I want to get a group element $h$ on the elliptic curve secp256k1. The important thing is that no one should know the discrete logarithm of $h$ with respect to $g$. That is, $h$ should be created from a public beacon and not by exponentiating $g$. What's the best way to do this?

  • $\begingroup$ "that know one" $\: \mapsto \:$ "that no one" $\;\;\;\;$ $\endgroup$ – user991 May 11 '15 at 21:05
  • $\begingroup$ I presume you mean that not even you should know $\log_g{h}$? $\endgroup$ – cpast May 12 '15 at 17:23

You want to hash the existing generator $g$ then coerce that hash to a curvepoint. This will result in a generator which is uniformly independent of $g$ (well, in the random oracle model anyway) and also commits to $g$ so that neither generator can be changed (say, to introduce a correlation) without changing the other.

The "obvious" way to avoid correlations, which is deriving $h$ from a nothing-up-my-sleeve (NUMS) number, suffers from the problem that the SECG generator $g$ does not have a clear origin -- it is not NUMS -- so it is possible that somebody knows the discrete log of $g$ with respect to some NUMS point. (Thanks Adam Back for pointing this risk out to me.)

To coerce a hash function to a curvepoint you can use functions from this paper (thanks Greg Maxwell for this link), for example... or you could just take the hash as the $x$-coordinate of your point and keep incrementing it by small integers until you are able to produce a valid curvepoint.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.