Good night everybody.

Is it real destroy all EC parameters in bitcoin client ? If remove "+7" and replace base point to (0,0 or 1,1)in algorithm then making a new address or public key, bitcoin client send to computer memory clean privat key and it will be easy dump this privakey to txt file :))).

What you think about this ???

  • 2
    $\begingroup$ This question is better suited for bitcoin.stackexchange.com $\endgroup$ – Aman Grewal Jul 26 at 1:11
  • $\begingroup$ This question was closed for being off-topic, because the question (per its title) seems specific to an implementation detail of the Bitcoin wallet program Bitcoin-Qt (an obsolete ancestor of the Bitcoin Core wallet program). The question is also unclear, and thus can't be migrated. What's asked is not precise. Is the question about making a modification altering the Elliptic Curve parameters used to extract the private key? If so, edit the question to clarify that, and reword it to explain the attack, inasmuch as possible making that description independent of the particular program used. $\endgroup$ – fgrieu Jul 26 at 9:05

The equation of the elliptic curve secp256k1 used in Bitcoin is $y^2 = x^3 + 7$ over a prime field $\mathbf{F}_p$. Removing the parameter $7$ makes the equation $y^2 = x^3$, which is not an elliptic curve, since there is a singularity at the point $(0, 0)$ (see the pictures in this page to see the problem around this point).

If you consider all the non-singular points on this singular curve (all of them except $(0, 0)$ the singular point), then it works as if it was an elliptic curve: the group law is still correct. Counting the number of those points is also very easy: we have $(y/x)^2 = x$, then if $x_0$ is a square in $\mathbf{F}_p$, there are two points $(x_0, x_0\sqrt{x_0})$ and $(x_0, -x_0\sqrt{x_0})$ where $\sqrt{x_0}$ is one of the two square roots of $x_0$. There are $(p-1)/2$ squares in $\mathbf{F}_p^\times$, so that makes $(p-1)$ affine points, and including the infinity, it makes exactly $p$ points.

But what could be the consequence if an attacker can make the computation happens on the singular curve $y^2 = x^3$ instead of the intended elliptic curve? There is an example of how it can be done in some implementations in this paper.

The answer is that it is disastrous. Indeed, there is a very simple isomorphism $\varphi$ between the group law on the singular curve and the additive group of $\mathbf{F_p}$: $$ \begin{align} (x,y) & \mapsto x/y \\ \infty & \mapsto 0. \end{align} $$ If the base point is $P = (x_0,y_0)$, and the public key is $Q = [k]P = (x_1, y_1)$, with $k$ the secret key, then: $$ \varphi(Q) = \varphi([k]P) = \varphi(P + \cdots + P) = \varphi(P) + \cdots + \varphi(P) = k\varphi(P), $$ so $k$ is easy to compute $$ k = \varphi(Q)/\varphi(P) = \frac{x_1/y_1}{x_0/y_0}. $$ Note that in the case $P=(1, 1)$ as suggested, then $k = x_1/y_1$.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.