Questions tagged [secp256k1]
This tag should be used for anything related to the secp256k1 algorithm used for Bitcoin's public key cryptography.
65
questions
0
votes
0
answers
43
views
Same message different nonce but similarities in r value of the signatures(r,s)
I'm studying a case where when i sign a same message with the same private key and a different nonce, i sometimes get signatures (r,s) where r values share some similarities (same numbers at the same ...
- 101
1
vote
1
answer
154
views
How to determine the prefix of a SECP256K1 compressed public key
I need to store a public key in a variable of maximum 32 bytes.
I recover the compressed key and remove its prefix, but then I have to do the opposite: I have to rebuild the compressed address from it ...
- 11
1
vote
1
answer
50
views
is it possible to calculate the difference between 2 public keys of secp256k1
I am inquiring about the feasibility of calculating the point difference between two distinct secp256k1 elliptic curve points. Given the nature of secp256k1, which is widely used in cryptographic ...
- 11
2
votes
1
answer
81
views
Does using only one sign of secp256k1 publc keys weaken security?
As far as I understand, compressed public keys of secp256k1 can represent points either above or below the X axis, depending on whether they begin 0x02 or 0x03.
Am I correct in thinking that if you ...
- 835
1
vote
2
answers
40
views
In ECDSA over K256, Why R.x should be less than the subgroup order, not field order? But in BIP340 over K256, should be less than field order
I understand that R.x is a field element.
I don't understand why in ECDSA verification ie. FIPS 186-5 section 6.4.2 step 1, we check whether r is less than subgroup order.
If it has something to do ...
- 143
0
votes
0
answers
59
views
Trouble detecting cyclic group order crossovers in SECP256K1
There's a problem in detecting whether the sum of public key addition has crossed the cyclic group order boundary
For this example, think of public keys $Pub$ as private keys $Priv$, (private scalars),...
3
votes
1
answer
216
views
Does ECDH on secp256k produce a defined shared secret for two key pairs, or is it implementation defined?
Rust and NodeJS implementations of ECDH on secp256k1 produce different shared secrets, when using identical keypairs:
NodeJS:
...
- 835
1
vote
1
answer
60
views
Can anyone explain the algorithm that OpenSSL uses to add two points on an elliptic curve?
I am trying to understand how OpenSSL adds points on an elliptic curve. I have understood from here that ossl_ec_GFp_simple_add() is where the addition op works. Can anyone explain the algorithm used ...
- 11
2
votes
1
answer
289
views
What is the relationship between NIST and secp256k1?
While exploring secp256k1, I came across what seems like the official definition at https://www.secg.org/, specifically in https://www.secg.org/sec2-v2.pdf. In terms of authorship, the document only ...
- 123
2
votes
2
answers
122
views
Can you find a secure curve defined over the scalar field of secp256k1?
Is it possible to find a secure curve which's base field is the scalar field of secp256k1?
In general, can you find a secure curve defined over the scalar field of any secure curve? (For example, a ...
- 339
2
votes
0
answers
73
views
Safety of reusing same seed to derive secp256k1 keys and AES-256-GCM
The use case here is to deterministically generate a multi-use wallet from a single 12-word BIP39 mnemonic. Currently a standard process for deriving secp256k1 keypairs is implemented, e.g., using a ...
- 21
5
votes
2
answers
239
views
Method to break a baby Elliptic Curve analog to secp256k1
What would be the method of choice to compute the private key from the public key on a baby analog of secp256k1, say with $p$ and $n$ 144-bit?
What would be the pros and cons of Pollard's rho and ...
- 51
2
votes
1
answer
209
views
A property of some Koblitz elliptic curves over a prime field
secp256k1 is an elliptic curve $E$ over a prime field $\mathbb F_p$, of equation $y^2\equiv x^3+b\pmod p$, with prime order $n$.
I noticed† that the different curve $E'$ over the prime field $\mathbb ...
- 137k
2
votes
1
answer
239
views
Help with adding and multiplying points on secp256k1
I'm currently working on implementing digital signatures on the curve secp256k1 (for learning purposes only), and I'm having some trouble implementing ECDSA on curve secp256k1. As I understand it, ...
- 41
-2
votes
1
answer
138
views
What is secp256k1 and can we have a post quantum cryptography with that? [closed]
Please detail secp256k1 and its role in a public key cryptography. Please explain can we use it into a post-quantum cryptography and how can we do it?
- 109
1
vote
1
answer
438
views
ECDSA SECP256k1 curve - same-r-value-is-used-for-two-different-addresses
Edited: changing the notation according request by fgrieu.
I have prepared 4 transactions for 2 pubkeys with the same r1 and r2.
properties of secp256k1:
...
