Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently working on an application that requires me to add two ECDSA private keys in order to make a new private key. The result has to have the property, that its corresponding public key is the same as one would sum the public keys corresponding to the first private keys.

I managed to get most of that going, but I have problems when the sum of the private keys gets so big that I need to mod it by the curve's $N$ parameter.

What are the correct steps I should take in order to ensure a proper private key sum is generated?

share|improve this question

Well, the normal rules apply, i.e. $(aG + bG) = (a + b)G$, so as long as you add $a$ and $b$ correctly, everything should work fine. Note that you don't actually have to reduce the result of the addition for the point multiplication to give the same result, however your implementation may require the number to be smaller than the order.

Also make sure that you are working mod the order of the curve, and not mod some other number (e.g. the order of the underlying finite field).

share|improve this answer
If you're using OpenSSL, it's just BN_mod_add. You can get the correct order with EC_GROUP_get_order. – David Schwartz Jun 1 '12 at 15:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.