# Computing inverse of BN256 G2 point in golang x/crypto/bn256 library

I'm trying to confirm a vulnerability in a signing scheme I'm helping with. To do this I need to simulate a rogue key attack on a BLS aggregate signature using the golang bn256 library https://godoc.org/golang.org/x/crypto/bn256 This requires computing the inverse of a public key.

I'm not a crypto expert but do have a fairly strong algebra background... So if g is the generator of order n then the inverse of p is just p^(n-1) right? But I have no idea what n is.

Any help would be greatly appreciated

• Why are you doing that if you have no idea about that? Why havent you learned the basics first? – mentallurg Sep 6 '19 at 20:45
• @mentallurg could you please elaborate so that your comment is constructive? For example what do you mean by "that"? Anyways, I'm doing this because I need to write some code and don't have the time right now to take several semesters worth courses to learn the basics. – cmspice Sep 6 '19 at 21:09
• OK. Why are you "trying to simulate a rogue key attack" if you don't really understand what are you doing? Can you explain the purpose of such strange "activity"? – mentallurg Sep 6 '19 at 21:11
• I need to write some tests to confirm a vulnerability in a signing scheme I'm helping with. I understand it well enough at a high level but I have no experience working with the crypto primitives. – cmspice Sep 6 '19 at 21:15
• I added the explanation to the question. – cmspice Sep 6 '19 at 21:20

## 1 Answer

Actually, computing an inverse of a point (that is, the inverse of X is the point Y such that X+Y is the identity) is quite easy.

For a curve in Weierstrass format with characteristic > 3 (which bn256 is), the inverse of the point (x, y) is the point (x, -y). That is, you compute the negation of the y coordinate (which, in this case, is modulo $$p$$ the characteristic of the curve, as it's a prime curve).

BTW: you stated that you "don't have the time right now ... to learn the basics"; if you want to do anything with Elliptic Curves, I would suggest you take the time (the basics shouldn't take several semesters...)

• Thx!! I was able to invert the point by flipping the y component (I think). a * inv(a) gives me a point at infinity as expected. But (a*inv(b))*b does not give me back a right now :(. Any ideas? I'll keep poking at it. Any suggestions on learning more about elliptic curves? I'm especially interested in learning about bilinear maps so as to someday understand all the ZK stuff. – cmspice Sep 9 '19 at 19:20