# Questions tagged [secp256k1]

This tag should be used for anything related to the secp256k1 algorithm used for Bitcoin's public key cryptography.

65 questions
Filter by
Sorted by
Tagged with
43 views

### Same message different nonce but similarities in r value of the signatures(r,s)

I'm studying a case where when i sign a same message with the same private key and a different nonce, i sometimes get signatures (r,s) where r values share some similarities (same numbers at the same ...
1 vote
154 views

### How to determine the prefix of a SECP256K1 compressed public key

I need to store a public key in a variable of maximum 32 bytes. I recover the compressed key and remove its prefix, but then I have to do the opposite: I have to rebuild the compressed address from it ...
1 vote
50 views

### is it possible to calculate the difference between 2 public keys of secp256k1

I am inquiring about the feasibility of calculating the point difference between two distinct secp256k1 elliptic curve points. Given the nature of secp256k1, which is widely used in cryptographic ...
81 views

### Does using only one sign of secp256k1 publc keys weaken security?

As far as I understand, compressed public keys of secp256k1 can represent points either above or below the X axis, depending on whether they begin 0x02 or 0x03. Am I correct in thinking that if you ...
1 vote
40 views

### In ECDSA over K256, Why R.x should be less than the subgroup order, not field order? But in BIP340 over K256, should be less than field order

I understand that R.x is a field element. I don't understand why in ECDSA verification ie. FIPS 186-5 section 6.4.2 step 1, we check whether r is less than subgroup order. If it has something to do ...
59 views

### Trouble detecting cyclic group order crossovers in SECP256K1

There's a problem in detecting whether the sum of public key addition has crossed the cyclic group order boundary For this example, think of public keys $Pub$ as private keys $Priv$, (private scalars),...
216 views

### Does ECDH on secp256k produce a defined shared secret for two key pairs, or is it implementation defined?

Rust and NodeJS implementations of ECDH on secp256k1 produce different shared secrets, when using identical keypairs: NodeJS: ...
1 vote
60 views

### Can anyone explain the algorithm that OpenSSL uses to add two points on an elliptic curve?

I am trying to understand how OpenSSL adds points on an elliptic curve. I have understood from here that ossl_ec_GFp_simple_add() is where the addition op works. Can anyone explain the algorithm used ...
289 views

### What is the relationship between NIST and secp256k1?

While exploring secp256k1, I came across what seems like the official definition at https://www.secg.org/, specifically in https://www.secg.org/sec2-v2.pdf. In terms of authorship, the document only ...
122 views

### Can you find a secure curve defined over the scalar field of secp256k1?

Is it possible to find a secure curve which's base field is the scalar field of secp256k1? In general, can you find a secure curve defined over the scalar field of any secure curve? (For example, a ...
73 views

### Safety of reusing same seed to derive secp256k1 keys and AES-256-GCM

The use case here is to deterministically generate a multi-use wallet from a single 12-word BIP39 mnemonic. Currently a standard process for deriving secp256k1 keypairs is implemented, e.g., using a ...
239 views

### Method to break a baby Elliptic Curve analog to secp256k1

What would be the method of choice to compute the private key from the public key on a baby analog of secp256k1, say with $p$ and $n$ 144-bit? What would be the pros and cons of Pollard's rho and ...
209 views

313 views

### Is the elliptic-curve cryptography library libsecp256k1 not susceptible to the Hertzbleed attack?

I was reading up on the recently disclosed Hertzbleed side channel attack(s). It was speculated on Twitter that the elliptic-curve cryptography library libsecp256k1 is not susceptible to these attacks....
1 vote
566 views

### How to expand elliptic curve public key from compressed form?

Following this page https://en.bitcoin.it/wiki/Secp256k1, secp256k1 curve's equation is $$y^2=x^3+7$$ Does this mean that I can substitute $G_x$ in the equation to get $G_y$? I think yes and that's ...
514 views

### Is it possible to calculate the modular inverse of a secp256k1 public key?

I know that it wouldn't be possible to use the extended Euclidean algorithm, since it would require the ability to divide a public key and calculate the remainder. I was wondering if there were any ...
1 vote
146 views

### How to do addition in Montgomery form?

I'm trying to do ECDSA signing, and I need to compute $$\left(k^{-1} \bmod n \cdot (m + d\cdot r) \bmod n\right) \bmod n$$ I'm able to do the inverse function and multiplication in Montgomery form, ...
749 views

### ECDSA private key recovery

I have a bunch of signatures (1000) signed with ECDSA secp256k1 curve. I can verify all of them with the same public key. I have studied attacks are performed against ECDSA signatures using known MSB ...
1 vote
255 views

### What data can be derived from ECDSA signature and message?

I generate a random message m sent to a device that calculates sig(m, privKey) with secp256k1...
105 views

### Practical check the point is on the Curve [duplicate]

The curve I am using is secp256r1. Its formulae is $y^2 == x^3 + a\cdot x + b$ $a$ = 0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc (...
1 vote
188 views

### How to select $r$ in Pedersen commitment scheme?

I'm implementing Pedersen commitment scheme in order to enhance entropy of a pre-image of a hash. I'm using secp256k1 for my curve parameters. I am following naming conventions from here: What is a ...
1 vote
492 views

### Shor's algorithm and ECDSA in Bitcoin - why is finding the private key still difficult when we know the base point?

I'm learning about Shor's algorithm and how it can be applied to break ECDSA. I've clearly missed something basic here - I thought I understood that the challenge ECDSA presented was to find the ...
1k views

### Modulo p in Elliptic Curve Cryptography

To carry out Elliptic Curve Cryptography between parties, are all elliptic curve equations considered to be in the form $\bmod p$? For example, the $secp256k1$ Bitcoin curve of the equation $y^2=x^3+7$...
446 views

### Possible to directly calculate the Recovery ID from a msg, signature and public key in ECDSA/secp256k1?

Problem Let's say I receive a signature $(r,s)$, the corresponding public key and the message that was signed. I don't have access to the private key. I need to know what the ...