How does recovering the public key from an ECDSA signature work? It is possible to recover the public key from an ECDSA signature values $(r,s)$?

Please explain how this works.
Actually, it is not possible to uniquely recover the public key from an ECDSA signature $(r,s)$.  This remains true even if we also assume you know the curve, the hash function used, and you also have the message that was signed.

However, with the signature and the message that was signed, and the knowledge of the curve, it is possible to generate two public keys; one of which will be the public key corresponding to the private key used.

Here's how that works:


First, you find the two points $R$, $R'$ which have the value $r$ as the x-coordinate $r$.
You also compute $r^{-1}$, which is the multiplicative inverse of the value $r$ from the signature (modulo the order of the generator of the curve).
Then, you compute $z$ which is the lowest $n$ bits of the hash of the message (where $n$ is the bit size of the curve).


Then, the two public keys are $r^{-1}(sR - zG)$ and $r^{-1}(sR' - zG)$

It is easy to verify that if you plug either of these values in the ECDSA signature routines as the public keys, the signature validates.