# With EC secp256k1 is there a way of transforming a function of the private key to a function of the public key?

A key pair has a private key $D_A$ and a public key $Q_A$.

$D_A$ is an integer less than the curve's $n$.

Is there any (boolean) function of the private key $f(D_A)$ which can be transformed into a function of the public key $f'(Q_A)$?

i.e. are there any relationships between private keys which can be calculated knowing only the public keys?

## 2 Answers

Secp256k1 is a curve, not a scheme - you can build different schemes over it that have different private/public key relationships.

If you do plain ElGamal on secp256k1 for example, $Q_A = D_A . P$ for a public base point $P$ so you get the usual key-sharing properties: if my keypair is $(D_A, Q_A)$ and yours is $(D_B, Q_B)$ then anyone can compute $Q = Q_A + Q_B$ to produce a public key whose secret key is $D = D_A + D_B$. If they can encrypt a message under $Q$, you and me have to cooperate to decrypt it as the secret key is effectively $2:2$ secret-shared.

In summary: if the function mapping secret to public keys is linear (which it often is) then one can transform linear relationships in the way you asked for.

• Does this also apply to ECDSA? – Thomas Von Panom Nov 9 '15 at 9:53
• ECDSA is a bit more complicated (for one thing, it's a signature not an encryption scheme, but mainly because you need both $k$ and $1/k$ for a secret $k$) but threshold signatures do exist: freedom-to-tinker.com/blog/stevenag/… – Bristol Nov 9 '15 at 14:14

We aren't aware of any sich relations. In fact, one assumes that the group of elliptic curve points behave like a Generic Group.
A generic group is a group, where the encoding of the elements are chosen as a random values.