1
$\begingroup$

Is the elliptic curve scalar multiplication $[n]G$ defined if $n=0$?

I saw multiple software implementations with multiple results such that, $[0]G=0$ or $[0]G=G$.

This made me wonder, how can i compute $[0]G$ on 25519 curve, where G is the base point. $G=(9,14781619447589544791020593568409986887264606134616475288964881837755586237401).$

Also, is [n]$\mathcal{O}$ defined?

Improve this question
$\endgroup$
8

1 Answer 1

Reset to default
3
$\begingroup$

I saw multiple software implementations with multiple results such that, $[0]G=0$ or $[0]G=G$.

As stated in the comments, we define $[0]G = 0$, anything else is incorrect

I thought I'd outline why we define things we did.

What we want is to have $[a+b]G = [a]G + [b]G$ be true for all integers $a, b$, and all points $G$.

If it is true for all integers $b$, it must be true for $b=0$, hence we must have:

$$[a+0]G = [a]G + [0]G$$

This obviously simplifies to $[a]G = [a]G + [0]G$, and this is true only if $[0]G$ is the group identity, that is, only if $[0]G = 0$

Improve this answer
$\endgroup$
5
  • 2
    $\begingroup$ Addition: in $[0]G = 0$, the left $0$ is an integer (or integer modulo $n$), But the right $0$ is not, and sometime is noted $\mathcal O$ to make the distinction. It's the neutral for point multiplication. It's called the point at infinity, and thus sometime is noted $\infty$. On Curve25519 [update: sorry Ed25519, which is not the question's curve], the point at infinity has coordinates $(x,y)=(0,1)$. $\endgroup$
    – fgrieu ♦
    Apr 17, 2021 at 13:40
  • $\begingroup$ @fgrieu why does the point at infinity has coordinates (𝑥,𝑦)=(0,1)? $\endgroup$
    – Ashraf Yassin
    Apr 17, 2021 at 13:56
  • 3
    $\begingroup$ @AshrafYassin: it doesn't; the point at infinity doesn't have any coordinates at all. Now, some representations (that is, ways of writing down elliptic curve points as sequences of bits) may decide to denote the point-at-infinity as $(0, 1)$, however that's just a design decision (and is certainly is not universal) $\endgroup$
    – poncho
    Apr 17, 2021 at 14:01
  • 1
    $\begingroup$ There's some confusion here between Curve25519 which is a curve in Weierstrass form and Ed25519 which is a curve in Edwards form. On Ed25519 the identity point is $(0,1)$, but the base point is different from the one quoted in the question. On Curve22519 the point at infinity does not have an $(x,y)$ representation. It is important not to denote it with an actual $(x,y)$ value as some Weierstrass implementations will take these numbers and start doing computations on a related, but different curve. $\endgroup$
    – Daniel S
    Apr 17, 2021 at 15:08
  • $\begingroup$ @Daniel Shiu: thanks for the correction! $\endgroup$
    – fgrieu ♦
    Apr 17, 2021 at 18:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.