Questions tagged [secp256k1]
This tag should be used for anything related to the secp256k1 algorithm used for Bitcoin's public key cryptography.
101 questions
-1
votes
1
answer
53
views
Is it possible to uses large partial private key exposure to recover the ecdsa nonce?
There’s many algorithms for recovering the private key from nonce leakage but I’m not aware of any of them for recovering a nonce from a ecdsa signature.
In details, I know the higher order 120 bits ...
- 339
2
votes
0
answers
73
views
Proof-of-Work Challenge with a Built-In Advantage
I come here feeling like Don Quixote chasing windmills. I'm a complete newbie in cryptography, but I find myself trying to solve a problem without even knowing if it's solvable.
I want to design a ...
- 21
0
votes
1
answer
91
views
ECC Point-Scalar multiplication
I implemented my own Double-and-add method to make a public key from a private key using SECP256K1's parameters, this is how my code looks so far
...
- 11
-1
votes
1
answer
66
views
-1
votes
1
answer
76
views
How to Convert a Point from secp256k1 to secp384r1 in Elliptic Curve Cryptography
I'm working with elliptic curve cryptography and have a generator point $G$ on the secp256k1 curve. For example, I can express a point as $5G$ (the result of multiplying the generator point by 5).
...
0
votes
1
answer
70
views
Can parties in an MPC protocol establish a shared secret with an external party?
Creating a shared secret(ECDH) with a single private key is easy:
a·B = b·A
Does the same apply to MPC? and if so how?
Based on Gennaro and Goldfeder CCS 2018
0
votes
1
answer
95
views
Using a public key's points (other than the generator point) to calculate the order of the group (SECP256k1)?
Imagine if we were on a mission to try to calculate the order of the cyclic group $n$
...
- 49
1
vote
2
answers
122
views
Can attacker recover private key if he have history of intermediate elliptic curve point coordinates?
It is known that elliptic curves are used in public-key cryptography.
Lets take for example secp256k1. Given private key $k$ and generator point $G$, we can get public key by performing elliptic curve ...
2
votes
1
answer
183
views
0
votes
0
answers
75
views
Subtraction of inverse points in secp256k1
In pure math given:
k = 10
l = -10
k + l = 0
k - l = 20
Now in secp256k1
$K = k*G$
$L = l*G$
$K+L = O$
$K-L = O$
Why do we get identity point on subtraction since:
...
- 13
1
vote
1
answer
187
views
Secp256k1 giving y-value for inverse of point
Given a secp256k1 point $P$ with scalar 3 where:
$P = 3*G$
You get a point with co-ordinates:
...
- 13
0
votes
1
answer
112
views
What's wrong with BIP32 from NIST's perspective?
BIP32 is listed as Non-Approved Security Functions (see page 29 in 1). I could not find any problem with the primitives used in BIP32.
HMAC-SHA512: This is a FIPS-approved algorithm (see page 25 in 1)....
- 193
1
vote
0
answers
56
views
Can the ability to sign arbitrary messages expose the private key?
Consider a system that consists of a black box (some abstraction layer with perfect sandboxing). The black box contains a private key that cannot be extracted by request, but the black box exposes an ...
1
vote
1
answer
218
views
What’s the fastest known Koblitz curve addition law for FPGA that maximizes the per-LUT throughput?
The addition or multiplication laws used by large mainstream libraries achieve faster speed by using many many more operations in order to avoid larger numbers. And my problem is here: faster speeds ...
- 339
1
vote
2
answers
140
views
Is it safe to reuse the same scalar when doing direct scalar multiplication on Koblitz curves?
Let $s$ be a private key and $k=intAsScalar(s)$. Finding $s$ from $P_k=[k]G$ involves solving the Elliptic curves discrete logarithm problem.
But what if the same $k$ is also used for performing 1 or ...
- 339
1
vote
1
answer
71
views
The comparison of public keys corresponding to signatures based on secp256k1
Can two signatures based on the elliptic curve secp256k1 be compared to determine if they use the same public key without recovering the public keys?
- 11
-2
votes
3
answers
255
views
can we modify the prime field by increasing it in secp256k1?
If in ECDSA secp256k1 we have the prime field p=2256 - 232 - 29 - 28 - 27 - 26 - 24 - 1, can we increase it to p=2256, if we keep the double and add operations the same, the curve equation the same ...
- 1
1
vote
1
answer
185
views
How to use smt solvers in order to restrict the possible key search where a portion of the private key and a portion of the public key hash is known?
I’m in the following situation :
I’ve a portion/first bytes of a private secp256k1 security key such as it would take minutes to fully recover it through Pollard’s Kangaroo if I had the public key.
...
- 339
3
votes
1
answer
1k
views
When incrementing a private key by 1, by how much is the public key Incremented?
If you have a secp256k1 keypair and you increment the private key by 1, then a faster way to compute the new public key is to perform an addition on the previous public key. But by how much?
Some ...
