2
$\begingroup$
p_1 := (d_1)G
p_2 := (d_2)p_1

$P_2$ is calculated as shown above. Will $P_2$ be the same of $P_2$ in the second equation?

p_2 := ((d_1 * d_2) % curve_order)G

If I understand correctly, it shouldn't have any problems with the point at infinity. Are there any differences between two ways to calculate the point?

$\endgroup$
2
$\begingroup$

Yes, on an elliptic curve $\mathcal C$, we can use that $\forall d_1\in\Bbb Z, \forall d_2\in\Bbb Z, \forall G\in\mathcal C$ $$\begin{align} d_2\times(d_1\times G)&=(d_2\cdot d_1)\times G\\ &=(d_2\cdot d_1\bmod n)\times G \end{align}$$ where $n$ is the order of the curve, and also for $n$ the order of $G$ (which divides the order of the curve). That more generally holds in any finite group $(\mathcal C,+)$ with scalar multiplication $\times$ defined from the group law $+$ (even if not commutative).

For $d_1$ and $d_2$ random in $[0,n)$, the form $(d_2\cdot d_1\bmod n)\times G$ will typically be fastest, for decent implementation of the modular multiplication. It is best to use $n$ the order of $G$ (which can be smaller than the order of the curve). Beware that the modular multiplication could lead to a side channel.

If $d_1\times G=\infty$ with $G\ne\infty$, and the implementation of $d\times X$ fails when $X=\infty$, then both $(d_2\cdot d_1)\times G$ and $(d_2\cdot d_1\bmod n)\times G$ will prevent that failure (the end result will be $\infty$ all the same and the implementation should be able to deal with this). If the implementation fails when it internally encounters $\infty$ in some internal operation, the change in method of computation can potentially remove or create the condition triggering the issue; that depends on internals.

I have used $\cdot$ for integer multiplication, and $\times$ for point multiplication by scalar/integer.

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.