In ECDSA, the public key $P$ is computed via the private key $k$ and the generator point $G$: $P=[k]G$

The scalar $k$ (private key) has to be an integer.

However, I am wondering - does the private key/scalar need to be an integer in the first place? Would it be acceptable if the scalar is a decimal (example: $k=111254.3945890......$) or a fraction (example: $k=54/33$)?

  • 1
    $\begingroup$ What is the need for the floating-point? Normally yes, it is a random integer, preferably positive integer $[1,n-1]$. As you know, one can convert the floating point into an integer by multiplying some $10^t$/ $\endgroup$ – kelalaka May 25 at 14:24
  • $\begingroup$ TLDR: yes!$\,\,\,\,\,$ $\endgroup$ – fgrieu May 25 at 14:47

Point multiplication is defined as:

$$kG = \underbrace{G+G+G+...+G}_{k \text { times}}$$

That is, you take $k$ copies of $G$, and add them up.

To define $111254.3945890....G$ or $54/33 G$, you need to define what it means to add up a nonintegral number of $G$s (or some other extension of point multiplication) that preserves the essential properties of point multiplication, most notably $aG + bG = (a + b)G$.

In any case, assuming that $kG$ is always a member of the subgroup generated by $G$ (for example, if $G$ generates the entire curve group), then it's not clear that such an extended definition would actually gain you anything (as the standard definition already can map $kG$ to any subgroup member).

| improve this answer | |
  • $\begingroup$ That was very clear, thanks! Well, I was originally wondering whether allowing for non-integer private keys would constitute a cryptographic weakness. Because if you have an 256-bit private key k in P=kG, and you divide k by another integer (such as 2^200), thus producing k'=k/2^200 which is a 56-bit number. A 56-bit k' is too small to be secure, right? $\endgroup$ – Anonymous May 25 at 14:38
  • $\begingroup$ @Anonymous: well, if you happen to know that $k$ was selected to be a multiple of $2^{200}$, well, yes, such a $k$ would be weak (as there are only $2^{56}$ such values $< 2^{256}$. On the other hand, if $k$ was not specifically selected, such a $k'$ would really be $k \cdot ((2^{200})^{-1} \bmod n)$, which is another 256 bit value; that is no easier to attack $\endgroup$ – poncho May 25 at 14:43
  • $\begingroup$ Completely understood, thanks! $\endgroup$ – Anonymous May 25 at 14:44

Most of cryptography is performed using binary operations and / or discrete math. The operations performed on most if not all asymmetric cryptosystems operate on groups and rely on the security derived from working with specific groups and domains. So yes, the private key must be a positive integer when performing the actual calculations.

Most other values will be interpreted as zero-or-positive numbers as well - although they are often converted to binary, i.e. octet strings / byte arrays before and after the calculations. Decimal numbers are hard to operate on as floating point calculations are defined to have a specific precision. You'd have the same issue with fractions, unless you keep the value as two integers (in which case you are back to $\boxed{1}$, if you ask me).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.