Questions tagged [secp256k1]

This tag should be used for anything related to the secp256k1 algorithm used for Bitcoin's public key cryptography.

Filter by
Sorted by
Tagged with
5 votes
1 answer
173 views

Is the Bitcoin cryptography library libsecp256k1 not susceptible to the Hertzbleed attack?

I was reading up on the recently disclosed Hertzbleed side channel attack(s). It was speculated on Twitter that the Bitcoin cryptography library libsecp256k1 is not susceptible to these attacks. ...
user avatar
1 vote
2 answers
49 views

How to expand elliptic curve public key from compressed form?

Following this page https://en.bitcoin.it/wiki/Secp256k1, secp256k1 curve's equation is $$y^2=x^3+7$$ Does this mean that I can substitute $G_x$ in the equation to get $G_y$? I think yes and that's ...
user avatar
  • 13
2 votes
2 answers
71 views

Is it possible to calculate the modular inverse of a secp256k1 public key?

I know that it wouldn't be possible to use the extended Euclidean algorithm, since it would require the ability to divide a public key and calculate the remainder. I was wondering if there were any ...
user avatar
1 vote
1 answer
51 views

How to do addition in Montgomery form?

I'm trying to do ECDSA signing, and I need to compute $$\left(k^{-1} \bmod n \cdot (m + d\cdot r) \bmod n\right) \bmod n$$ I'm able to do the inverse function and multiplication in Montgomery form, ...
user avatar
  • 13
0 votes
0 answers
94 views

ECDSA private key recovery

I have a bunch of signatures (1000) signed with ECDSA secp256k1 curve. I can verify all of them with the same public key. I have studied attacks are performed against ECDSA signatures using known MSB ...
user avatar
1 vote
0 answers
53 views

What data can be derived from ECDSA signature and message?

I generate a random message m sent to a device that calculates sig(m, privKey) with secp256k1...
user avatar
  • 11
0 votes
1 answer
57 views

Practical check the point is on the Curve [duplicate]

The curve I am using is secp256r1. Its formulae is $y^2 == x^3 + a\cdot x + b$ $a$ = 0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc (...
user avatar
  • 21
0 votes
2 answers
74 views

How to select $r$ in Pedersen commitment scheme?

I'm implementing Pedersen commitment scheme in order to enhance entropy of a pre-image of a hash. I'm using secp256k1 for my curve parameters. I am following naming conventions from here: What is a ...
user avatar
1 vote
1 answer
160 views

Shor's algorithm and ECDSA in Bitcoin - why is finding the private key still difficult when we know the base point?

I'm learning about Shor's algorithm and how it can be applied to break ECDSA. I've clearly missed something basic here - I thought I understood that the challenge ECDSA presented was to find the ...
user avatar
  • 13
2 votes
2 answers
356 views

Modulo p in Elliptic Curve Cryptography

To carry out Elliptic Curve Cryptography between parties, are all elliptic curve equations considered to be in the form $\bmod p$? For example, the $secp256k1$ Bitcoin curve of the equation $y^2=x^3+7$...
user avatar
0 votes
1 answer
104 views

Possible to directly calculate the Recovery ID from a msg, signature and public key in ECDSA/secp256k1?

Problem Let's say I receive a signature $(r,s)$, the corresponding public key and the message that was signed. I don't have access to the private key. I need to know what the ...
user avatar
0 votes
1 answer
116 views

How to prove that an elliptic curve point is smaller or greater than half of the curve's order?

Is it possible to tell if a point on an elliptic curve is less than half of the curve's order? If I have a point $𝐴 = [a]𝐺$ on a curve with prime order q, is there an efficient way to know that $a &...
user avatar
  • 1
1 vote
1 answer
97 views

Reusing additional data k' nonce from RFC6979 ECDSA

It is known that you must not reuse k in ECDSA; doing so will leak your private key. That's one of the reasons RFC6979 deterministic signatures were invented. Now, ...
user avatar
0 votes
0 answers
66 views

Help determine points on P-256 lie on the actual curve

The curve equation for P-256 is: NIST P-256 y^2 = x^3-3x+41058363725152142129326129780047268409114441015993725554835256314039467401291 Below I am generating key data, including the secret key "d&...
user avatar
1 vote
1 answer
168 views

Convert secp256k1 private key to sr25519 private key

Is it possible to convert secp256k1 private key to valid sr25519 key?
user avatar
1 vote
1 answer
151 views

On an Elliptic Curve is that possible that from $P$ we can tell if $a$ is quadratic residue modulo $N$?

Imagine that, On an Elliptic Curve cryptography scheme where $P=a\times G$, Bob shares his public key $P$ with Eve (the devil who wants to know secrets he is not supposed to). Bob has also revealed a ...
user avatar
  • 172
3 votes
1 answer
117 views

The better algorithm for Modular Exponentiation on secp256k1/r1

I know Modular Exponentiation ($r = b^e \bmod m$) is important for RSA, and I can find some algorithm that if e is expressed in binary form (for exp: )--in such way for a n-bit long e, one can expect ~...
user avatar
  • 111
0 votes
1 answer
116 views

Chinese remainder theorem in ECDSA for parameters in secp256k1?

