>, <em>x(Q) = x(-Q)</em>, as negating a point only affects the Y coordinate. Thus, <em>r = x(m/s'*G + r/s'*P) mod n</em>, or <em>(r,s')</em> is valid signature whenever <em>(r,s)</em> is.</p>
