Given:
$eG=P$, $kG=(r,y)$
ECDSA signature transmits (r,s) and does this calculation:
$u = \frac{z}{s}$, $v = \frac{r}{s}$
$uG+vP=(r,y)$ means the signature is valid
Why do we transmit $s$ and not $s^{-1}$?
Currently, $s=\frac{z+re}{k}$, why not $s=\frac{k}{z+re}$? The equations would all go through:
$u=zs$, $v=rs$
$uG+vP=zsG+rsP=zsG+rseG=(zs+rse)G=s(z+re)G=\frac{k(z+re)}{z+re}G=kG=(r,y)$
Given that finding the inverse is very expensive computationally, what are we gaining by transmitting $s$ instead of $s^{-1}$?
