Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Good night everybody.
Is it real destroy all EC parameters in bitcoin client ? If remove "+7" and replace base point to (0,0 or 1,1)in algorithm then making a new address or public key, bitcoin client send to computer memory clean privat key and it will be easy dump this privakey to txt file :))).
What you think about this ???
The equation of the elliptic curve secp256k1 used in Bitcoin is $y^2 = x^3 + 7$ over a prime field $\mathbf{F}_p$.
Removing the parameter $7$ makes the equation $y^2 = x^3$, which is not an elliptic curve, since there is a singularity at the point $(0, 0)$ (see the pictures in this page to see the problem around this point).
If you consider all the non-singular points on this singular curve (all of them except $(0, 0)$ the singular point), then it works as if it was an elliptic curve: the group law is still correct. Counting the number of those points is also very easy: we have $(y/x)^2 = x$, then if $x_0$ is a square in $\mathbf{F}_p$, there are two points $(x_0, x_0\sqrt{x_0})$ and $(x_0, -x_0\sqrt{x_0})$ where $\sqrt{x_0}$ is one of the two square roots of $x_0$. There are $(p-1)/2$ squares in $\mathbf{F}_p^\times$, so that makes $(p-1)$ affine points, and including the infinity, it makes exactly $p$ points.
But what could be the consequence if an attacker can make the computation happens on the singular curve $y^2 = x^3$ instead of the intended elliptic curve? There is an example of how it can be done in some implementations in this paper.
The answer is that it is disastrous. Indeed, there is a very simple isomorphism $\varphi$ between the group law on the singular curve and the additive group of $\mathbf{F_p}$: $$ \begin{align} (x,y) & \mapsto x/y \\ \infty & \mapsto 0. \end{align} $$ If the base point is $P = (x_0,y_0)$, and the public key is $Q = [k]P = (x_1, y_1)$, with $k$ the secret key, then: $$ \varphi(Q) = \varphi([k]P) = \varphi(P + \cdots + P) = \varphi(P) + \cdots + \varphi(P) = k\varphi(P), $$ so $k$ is easy to compute $$ k = \varphi(Q)/\varphi(P) = \frac{x_1/y_1}{x_0/y_0}. $$ Note that in the case $P=(1, 1)$ as suggested, then $k = x_1/y_1$.