- 11
1
vote
1
answer
40
views
Can a quantum attacker prove that incomplete ECDSA signatures were produced with the same key?
Assume a 256-bit ECDSA private key used with Secp256k1 and SHA-256. This key signs multiple different messages in a fully deterministic manner as described in RFC-6979, so signing the same message ...
- 43
3
votes
2
answers
120
views
Given multiple incomplete ECDSA signatures, what can a quantum attacker learn in the following scenarios?
Assume a 256-bit ECDSA private key used with Secp256k1 and SHA-256. This key signs multiple different messages in a fully deterministic manner as described in RFC-6979, so signing the same message ...
- 43
2
votes
0
answers
33
views
Fusion auth versus jose4j library for jwt using secp256k [closed]
I am a beginner in-terms of JWT libraries in programming.
How the keypair used (secp256k1) is related with the algorithmic header used for creation of JWT?
And why authfusion doesn't need an ...
- 21
2
votes
1
answer
112
views
Elliptic Curve - Is it possible to know whether a particular value is the result of ECadd or ECdouble?
As we know the public key is generated from the private key and the process is point addition and point double and so on. If we see a list, it would look like a list of values coming from ECadd and ...
3
votes
1
answer
278
views
Criteria for choice of prime field in secp256k1?
In secp256k1, the prime order field $\mathbb F_p$ uses
$$p=2^{256}-2^{32}-977$$
This is the largest prime $p$ less than $2^{256}-2^{32}$ allowing to construct a Koblitz curve $y^2\equiv x^3+b\bmod p$ ...
- 137k
1
vote
0
answers
259
views
How to calculate points for twist?
How I can find the point to perform this twist attack - https://cryptodeep.ru/twist-attack/
English version of previous link:
https://github.com/demining/Twist-Attack
This video has additional ...
- 29
3
votes
3
answers
1k
views
How can we reverse Elliptic Curves after solving the DLP problem?
Suppose that I've solved the Discrete Logarithm problem. Can someone explain to me in terms of the example below how to arrange values of Elliptic Curve secp256k1 in a reverse form so that I can ...
1
vote
0
answers
50
views
Troubleshooting ECDSA implementation in rust [closed]
I'm trying to implement ECDSA for learning purposes and have generated public and private keys, which seem to be correct as I have compared them with those generated by an online tool called noble. ...
- 11
1
vote
1
answer
158
views
0
votes
1
answer
267
views
Which P-256 is in Web Crypto? [duplicate]
Web Crypto API allows creating ECC keys with some known curves: https://developer.mozilla.org/en-US/docs/Web/API/EcKeyGenParams
Those are P-256, P-384, P-521.
However as answered at this answer https:/...
- 103
4
votes
1
answer
545
views
Is it true that Public keys with even y coordinate correspond to private key that are less than n/2 and vice versa? (Secp256k1)
The question is somewhat complex and directed to clearing things out.
Suppose that $n$ is the order of the cyclic group. It $n - 1$ is the number of all private keys possible
...
- 43
0
votes
1
answer
151
views
Proof that user compressed public key corresponds the curve equation (secp256k1)
I am trying to check if some compressed public key corresponds to an elliptic curve equation (secp256r1). As far as I know it should be valid once the following equation is fulfill y^2 = x^3 + ax + b ...
- 103
0
votes
1
answer
205
views
Determine if an elliptic point is negative
How to determine if an elliptic point $kG$ is negative? Is $k<0?$
By example, for $k=1234$, the coordinate of the point $1234G$ using secp256k1 =
$X= ...
8
votes
2
answers
313
views
Is the elliptic-curve cryptography library libsecp256k1 not susceptible to the Hertzbleed attack?
I was reading up on the recently disclosed Hertzbleed side channel attack(s).
It was speculated on Twitter that the elliptic-curve cryptography library libsecp256k1 is not susceptible to these attacks....
- 197
1
vote
2
answers
566
views
How to expand elliptic curve public key from compressed form?
Following this page https://en.bitcoin.it/wiki/Secp256k1, secp256k1 curve's equation is
$$y^2=x^3+7$$
Does this mean that I can substitute $G_x$ in the equation to get $G_y$?
I think yes and that's ...
- 13
2
votes
2
answers
514
views
Is it possible to calculate the modular inverse of a secp256k1 public key?
I know that it wouldn't be possible to use the extended Euclidean algorithm, since it would require the ability to divide a public key and calculate the remainder. I was wondering if there were any ...
- 21
1
vote
1
answer
146
views
How to do addition in Montgomery form?
I'm trying to do ECDSA signing, and I need to compute
$$\left(k^{-1} \bmod n \cdot (m + d\cdot r) \bmod n\right) \bmod n$$
I'm able to do the inverse function and multiplication in Montgomery form, ...
