Questions tagged [secp256k1]
This tag should be used for anything related to the secp256k1 algorithm used for Bitcoin's public key cryptography.
36
questions
5
votes
1
answer
173
views
Is the Bitcoin cryptography library libsecp256k1 not susceptible to the Hertzbleed attack?
I was reading up on the recently disclosed Hertzbleed side channel attack(s).
It was speculated on Twitter that the Bitcoin cryptography library libsecp256k1 is not susceptible to these attacks. ...
- 153
1
vote
2
answers
49
views
How to expand elliptic curve public key from compressed form?
Following this page https://en.bitcoin.it/wiki/Secp256k1, secp256k1 curve's equation is
$$y^2=x^3+7$$
Does this mean that I can substitute $G_x$ in the equation to get $G_y$?
I think yes and that's ...
- 13
2
votes
2
answers
71
views
Is it possible to calculate the modular inverse of a secp256k1 public key?
I know that it wouldn't be possible to use the extended Euclidean algorithm, since it would require the ability to divide a public key and calculate the remainder. I was wondering if there were any ...
- 21
1
vote
1
answer
51
views
How to do addition in Montgomery form?
I'm trying to do ECDSA signing, and I need to compute
$$\left(k^{-1} \bmod n \cdot (m + d\cdot r) \bmod n\right) \bmod n$$
I'm able to do the inverse function and multiplication in Montgomery form, ...
- 13
0
votes
0
answers
94
views
ECDSA private key recovery
I have a bunch of signatures (1000) signed with ECDSA secp256k1 curve. I can verify all of them with the same public key.
I have studied attacks are performed against ECDSA signatures using known MSB ...
1
vote
0
answers
53
views
What data can be derived from ECDSA signature and message?
I generate a random message m sent to a device that calculates sig(m, privKey) with secp256k1...
- 11
0
votes
1
answer
57
views
Practical check the point is on the Curve [duplicate]
The curve I am using is secp256r1. Its formulae is
$y^2 == x^3 + a\cdot x + b$
$a$ = 0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc (...
- 21
0
votes
2
answers
74
views
How to select $r$ in Pedersen commitment scheme?
I'm implementing Pedersen commitment scheme in order to enhance entropy of a pre-image of a hash. I'm using secp256k1 for my curve parameters.
I am following naming conventions from here:
What is a ...
- 115
1
vote
1
answer
160
views
Shor's algorithm and ECDSA in Bitcoin - why is finding the private key still difficult when we know the base point?
I'm learning about Shor's algorithm and how it can be applied to break ECDSA. I've clearly missed something basic here - I thought I understood that the challenge ECDSA presented was to find the ...
- 13
2
votes
2
answers
356
views
Modulo p in Elliptic Curve Cryptography
To carry out Elliptic Curve Cryptography between parties, are all elliptic curve equations considered to be in the form $\bmod p$?
For example, the $secp256k1$ Bitcoin curve of the equation $y^2=x^3+7$...
- 23
0
votes
1
answer
104
views
Possible to directly calculate the Recovery ID from a msg, signature and public key in ECDSA/secp256k1?
Problem
Let's say I receive a signature $(r,s)$, the corresponding public key and the message that was signed. I don't have access to the private key. I need to know what the ...
0
votes
1
answer
116
views
How to prove that an elliptic curve point is smaller or greater than half of the curve's order?
Is it possible to tell if a point on an elliptic curve is less than half of the curve's order?
If I have a point $𝐴 = [a]𝐺$ on a curve with prime order q, is there an efficient way to know that $a &...
- 1
1
vote
1
answer
97
views
Reusing additional data k' nonce from RFC6979 ECDSA
It is known that you must not reuse k in ECDSA; doing so will leak your private key. That's one of the reasons RFC6979 deterministic signatures were invented.
Now, ...
- 229
0
votes
0
answers
66
views
Help determine points on P-256 lie on the actual curve
The curve equation for P-256 is:
NIST P-256
y^2 = x^3-3x+41058363725152142129326129780047268409114441015993725554835256314039467401291
Below I am generating key data, including the secret key "d&...
- 1
1
vote
1
answer
168
views
Convert secp256k1 private key to sr25519 private key
Is it possible to convert secp256k1 private key to valid sr25519 key?
1
vote
1
answer
151
views
On an Elliptic Curve is that possible that from $P$ we can tell if $a$ is quadratic residue modulo $N$?
Imagine that, On an Elliptic Curve cryptography scheme where $P=a\times G$, Bob shares his public key $P$ with Eve (the devil who wants to know secrets he is not supposed to). Bob has also revealed a ...
- 172
3
votes
1
answer
117
views
The better algorithm for Modular Exponentiation on secp256k1/r1
I know Modular Exponentiation ($r = b^e \bmod m$) is important for RSA, and I can find some algorithm that if e is expressed in binary form (for exp: )--in such way for a n-bit long e, one can expect ~...
- 111
0
votes
1
answer
116
views
Chinese remainder theorem in ECDSA for parameters in secp256k1?
