1
$\begingroup$

Given the following information:

"curve": "P-256",

"qx": "729C51D177EBE2079A0FB7B0B3C2145159CF81EC61960E642A1744719AA9F913",

"qy": "8C36BCF51475016E614F8C7E0CB1B37C7EA65B4ECCF809852C9B2D0E438710BD"

The above coordinates are supposedly valid as per the test vector expected results:

"testPassed": true

I need to determine if the above public key coordinates are valid points on the curve or not. I have tried converting the coordinates in python into ints with:

>>> x = int("7C96DFF02F55B876A2A885A920E9FB5E30C6E1A4061A62517FD5C936A16AD363", 16)
>>> y = int("301ABC6B82DF5B6B6D3E8D56D7660D83A6E4F55E321BD2E57A5AC4A6A683374E", 16)

And then plugged those integer values into both of the following formulas:

y^2 = X^3 + 7 (secp256k1)

y^2 = x^3 - 3x + b where b is 41058363725152142129326129780047268409114441015993725554835256314039467401291

In neither case did the formula indicate that the values were valid.

Would anybody happen to know how I could go about validating these coordinates?

$\endgroup$
12
  • $\begingroup$ For P256; it's the $y^2 \equiv x^3 - 3x + b \pmod p$ formula. Did you remember to do the $\bmod p$ part? $\endgroup$ – poncho Jun 15 at 16:45
  • $\begingroup$ Ah, I definitely had the formula wrong because I did leave out the mod p component. How can I get that component out of the x, y coordinates? $\endgroup$ – factor2 Jun 15 at 16:50
  • $\begingroup$ If you know that you're checking a P256 curve, that gives you the $p$ value $\endgroup$ – poncho Jun 15 at 16:51
  • $\begingroup$ Okay, I still end up getting the wrong value. After conversion, I get the following x and y values: x = 56353365848849265321159620645865428036014544177922197398856507648435978687331 y = 21758255182490996347272889474463336439598185139152900800520689763795259832142 This gives me a (y^2) % 256 = 196 and a (x^3 -3x + b) % 256 = 93 Is my constant b value wrong perhaps? $\endgroup$ – factor2 Jun 15 at 17:00
  • $\begingroup$ and with the first equation I get (x^3 + 7) %256 = 66 $\endgroup$ – factor2 Jun 15 at 17:08
0
$\begingroup$

As you wrote you're supposed to check that $y^2 = x^3 + ax + b \mod p$.

According to this source : https://eprint.iacr.org/2013/816.pdf

$$p = 2^{256}-2^{224}+2^{192}+2^{96}-1$$

Notice that the $256$ refers to the bit size of $p$, and not to $p$ itself.

$\endgroup$
1
  • $\begingroup$ A commenter above pointed out that I am on the wrong curve, but I want to thank you for the link to that documentation, good knowledge for me to read through in general $\endgroup$ – factor2 Jun 15 at 17:23

Not the answer you're looking for? Browse other questions tagged or ask your own question.