I wonder if I provide someone with two public keys from different elliptic curves, is there any way to prove that these two public keys are generated from the same private key without revealing the private key itself?

For example, I have a private key (which is a large random 256-bit number) and I generate one public key on the secp256r1 curve and another public key on the secp256k1 curve, how do I provide the two keys to a third party and prove to them that these two public keys are generated from the same private key? Is there some kind of zero-knowledge proof or some algorithm that can accomplish that? Thanks.

  • 1
    $\begingroup$ Caution: I goes against standard cryptographic practice (and rule: one usage, one key) to use the same private key directly multiplying the base point on two curves (as considered). I would not be too surprised if it turned out to ease recovering the private key, at least for some curves. If one wants to limit the private key size, there are simple and safe options, like computing at least one of the two multipliers by a Key Derivation Function (but that makes it hopeless to perform what's asked). $\endgroup$
    – fgrieu
    Oct 12, 2018 at 6:56
  • 1
    $\begingroup$ crypto.stackexchange.com/questions/54660/… $\endgroup$
    – kelalaka
    Oct 12, 2018 at 7:35
  • 1
    $\begingroup$ @fgrieu: I didn't retract, not sure what happened. $\endgroup$ Oct 12, 2018 at 15:10
  • $\begingroup$ @Changyu Dong: I understand now; you raised a flag for closing, but have not yet the reputation to cast a close vote. The count shown is accurate. $\endgroup$
    – fgrieu
    Oct 12, 2018 at 15:25


Browse other questions tagged or ask your own question.