8
$\begingroup$

I'm testing an implementation of Bitcoin, which uses the curve Secp256k1 for ECDSA, and I want to see how it handles the point at infinity ($0$) if present in a signature. For example, r could be the x coordinate of the encoding of the point at infinity.

How is the $0$ encoded? Can it be encoded?

I found that bouncycastle prefixes the encoding of 0 with 0x00, and has some other defined prefixes (ECCurve.decodePoint()) but I don't known how this information applies (or even if it does apply to) to the encoding of $(r,s)$. This info seems to be in the X9.62 standard.

$\endgroup$

2 Answers 2

8
$\begingroup$

Standard encoding of the point at infinity is a single byte of value 0x00 (it is defined as such as least in P1363, possibly also in X9.62). Other representations may exist (such as a lot of bytes of value 0x00), but, in truth, the "point at infinity" does not have well-defined X and Y coordinates.

In the case of ECDSA, you generate a random value k which must lie between 1 and r-1, where r is the (prime) order of the conventional generator point G. Therefore, kG cannot be the point at infinity -- if it is, then the implementation got it wrong, or the key is not correct. Since kG is not the point at infinity, then it always has a well-defined X coordinate, and the problem does not arise. Similarly, if the point at infinity is obtained during the verification algorithm, then something definitely fishy is happening, and therefore the signature should be rejected (this cannot happen with a valid signature).

The same can be said about elliptic curve Diffie-Hellman. To sum up, if the encoding of the point-at-infinity begins to matter, then something went wrong and the best thing to do is to declare a failure (e.g. reject the signature as invalid).

$\endgroup$
1
  • $\begingroup$ Is it ok to throw an exception if point at infinity is encountered? I am currently doing this (for secpk256k1). $\endgroup$
    – Jus12
    Dec 28, 2017 at 7:32
4
$\begingroup$

Well, the most common representation of 'point at infinity' would be a value that consists solely of zeros; that is, if normal points are encoded as a series of 64 bytes, then the point at infinity would be encoded as 64 00 bytes.

On the other hand, it wouldn't appear to apply to ECDSA; ECDSA signatures consist of two integers between 1 and the curve order, not a point. ECDSA public keys do contain a point; however the point at infinity is specifically excluded as a legal possibility.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.