I'm currently working on an application that requires me to add two ECDSA private keys in order to make a new private key. The result has to have the property, that its corresponding public key is the same as one would sum the public keys corresponding to the first private keys.

I managed to get most of that going, but I have problems when the sum of the private keys gets so big that I need to mod it by the curve's $N$ parameter.

What are the correct steps I should take in order to ensure a proper private key sum is generated?


Well, the normal rules apply, i.e. $(aG + bG) = (a + b)G$, so as long as you add $a$ and $b$ correctly, everything should work fine. Note that you don't actually have to reduce the result of the addition for the point multiplication to give the same result, however your implementation may require the number to be smaller than the order.

Also make sure that you are working mod the order of the curve, and not mod some other number (e.g. the order of the underlying finite field).

  • $\begingroup$ If you're using OpenSSL, it's just BN_mod_add. You can get the correct order with EC_GROUP_get_order. $\endgroup$ Jun 1 '12 at 15:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.