# Assuming secp256k1 curve and given fixed (but random) $h$ and $d$ values, is it possible to calculate a $k$ such that $h\equiv(k\,G)_X\,(k-d)\pmod n$?

For generator point $$G$$ in the secp256k1 curve, I want to find a value $$k$$ such that: $$h\equiv(k\,G)_X\,(k-d)\pmod n$$ where $$n$$ is the group order, and $$(k\,G)_X$$ indicates the x-coordinate (mod n) of the resulting point after the multiplication by $$k$$. Assume $$h$$ and $$d$$ are fixed scalar values that I've been given.

Is it possible to calculate $$k$$?

Without the multiplication by $$(k - d)$$, this would just be the ECC discrete log problem. Does having that extra multiplication make it easier to calculate some $$k$$, or is there a way to show that it still reduces to the discrete log problem?

In my experiments with smaller fields, it appears that no such $$k$$ value exists about 35% of the time.

• I'd be surprised is this was sizably easier than the DLP, and would not be surprised if it was much harder: I fail to think of a $\mathcal O(\sqrt n\,\ln(n)\ln(\ln(n)))$ algorithm to solve this, when there are for the DLP.
– fgrieu
Aug 1 at 20:06
• @fgrieu I was actually hoping as much. It would be nice to have a proof that it's at least as hard, but it certainly makes sense intuition-wise. Thanks. Aug 1 at 20:29
• cross-posted math.se Aug 3 at 23:03