1
$\begingroup$

Is the elliptic curve scalar multiplication $[n]G$ defined if $n=0$?

I saw multiple software implementations with multiple results such that, $[0]G=0$ or $[0]G=G$.

This made me wonder, how can i compute $[0]G$ on 25519 curve, where G is the base point. $G=(9,14781619447589544791020593568409986887264606134616475288964881837755586237401).$

Also, is [n]$\mathcal{O}$ defined?

$\endgroup$
8
3
$\begingroup$

I saw multiple software implementations with multiple results such that, $[0]G=0$ or $[0]G=G$.

As stated in the comments, we define $[0]G = 0$, anything else is incorrect

I thought I'd outline why we define things we did.

What we want is to have $[a+b]G = [a]G + [b]G$ be true for all integers $a, b$, and all points $G$.

If it is true for all integers $b$, it must be true for $b=0$, hence we must have:

$$[a+0]G = [a]G + [0]G$$

This obviously simplifies to $[a]G = [a]G + [0]G$, and this is true only if $[0]G$ is the group identity, that is, only if $[0]G = 0$

$\endgroup$
5
  • 2
    $\begingroup$ Addition: in $[0]G = 0$, the left $0$ is an integer (or integer modulo $n$), But the right $0$ is not, and sometime is noted $\mathcal O$ to make the distinction. It's the neutral for point multiplication. It's called the point at infinity, and thus sometime is noted $\infty$. On Curve25519 [update: sorry Ed25519, which is not the question's curve], the point at infinity has coordinates $(x,y)=(0,1)$. $\endgroup$
    – fgrieu
    Apr 17 at 13:40
  • $\begingroup$ @fgrieu why does the point at infinity has coordinates (𝑥,𝑦)=(0,1)? $\endgroup$ Apr 17 at 13:56
  • 3
    $\begingroup$ @AshrafYassin: it doesn't; the point at infinity doesn't have any coordinates at all. Now, some representations (that is, ways of writing down elliptic curve points as sequences of bits) may decide to denote the point-at-infinity as $(0, 1)$, however that's just a design decision (and is certainly is not universal) $\endgroup$
    – poncho
    Apr 17 at 14:01
  • 1
    $\begingroup$ There's some confusion here between Curve25519 which is a curve in Weierstrass form and Ed25519 which is a curve in Edwards form. On Ed25519 the identity point is $(0,1)$, but the base point is different from the one quoted in the question. On Curve22519 the point at infinity does not have an $(x,y)$ representation. It is important not to denote it with an actual $(x,y)$ value as some Weierstrass implementations will take these numbers and start doing computations on a related, but different curve. $\endgroup$
    – Daniel S
    Apr 17 at 15:08
  • $\begingroup$ @Daniel Shiu: thanks for the correction! $\endgroup$
    – fgrieu
    Apr 17 at 18:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.