Low-s value in bitcoin signature What are the problems related in using the "normal" ( bigger than N/2) value of the s number in transaction signature and why we use the lower one?
Is it about the math behind the ecdsa?
Details are in BIP 146:

We require that the S value inside ECDSA signatures is at most the curve order divided by 2...
...
A high S value in signature could be trivially replaced by S' = 0xFFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141 - S.

Signatures encode two important values for verification r and S. If (r, S) is a valid signature, then so is (r, -S), which is equivalent to (r, curver_order -S).