-1
$\begingroup$

When i know the value "c", How do I find factored numbers "a" and "b" : (a*b) == c (mod N) where, N is bitcoin order.

For example, 0x2eb4110dd5ca04a63de5b4ba2654ad2012ece01827e92af6734553150fae332a * 0x251469c4e7202526c1571ba2e9a9d90ad46f52172b9d63e779a2165ee7201f66 == 0x5a1b9916812f186ef2c26f314fccd20af8222b022b0154e62c9e3f9c30310145 (mod N)

then i want to know the value, 0x2eb4~ and 0x2514~. Does any method exist?

$\endgroup$
5
  • 1
    $\begingroup$ It's unclear what "factored numbers" are, and the constraints on $a$ and $b$. What about for example $a=1$ and $b=c$? Or any $a\in[1,c)$ and $b=a^{-1}c\bmod N$? Note: the order of secp256k1 is $N=$0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141 (just below $2^{256}$), and that matches the example given. $\endgroup$
    – fgrieu
    Mar 27 at 11:15
  • $\begingroup$ Sorry for the unclear questions. This example means the latter(not means a=1 and b=c). N is 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141. If I could derive the values of a and b from c.... It is assumed that it( c ) can be decomposed $\endgroup$
    – sokraa2134
    Mar 27 at 11:31
  • 1
    $\begingroup$ What do you expect to do with the factors? Do you really think you can break ECDSA by factoring some number like RSA as you've tagged this question as such? I don't know if I should feel amused or pity for you. $\endgroup$
    – DannyNiu
    Mar 27 at 11:48
  • $\begingroup$ If the question asks how to find some $a$ and $b$ of known factorization and near 256-bit such that $a\,b\equiv c\pmod N$, that's easy, since most 256-bit integers are easy to factor: pick a random $a\in[1,N)$, compute $b=a^{-1}c\bmod N$ (that's b=pow(a,-1,N)*c%N in python), and factor $a$ and $b$ (or try another $a$ in the unlikely case that turns out to be hard). But I don't see the point. $\endgroup$
    – fgrieu
    Mar 27 at 11:55
  • $\begingroup$ Because $N$ is prime, any integer $a$ such that $0 < a < N$ has a corresponding value $b$ such that $ab \equiv c \pmod{N}$. You can literally just choose one. There is no way to know what $a$ and $b$ values were used by someone to compute $c$ because any nonzero choice of $a$ could have been used. As a simple example, you could choose $a=1$ in which case $b=c$. fgrieu's comment shows how to compute $b$ given $a$. $\endgroup$
    – Myria
    Mar 28 at 18:34

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.