0
$\begingroup$

secp256k1 Generator:(G_X, G_Y, 0x1),

secp256k1 any public key using affine coordinates : B=(X, Y)

secp256k1 any Public key using jacobian coordinates:BB=(P_X, P_Y, P_Z)

(B's private key)==(BB's private key)

I consider projective Jacobian coordinates for secp256k1.

Given any public key B, if the z-coordinate after converting the generator of secp256k1 to Jacobian coordinates is set to 0x1, how should I calculate P_Z(the z-coordinate of any public key) without using scalar(private key) and a middle point?

$\endgroup$
7
  • $\begingroup$ If you just decoded a point, just set $Z$ to 1. If you're operating on a point, treat divisions on $X$ and $Y$ as multiplication on $Z$. Afterwards, if you encode a point, divide $Z$ from $X$ and $Y$ to get the encoded values. Is anything still unclear? or is it enough to make a formal answer? $\endgroup$
    – DannyNiu
    Dec 6, 2023 at 8:48
  • 1
    $\begingroup$ @DannyNiu Careful! With Jacobian coordinates conversion to affine needs $X$ to be divided by $Z^2$ and $Y$ to be divided by $Z^3$. $\endgroup$
    – Daniel S
    Dec 6, 2023 at 9:07
  • $\begingroup$ For example, the final public key's Z-coordinate obtained from the generator point using jacobian-coordinates and the adding operator was different from the final public key's Z-coordinate obtained from the middle point using jacobian-coordinates and the adding operator. So, Setting the Z-coordinate of the generator point to 0x1 and setting the Z-coordinate of the middle point to 0x1 leads to different results....Z-coordinate $\endgroup$
    – bnsage123
    Dec 6, 2023 at 9:23
  • $\begingroup$ Note: I do not know "projective Jacobian coordinates", only Jacobian coordinates and the (different) projective coordinates. $\endgroup$
    – fgrieu
    Dec 6, 2023 at 10:05
  • 1
    $\begingroup$ hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html $\endgroup$
    – kelalaka
    Dec 6, 2023 at 10:08

1 Answer 1

0
$\begingroup$

Recall that a point (other than the point at infinity) on the secp256k1 curve (or any curve in Weierstrass form over a prime field $\mathbb F_p$) having Cartesian coordinates $(X,Y)$ matches point with Jacobian coordinates $(x,y,z)$ if and only if $z^2\,X\equiv x\pmod p$ and $z^3\,Y\equiv y\pmod p$ and $z\not\equiv0\pmod p$. Notice that $z=0$ can be used to represent the point at infinity (otherwise said, the group's identity).

It follow that to convert $B=(X,Y)$ to Jacobian coordinates, we can use $BB=(X,Y,1)$.

Or, if we want some blinding for side-channel resistance, we can pick a random integer $z$ in $[1,p)$ and set $BB=\bigl((z^2\,X\bmod p),(z^3\,Y\bmod p),z\bigr)$.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.