user90173: I want to calculate the v-value from the signature obtained using the OpenSSL ECDSA_do_sign function. I found that this value is calculated using the parity of y-coordinate of r. Here I also found that the parity of y is equal to the parity of r. I want to understand whether it depends on the implementation. Can anyone tell exactly how the coordinates x and y are stored inside r in OpenSSL. I can't find it in the code.
edited:
  I understand how v is calculated. My question is how to get the y-coordinate of r in the specific implementation of ECDSA in the OpenSSL library.

user64730: The value r is just a number and doesn't explicitly store or encode any point coordinates.  In a signature, r is set to the X coordinate of the point R, which is really k*G, where k is the secret nonce used during signing, then reduced mod the curve order.
In secp256k1, this usually means that r is in fact the X coordinate (because r itself is usually very big), but it is not always so.
During verification, the verifier attempts to reconstruct the original R point by from the signature values (s, r), the message z and the signer's public key P by solving the equation s*R' = z*G + r*P, then reduce the X coordinate of R' mod the curve order and check that it is equal to r given in the signature.
I've never used openssl, but the process seems to be in ossl_ecdsa_verify_sig().  So you can see R' being computed here :
https://github.com/openssl/openssl/blob/master/crypto/ec/ecdsa_ossl.c#L396-L404
After these lines, the reduction mod the order is done and finally the equality test.  In simple signature verification, the Y coordinate of R' is not used, but it is available from the value point (which is R') in openssl's implementation.
edit:
Also, I just realized I should add a something about pubkey recovery since you mention the v or recid value in your question.
When doing pubkey recovery from message and signature (as in the case when the signer's pukey is not given), to get the Y coordinate from a possible R' point, you would try a few values based on r as the candidate X coordinates.
The possible X coordinates of R' will be r itself, or r + curve_order (and both can be valid X's).  You can then solve the curve's equation y^2 = x^3 + 7 to get the possible Y values for each.

90173: <p>I want to calculate the <strong>v</strong>-value from the signature obtained using the OpenSSL <a href="https://github.com/openssl/openssl/blob/4ace4ccda2934d2628c3d63d41e79abe041621a7/include/openssl/ec.h#L1178" rel="nofollow noreferrer">ECDSA_do_sign</a> function. I found that this value is calculated using the parity of <strong>y</strong>-coordinate of <strong>r</strong>. <a href="https://bitcoin.stackexchange.com/questions/38351/ecdsa-v-r-s-what-is-v">Here</a> I also found that the parity of <strong>y</strong> is equal to the parity of <strong>r</strong>. I want to understand whether it depends on the implementation. Can anyone tell exactly how the coordinates <strong>x</strong> and <strong>y</strong> are stored inside <strong>r</strong> in OpenSSL. I can't find it in the code.</p>

<p><strong>edited:</strong>
  I understand how v is calculated. My question is how to get the <strong>y</strong>-coordinate of <strong>r</strong> in the specific implementation of ECDSA in the OpenSSL library.</p>
 64730: <p>The value <code>r</code> is just a number and doesn't explicitly store or encode any point coordinates.  In a signature, <code>r</code> is set to the X coordinate of the point <code>R</code>, which is really <code>k*G</code>, where <code>k</code> is the secret nonce used during signing, then reduced mod the curve order.
In secp256k1, this <em>usually</em> means that <code>r</code> is in fact the X coordinate (because <code>r</code> itself is usually very big), but it is not always so.</p>

<p>During verification, the verifier attempts to reconstruct the original <code>R</code> point by from the signature values <code>(s, r)</code>, the message <code>z</code> and the signer's public key <code>P</code> by solving the equation <code>s*R' = z*G + r*P</code>, then reduce the X coordinate of <code>R'</code> mod the curve order and check that it is equal to <code>r</code> given in the signature.</p>

<p>I've never used openssl, but the process seems to be in <code>ossl_ecdsa_verify_sig()</code>.  So you can see <code>R'</code> being computed here :
<a href="https://github.com/openssl/openssl/blob/master/crypto/ec/ecdsa_ossl.c#L396-L404" rel="nofollow noreferrer">https://github.com/openssl/openssl/blob/master/crypto/ec/ecdsa_ossl.c#L396-L404</a></p>

<p>After these lines, the reduction mod the order is done and finally the equality test.  In simple signature verification, the Y coordinate of <code>R'</code> is not used, but it is available from the value <code>point</code> (which is <code>R'</code>) in openssl's implementation.</p>

<p>edit:<br>
Also, I just realized I should add a something about pubkey recovery since you mention the <code>v</code> or <code>recid</code> value in your question.
When doing pubkey recovery from message and signature (as in the case when the signer's pukey is not given), to get the Y coordinate from a possible <code>R'</code> point, you would try a few values based on <code>r</code> as the candidate X coordinates.</p>

<p>The possible X coordinates of <code>R'</code> will be <code>r</code> itself, or <code>r + curve_order</code> (and both can be valid X's).  You can then solve the curve's equation <code>y^2 = x^3 + 7</code> to get the possible Y values for each.</p>
