-1
$\begingroup$

This is a $y^2=x^3+7$ elliptic curve points - $Q,G_1,G_2,G_3. k_1,k_2,k$? - secret exponents:

  • $k_1*G_1( x_1,y_1) = Q(X,Y)$

  • $k_2*G_2( x_2,y_2) = Q(X,Y)$

  • $k*G_3( x_3,y_3) = Q(X,Y)$

How to find a $k$?" ??

$Q,G_1,G_2,G_3. k_1,k_2$ - are known

$k$? - need to find.

$\endgroup$
3
  • 3
    $\begingroup$ If no relations known about $k_1,k_2,k$ or $G_1, G_2, G_3$, then $[k]G_3=Q$ is independent and so it is generally hard to recover $k$. Unless the curve is weak, but this depends on the underlying field. $\endgroup$ – Fractalice Feb 10 at 8:48
  • 1
    $\begingroup$ This question needs additional information on how these equations have arrived. This not an ordinary DLog. $\endgroup$ – kelalaka Feb 10 at 9:23
  • $\begingroup$ Base points G1,G2 and secret exponents k1,k2 are bruteforced, G - information from property of a curve secp256k1. $\endgroup$ – Donald Feb 10 at 9:25
2
$\begingroup$

This is known: $$k_1 \cdot G_1 = k_2 \cdot G_2 = k \cdot G_3 = Q$$

Additionally, let $G$ be a base point, such that we can have:

$$G_1 = k \cdot k_2 \cdot G$$ $$G_2 = k_1 \cdot k \cdot G$$ $$G_3 = k_1 \cdot k_2 \cdot G$$

This reduces to a case of tri-party Diffie-Hellman. So without further information, it's unsolvable.

$\endgroup$
7
  • $\begingroup$ What further information need for this ? Tnx for your comment @DannyNiu $\endgroup$ – Donald Feb 10 at 9:35
  • $\begingroup$ I'm not sure what further information is needed, but if it's a question from a text book, there may be some context you missed to put here, or if there is no further context, then it's an error in the book. $\endgroup$ – DannyNiu Feb 10 at 9:37
  • $\begingroup$ how to find a k from k_1*G_1=k_2*G_2=k*G_3=Q ??? $\endgroup$ – Donald Feb 10 at 9:46
  • $\begingroup$ @Donald as I said in the answer, it reduces to a case of 3-party DH. You can't solve it without side information. $\endgroup$ – DannyNiu Feb 10 at 10:34
  • $\begingroup$ DannyNiu how I can add to this your answer crypto.stackexchange.com/a/88141/81643 G = G_o*k_3 ? Because I don't know exact k for G, but I can get k_o for get G from (k_o * G_o=G) and this <>Q !!! ??? $\endgroup$ – Donald Feb 10 at 19:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.