0
$\begingroup$

I must perform calculate of substract two points:

Let $G$ be the generator point and;

$P_1 =[1]G = (x_1,y_1)$

$P_2 = [2]G = (x_2,y_2)$,

When I will subtract $P_1 - P_2$ -> I will move Point to N-1 with negative $y_1$ of $P_1$

second: Let $G$ be the generator point and;

$P_5 =[5]G = (x_1,y_1)$

$P_2 = [2]G = (x_2,y_2)$,

$P_3 = [3]G = (x_3,y_3)$,

When I will subtract $P_2 - P_5$ -> I will take result $P_3$ with negative $y_3$ of $P_3$

it looks like $P_2 - P_5$ it "similiar" to integer 2 minus integer 5 = we get minus 3 - and in this example -3 it is N-3 .

How to check that substract points cross the order of curve n? without checking y is negative?
how to check that substract point is crossed by Point of Infinity and order of the curve?

Ps. N = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141 order of curve -> maximum points.

$\endgroup$
9
  • $\begingroup$ Welcome to Cryptography.SE. do you mean $P_1 = [1]G$ and $P_2=[2]G$? We have $\LaTeX$/MathJax enabled our site. Currently, you question is not clear. Note that, the point doesn't have floating points. $1/5$ probably means that $5^{-1}$ on the defined field. $\endgroup$
    – kelalaka
    Apr 27, 2021 at 14:58
  • $\begingroup$ P1=[1]G and P2=[2]G? Yes but 1/5 = 0.2 of P it is halfing_point by 5 it is like 0.2 of P. and we have P_1.2[G] it is equals P + halfing P by 5 . and how to check that substract is moved N-1 curve order? $\endgroup$
    – Ironic
    Apr 27, 2021 at 15:00
  • $\begingroup$ "0.2 of P it is halfing_point by 5"; I am not familiar with that terminology (and I suspect others may be in the same boat); what operation are you performing on $P$? Is it 'find the point $Q$ with $5Q = P$, and return $Q$?' $\endgroup$
    – poncho
    Apr 27, 2021 at 18:43
  • $\begingroup$ @poncho point halving possible, however, the Q is not clear to me. $\endgroup$
    – kelalaka
    Apr 27, 2021 at 19:07
  • 1
    $\begingroup$ @kelalaka: I know there is a well defined operation "point halving", however I'm not certain what he means by "point halving by 5" $\endgroup$
    – poncho
    Apr 27, 2021 at 19:09

1 Answer 1

1
$\begingroup$

How to check that substract points cross the order of curve n?

You cant'; or at least, we hope you can't.

If you could, you could use that method to compute discrete logs.

Here is one approach; suppose you had a method that, given the points $[a]G$ and $[b]G$, would return you $[a-b]G$ and also informed you whether it "crossed the order of curve n", that is, if $a < b$. Then, what you could do, given the point $[x]G$, you could use this method on the points $[x]G$ and $[\lfloor n/2 \rfloor]G$; that method would tell you if $x < \lfloor n/2 \rfloor$. If it turned out (for example) if $x$ happened to be larger, you could repeat this with $[x]G$ and $[\lfloor 3n/5 \rfloor]G$; and continue to do binary searching until you have recovered the value of $x$.

That means that you've just recovered the discrete log of $xG$ with only circa $\log_2(n)$ calls to your method; we certainly hope that we can't do that.

BTW: why do you care if "the points cross the order of curve n"?

$\endgroup$
4
  • $\begingroup$ If I know that point of substracted -> crossed the order , then I can make "application" for curve. If its not possible, maybe "how to check" that substract point moved by Point Infinity is possibility? $\endgroup$
    – Ironic
    Apr 27, 2021 at 20:39
  • $\begingroup$ @Ironic: 'then I can make "application" for curve' - I have no idea what that means $\endgroup$
    – poncho
    Apr 27, 2021 at 20:51
  • $\begingroup$ imagine calculator like in Windows system. you can add, substract, multiply, and divide. but designed for curves. $\endgroup$
    – Ironic
    Apr 27, 2021 at 20:57
  • $\begingroup$ @Ironic: if your EC calculator has things entered as $(x, y)$ coordinates, you can compute point subtraction using the standard algorithm without knowing/caring whether the result "crossed the order" (which, btw, makes sense only in terms of a specific generator). And, if it has things entered as discrete logs (e.g. 3 for [3]G), then its even easier... $\endgroup$
    – poncho
    Apr 27, 2021 at 21:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.