Verification

Given message m, signature (r, s), and public key Q:

1. Verify 1 ≤ r,s ≤ n-1; otherwise reject.
2. e = SHA-256(m), truncated.
3. w = s^(-1) mod n.
4. u1 = e*w mod n; u2 = r*w mod n.
5. R = u1*G + u2*Q.
6. If R = ∞: reject.
7. Accept iff R.x mod n == r.

The cleverness: the verifier doesn't know k. But by combining the public key Q = dG with the components:

u1G + u2Q = u1G + u2dG = (u1 + u2d)G = (ew + rwd)G = w*(e + rd)G = s^(-1)skG (since ks = e + rd, so s^(-1)(e+rd) = k) = kG = R

So verifier reconstructs R. If R.x ≡ r (mod n), the signature is valid.

Verification is two scalar multiplications + one point addition. Public — no secrets, no constant-time concern. (But sign side IS secret-time-sensitive.)

Common API: signature is DER-encoded SEQUENCE { INTEGER r, INTEGER s }. Bitcoin used a low-s convention to prevent malleability — flipping s to n-s gives a different valid signature. SegWit fixed this entirely.