- 13
0
votes
0
answers
749
views
ECDSA private key recovery
I have a bunch of signatures (1000) signed with ECDSA secp256k1 curve. I can verify all of them with the same public key.
I have studied attacks are performed against ECDSA signatures using known MSB ...
1
vote
0
answers
255
views
What data can be derived from ECDSA signature and message?
I generate a random message m sent to a device that calculates sig(m, privKey) with secp256k1...
- 11
0
votes
1
answer
105
views
Practical check the point is on the Curve [duplicate]
The curve I am using is secp256r1. Its formulae is
$y^2 == x^3 + a\cdot x + b$
$a$ = 0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc (...
- 21
1
vote
2
answers
188
views
How to select $r$ in Pedersen commitment scheme?
I'm implementing Pedersen commitment scheme in order to enhance entropy of a pre-image of a hash. I'm using secp256k1 for my curve parameters.
I am following naming conventions from here:
What is a ...
- 145
1
vote
1
answer
492
views
Shor's algorithm and ECDSA in Bitcoin - why is finding the private key still difficult when we know the base point?
I'm learning about Shor's algorithm and how it can be applied to break ECDSA. I've clearly missed something basic here - I thought I understood that the challenge ECDSA presented was to find the ...
- 13
3
votes
2
answers
1k
views
Modulo p in Elliptic Curve Cryptography
To carry out Elliptic Curve Cryptography between parties, are all elliptic curve equations considered to be in the form $\bmod p$?
For example, the $secp256k1$ Bitcoin curve of the equation $y^2=x^3+7$...
- 33
0
votes
1
answer
446
views
Possible to directly calculate the Recovery ID from a msg, signature and public key in ECDSA/secp256k1?
Problem
Let's say I receive a signature $(r,s)$, the corresponding public key and the message that was signed. I don't have access to the private key. I need to know what the ...
- 103
0
votes
1
answer
410
views
How to prove that an elliptic curve point is smaller or greater than half of the curve's order?
Is it possible to tell if a point on an elliptic curve is less than half of the curve's order?
If I have a point $𝐴 = [a]𝐺$ on a curve with prime order q, is there an efficient way to know that $a &...
- 1
1
vote
1
answer
321
views
Reusing additional data k' nonce from RFC6979 ECDSA
It is known that you must not reuse k in ECDSA; doing so will leak your private key. That's one of the reasons RFC6979 deterministic signatures were invented.
Now, ...
- 300
0
votes
0
answers
151
views
Help determine points on P-256 lie on the actual curve
The curve equation for P-256 is:
NIST P-256
y^2 = x^3-3x+41058363725152142129326129780047268409114441015993725554835256314039467401291
Below I am generating key data, including the secret key "d&...
- 1
2
votes
1
answer
350
views
Convert secp256k1 private key to sr25519 private key
Is it possible to convert secp256k1 private key to valid sr25519 key?
1
vote
1
answer
269
views
On an Elliptic Curve is that possible that from $P$ we can tell if $a$ is quadratic residue modulo $N$?
Imagine that, On an Elliptic Curve cryptography scheme where $P=a\times G$, Bob shares his public key $P$ with Eve (the devil who wants to know secrets he is not supposed to). Bob has also revealed a ...
- 184
3
votes
1
answer
245
views
The better algorithm for Modular Exponentiation on secp256k1/r1
I know Modular Exponentiation ($r = b^e \bmod m$) is important for RSA, and I can find some algorithm that if e is expressed in binary form (for exp: )--in such way for a n-bit long e, one can expect ~...
- 111
0
votes
1
answer
196
views
Chinese remainder theorem in ECDSA for parameters in secp256k1?
It is known that it is possible to apply the Chinese remainder theorem and attack RSA under precise conditions.
https://tls.mbed.org/public/WSchindler-...
- 3
2
votes
1
answer
317
views
Is it safe to implement elliptic curve Diffie Hellman with secp256k1
I need to implement X3DH Key Agreement Protocol according to Signal specification, in the document they suggest using either X25519 or X448 curves. I assume those curves have been chosen for this ...
- 121
2
votes
1
answer
1k
views
How to calculate the order of secp256k1?
The elliptic curve secp256k1 is defined as
$y^2 = x^3 + 7$. The prime for the field is set to:
...
- 123
2
votes
1
answer
215
views
ECC Point Addition on Jacob coordinate -- Not Commutative?
I have a python script that does the ECC point addition (code paste below), it simply performs the P =Q1+Q2 on Jacob coordination.
However, when doing some regression tests, I found that if I exchange ...
- 111