user90638: What are the problems related in using the "normal" ( bigger than N/2) value of the s number in transaction signature and why we use the lower one?
Is it about the math behind the ecdsa?

user38618: Details are in BIP 146:

We require that the S value inside ECDSA signatures is at most the curve order divided by 2...
...
A high S value in signature could be trivially replaced by S' = 0xFFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141 - S.

Signatures encode two important values for verification r and S. If (r, S) is a valid signature, then so is (r, -S), which is equivalent to (r, curver_order -S).

90638: <p>What are the problems related in using the "normal" ( bigger than N/2) value of the <strong>s</strong> number in transaction signature and why we use the lower one?
Is it about the math behind the ecdsa?</p>
 38618: <p>Details are in <a href="https://github.com/bitcoin/bips/blob/master/bip-0146.mediawiki" rel="nofollow noreferrer">BIP 146</a>:</p>
<blockquote>
<p>We require that the S value inside ECDSA signatures is at most the curve order divided by 2...</p>
<p>...</p>
<p>A high S value in signature could be trivially replaced by S' = 0xFFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141 - S.</p>
</blockquote>
<p>Signatures encode two important values for verification <code>r</code> and <code>S</code>. If <code>(r, S)</code> is a valid signature, then so is <code>(r, -S)</code>, which is equivalent to <code>(r, curver_order -S)</code>.</p>
