Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking at Secp 256K1 vs UProve's FIPS 186-3 or P-256 implementation. Is there any relationship between the curves such that I can consistently "map" or "project" values from one curve to another?

Is this a good idea? (What faults could crop up when doing so?)

My goal is to allow for two independent crypto systems based on ECDSA or subgroups to share the same keys via a conversion of some type

share|improve this question
off the top of my head, "K" curves are binary field curves, whereas P-256 is over a 256-bit prime field, so they will not map or have anything to do with eachother – Richie Frame Oct 21 '13 at 4:15
Conversion works only if the curves are equivalent, but Secp256K1 and P256 are not equivalent. – CodesInChaos Oct 21 '13 at 7:40
@RichieFrame UProve also uses a subgroup variant which is FIPS 186-3 finite field based DSA. Would that mean a mapping is possible – LamonteCristo Oct 21 '13 at 14:28
@CodesInChaos I don't know how to even begin to define equivalence in curves. Could FIPS 186-3 be equivalent? – LamonteCristo Oct 21 '13 at 14:29

If what you want is some kind of algorithm that takes a public key $Q = aP$ on one curve and converts it into $Q' = a P'$ on the other curve, then the answer is almost certainly no. There are no "interesting" maps between curves with different group structures.

If you just want to use the same secret key for both curves, so $Q = aP$ on one curve and $Q' = aP'$ on another, $P,P',Q,Q'$ public, that isn't obviously a bad idea. It seems plausible that the obvious DDH-like problem is hard. However, doing this does introduce a bunch of technical problems, e.g. how do you prove that your public keys correspond to the "same" private key (which can be solved, but is tricky when the group orders are different).

share|improve this answer
I will look more into group structures and group orders as you mention... but if instead of P-256, could any interesting maps be made with field based subgroups FIPS 186-3 and Secp 256 K1? – LamonteCristo Oct 21 '13 at 14:32
Probably, you should try to explain what you want to achieve. Maybe someone can suggest something then. – K.G. Oct 21 '13 at 19:50
Fundamentally, I want to use UProve crypto material in Bitcoin transactions. – LamonteCristo Oct 21 '13 at 22:46
If by UProve crypto material you mean keys generated for UProve, that seems unlikely to work except as I outlined in the answer. If you want to use the UProve cryptographic protocols, then probably you could just use a curve of your choice. Some care is required if the curve order isn't prime. – K.G. Oct 22 '13 at 7:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.