It is known that it is possible to apply the Chinese remainder theorem and attack RSA under precise conditions. https://tls.mbed.org/public/WSchindler-...
user avatar
  • 3
2 votes
1 answer
128 views

Is it safe to implement elliptic curve Diffie Hellman with secp256k1

I need to implement X3DH Key Agreement Protocol according to Signal specification, in the document they suggest using either X25519 or X448 curves. I assume those curves have been chosen for this ...
user avatar
  • 121
1 vote
1 answer
454 views

How to calculate the order of secp256k1?

The elliptic curve secp256k1 is defined as $y^2 = x^3 + 7$. The prime for the field is set to: ...
user avatar
  • 113
2 votes
1 answer
132 views

ECC Point Addition on Jacob coordinate -- Not Commutative?

I have a python script that does the ECC point addition (code paste below), it simply performs the P =Q1+Q2 on Jacob coordination. However, when doing some regression tests, I found that if I exchange ...
user avatar
  • 111
1 vote
1 answer
119 views

Is it possible to calculate and unknown point on an EC

I aim to find the answer to what is $X$ on an EC over a finite field where $A + X = B$ and $A$ and $B$ are known. I’m currently learning with secp256k1 so the simplified equation for the curve is $y^2 ...
user avatar
3 votes
1 answer
352 views

Problem with point addition about [n-1]+[2]G and [n-1]+G on on Secp256k1

I apologize in advance for my question. I am trying to make my own simple Secp256k1 calculator, just addition and subtraction, and one thing keeps confusing me. When I add 2 points, and I know what ...
user avatar
  • 31
1 vote
1 answer
277 views

Verify that x, y coordinates given as hex string are valid points on an Elliptic Curve [duplicate]

Given the following information: "curve": "P-256", "qx": "729C51D177EBE2079A0FB7B0B3C2145159CF81EC61960E642A1744719AA9F913", "qy": "...
user avatar
  • 11
0 votes
1 answer
100 views

Fully understanding bitcoin transcation verifying and secp256k1

Hello fellow cryptographers. I have spent last few days trying to understand and find a way to generate secp256k1 private and public keys from scratch, but i failed. I have seen tons of videos and ...
user avatar
4 votes
3 answers
903 views

secp256k1: is it theoretically possible to generate same signature with different key, message hash and k?

For a given private key $d$, random $k$ and message hash $h$ is it possible that there exists a different set of $d$, $k$ and $h$ which produces the same signature using $\text{secp256k1}$ curve?
user avatar
0 votes
1 answer
74 views

substract points on secp256k - result as moved to N-1

I must perform calculate of substract two points: Let $G$ be the generator point and; $P_1 =[1]G = (x_1,y_1)$ $P_2 = [2]G = (x_2,y_2)$, When I will subtract $P_1 - P_2$ -> I will move Point to N-1 ...
user avatar
  • 1
0 votes
0 answers
59 views

Security of SecretKey addition and PublicKey multiplication in secp256k1

I understand that: $[a+b]G = [a]G + [b]G$ where $a$ and $b$ are secret keys. (See: Is there a relationship between the secp256k1 public key of the sum of two private keys, and the public keys of ...
user avatar
  • 711
0 votes
0 answers
470 views

Bitcoin Key Recovery Without Nonce Re-Use

There are a lot of questions in these forums regarding the recovery of private keys. But I'm here to postulate on something unique to a specific piece of research that I looked into recently. The ...
user avatar
  • 115
4 votes
0 answers
377 views

secp256k1 scalar decomposing and prime field arithmetic

I'm currently studying the elliptic curve secp256k1 implementation. In my understanding, it has efficiently computable endomorphisms: We can find out a pair of number $\lambda$ and $\beta$ from the ...
user avatar
  • 61
0 votes
1 answer
259 views

Deterministic Key using a seed for ECNamedCurve

I am trying to generate deterministic keys using EC curve secp521r1 in java. I went through KDF but, couldn't find any references to use it with EC curves. I would appreciate if someone could point me ...
user avatar
1 vote
3 answers
544 views

secp256k1 prime modulus vs order

For curve secp256k1 prime modulus is $2^{256}-2^{32}-977$ and order is smaller number but has near half of starting bits set. If I draw number to be private key, it must be less than order. All field ...
user avatar
  • 39
1 vote
1 answer
308 views

How to choose secp256k1 private key?

The private key is any random 256 bit (but smaller than prime p) number or must be prime or other condition? For selected $x$ can be found $y$ - decompressing key: ...
user avatar
  • 39
1 vote
1 answer
211 views

Is it acceptable to use a HMAC-SHA256 hash as a secp256k1 private key?

Say I want to generate a deterministic private key related to some data, for instance to a domain name. The easiest way I can think of is: take a secret material which will work as "generator&...
user avatar
2 votes
2 answers
912 views

Is there a relationship between the secp256k1 public key of the sum of two private keys, and the public keys of those original two private keys?

If I have two secp256k1 private keys and add them together, can I derive the public key for the sum, if I only know the public keys for the two original private keys? (I think this may be the core of ...
user avatar
  • 711
0 votes
0 answers
125 views

Is there a relation between the private keys of secp256k1 public keys of opposite parities?

From observation, 32 bit public key values of opposite parities are either both valid, or both invalid. ...
user avatar
  • 711