It is known that it is possible to apply the Chinese remainder theorem and attack RSA under precise conditions.
https://tls.mbed.org/public/WSchindler-...
- 3
2
votes
1
answer
128
views
Is it safe to implement elliptic curve Diffie Hellman with secp256k1
I need to implement X3DH Key Agreement Protocol according to Signal specification, in the document they suggest using either X25519 or X448 curves. I assume those curves have been chosen for this ...
- 121
1
vote
1
answer
454
views
How to calculate the order of secp256k1?
The elliptic curve secp256k1 is defined as
$y^2 = x^3 + 7$. The prime for the field is set to:
...
- 113
2
votes
1
answer
132
views
ECC Point Addition on Jacob coordinate -- Not Commutative?
I have a python script that does the ECC point addition (code paste below), it simply performs the P =Q1+Q2 on Jacob coordination.
However, when doing some regression tests, I found that if I exchange ...
- 111
1
vote
1
answer
119
views
Is it possible to calculate and unknown point on an EC
I aim to find the answer to what is $X$ on an EC over a finite field where $A + X = B$ and $A$ and $B$ are known. I’m currently learning with secp256k1 so the simplified equation for the curve is $y^2 ...
- 11
3
votes
1
answer
352
views
Problem with point addition about [n-1]+[2]G and [n-1]+G on on Secp256k1
I apologize in advance for my question. I am trying to make my own simple Secp256k1 calculator, just addition and subtraction, and one thing keeps confusing me. When I add 2 points, and I know what ...
- 31
1
vote
1
answer
277
views
Verify that x, y coordinates given as hex string are valid points on an Elliptic Curve [duplicate]
Given the following information:
"curve": "P-256",
"qx": "729C51D177EBE2079A0FB7B0B3C2145159CF81EC61960E642A1744719AA9F913",
"qy": "...
- 11
0
votes
1
answer
100
views
Fully understanding bitcoin transcation verifying and secp256k1
Hello fellow cryptographers.
I have spent last few days trying to understand and find a way to generate secp256k1 private and public keys from scratch, but i failed.
I have seen tons of videos and ...
4
votes
3
answers
903
views
secp256k1: is it theoretically possible to generate same signature with different key, message hash and k?
For a given private key $d$, random $k$ and message hash $h$ is it possible that there exists a different set of $d$, $k$ and $h$ which produces the same signature using $\text{secp256k1}$ curve?
- 43
0
votes
1
answer
74
views
substract points on secp256k - result as moved to N-1
I must perform calculate of substract two points:
Let $G$ be the generator point and;
$P_1 =[1]G = (x_1,y_1)$
$P_2 = [2]G = (x_2,y_2)$,
When I will subtract $P_1 - P_2$ -> I will move Point to N-1 ...
- 1
0
votes
0
answers
59
views
Security of SecretKey addition and PublicKey multiplication in secp256k1
I understand that:
$[a+b]G = [a]G + [b]G$
where $a$ and $b$ are secret keys. (See: Is there a relationship between the secp256k1 public key of the sum of two private keys, and the public keys of ...
- 711
0
votes
0
answers
470
views
Bitcoin Key Recovery Without Nonce Re-Use
There are a lot of questions in these forums regarding the recovery of private keys.
But I'm here to postulate on something unique to a specific piece of research that I looked into recently.
The ...
- 115
4
votes
0
answers
377
views
secp256k1 scalar decomposing and prime field arithmetic
I'm currently studying the elliptic curve secp256k1 implementation.
In my understanding, it has efficiently computable endomorphisms:
We can find out a pair of number $\lambda$ and $\beta$ from the ...
- 61
0
votes
1
answer
259
views
Deterministic Key using a seed for ECNamedCurve
I am trying to generate deterministic keys using EC curve secp521r1 in java. I went through KDF but, couldn't find any references to use it with EC curves. I would appreciate if someone could point me ...
- 103
1
vote
3
answers
544
views
secp256k1 prime modulus vs order
For curve secp256k1 prime modulus is $2^{256}-2^{32}-977$ and order is smaller number but has near half of starting bits set. If I draw number to be private key, it must be less than order. All field ...
- 39
1
vote
1
answer
308
views
How to choose secp256k1 private key?
The private key is any random 256 bit (but smaller than prime p) number or must be prime or other condition?
For selected $x$ can be found $y$ - decompressing key:
...
- 39
1
vote
1
answer
211
views
Is it acceptable to use a HMAC-SHA256 hash as a secp256k1 private key?
Say I want to generate a deterministic private key related to some data, for instance to a domain name. The easiest way I can think of is:
take a secret material which will work as "generator&...
2
votes
2
answers
912
views
Is there a relationship between the secp256k1 public key of the sum of two private keys, and the public keys of those original two private keys?
If I have two secp256k1 private keys and add them together, can I derive the public key for the sum, if I only know the public keys for the two original private keys?
(I think this may be the core of ...
- 711
0
votes
0
answers
125
views
Is there a relation between the private keys of secp256k1 public keys of opposite parities?
From observation, 32 bit public key values of opposite parities are either both valid, or both invalid.
...
- 711