# Second generator for secp256k1 curve

I want to get a group element $h$ on the elliptic curve secp256k1. The important thing is that no one should know the discrete logarithm of $h$ with respect to $g$. That is, $h$ should be created from a public beacon and not by exponentiating $g$. What's the best way to do this?

• "that know one" $\: \mapsto \:$ "that no one" $\;\;\;\;$ – user991 May 11 '15 at 21:05
• I presume you mean that not even you should know $\log_g{h}$? – cpast May 12 '15 at 17:23

## 1 Answer

You want to hash the existing generator $g$ then coerce that hash to a curvepoint. This will result in a generator which is uniformly independent of $g$ (well, in the random oracle model anyway) and also commits to $g$ so that neither generator can be changed (say, to introduce a correlation) without changing the other.

The "obvious" way to avoid correlations, which is deriving $h$ from a nothing-up-my-sleeve (NUMS) number, suffers from the problem that the SECG generator $g$ does not have a clear origin -- it is not NUMS -- so it is possible that somebody knows the discrete log of $g$ with respect to some NUMS point. (Thanks Adam Back for pointing this risk out to me.)

To coerce a hash function to a curvepoint you can use functions from this paper (thanks Greg Maxwell for this link), for example... or you could just take the hash as the $x$-coordinate of your point and keep incrementing it by small integers until you are able to produce a valid curvepoint.