- 339
0
votes
1
answer
350
views
How to know if an ECC public key is y or -y
I'm a beginner still learning how ecc works... And i think I understand that in secp256k1 public keys there is something called addictive and negative inverse for example private key:- ...
- 1
1
vote
0
answers
59
views
How to know the number of digits in the decimals place in elliptic curve division result?
$p$ - is the order of the finite field
$n$ - is the order of the group. Private keys can range from $1$ (the generator point $G$) to $n - 1$.
All the private keys ($Priv$) lie in certain ranges of 2.
$...
- 49
0
votes
1
answer
146
views
Elliptic Curve Cryptography: Point Multiplication by 3 on secp256k1 Curve
Is there a direct non-iterative formula for point multiplication by 3 in the secp256k1 elliptic curve just like point multiplication by 2 (point doubling)? If such a formula exists, could you explain ...
- 41
5
votes
1
answer
2k
views
In Bitcoin, given half the 52-character private key in WIF format, is it possible to reconstruct the whole private key?
Given the following two preconditions:
It is almost impossible to reconstruct a bitcoin private key if an attacker only has one half of the private key as well as the public key.
It is almost ...
- 151
1
vote
0
answers
97
views
Using Deterministic ECDSA (secp256k1) Signature as a Cipher Key in Symmetric Encryption
I'm exploring the security implications of utilizing a deterministic ECDSA signature as a cipher key for symmetric encryption and would appreciate insights from the community. Here's the setup I'm ...
- 111
2
votes
1
answer
219
views
Loop back or cyclic nature of secp256k1 curve
I am working with point addition and scalar multiplication on the secp256k1 curve for points $(x,y)$ or public keys to derive the next public key scalar k times further from it. Actually when I use a ...
- 21
1
vote
1
answer
186
views
How can we derive $G$ from $P$ and $N$?
I would like to find the fastest way to derive $G$ for secp256k1 and secq256k1 curves. Does anyone know the method or equation?
Edit:
I'm interested to know how can this happen, when we use $\dfrac{n}{...
- 11
0
votes
1
answer
155
views
Z-coordinate in Jacobian coordinates
secp256k1 Generator:(G_X, G_Y, 0x1),
secp256k1 any public key using affine coordinates : B=(X, Y)
secp256k1 any Public key using jacobian coordinates:BB=(P_X, P_Y, P_Z)
(B's private key)==(BB's ...
- 23
1
vote
2
answers
593
views
Performing Point Division on secp256k1 Elliptic Curve for odd Integers
I'm exploring elliptic curve cryptography, specifically on the secp256k1 curve. I've come across the concept of point division by integers using scale multiplication, my question is how can I devide a ...
- 41
3
votes
0
answers
254
views
EC public key with leading zeros
Let us take example of secp256k1 curve. The current known public key with most leading zero (in x cordinate) is:
...
- 686
6
votes
2
answers
2k
views
Are curve secp256k1 ECDSA signatures distinguishable from random data?
Are the 64-byte curve secp256k1 ECDSA signatures distinguishable from random data?
I.e. Given a random private key and random data, will there be patterns?
Is there a proof or reasoning for this?
- 968
0
votes
3
answers
398
views
Understanding Point Negation in secp256k1 Elliptic Curve
I'm exploring the secp256k1 elliptic curve in the context of cryptography and encountered the concept of Point negation. I would appreciate clarification on what point negation means in this context.
...
- 41
0
votes
1
answer
428
views
Implementing Floor Division on secp256k1 Elliptic Curve in Python
I understand that the // operator is used for floor division in regular arithmetic
result = 7 // 3 # This will result in 2
but ...
- 41
1
vote
1
answer
526
views
Finding scalar in scalar multiplication on secp256k1 elliptic curve
In elliptic curve cryptography using the secp256k1 curve, how can I determine the number of times the base point $G$ has been multiplied to derive a new point? The formula is as follow:
$k * G = Q$
...
- 21
2
votes
0
answers
243
views
Can lattice attack work MSB or LSB are unkown but 16 bytes of private key are known?
I have been reading about lattice attack on ECDSA when partial bits of nonce are known for amount of signatures, So i went through some source code trying to understand how it works.
First of all, ...
2
votes
1
answer
541
views
Point halving formula for Koblitz curve over prime field
Consider a Koblitz elliptic curve over a prime field $\mathbb F_p$, with equation $y^2=x^3+b$, prime order $n$ close to (but different from) $p$. This includes secp256k1, secp224k1, secp192k1, ...
- 21
-1
votes
1
answer
303
views
How to convert (Rx1 and Ry1) to (Rx2 and Ry2)
I'm working with the secp256k1 elliptic curve and have point doubling and point addition formulas for this curve.
If a point is given $Q_x$ and $Q_y$
...
- 45
0
votes
0
answers
82
views
Same message different nonce but similarities in r value of the signatures(r,s)
I'm studying a case where when i sign a same message with the same private key and a different nonce, i sometimes get signatures (r,s) where r values share some similarities (same numbers at the same ...
- 101
1
vote
1
answer
999
views
How to determine the prefix of a SECP256K1 compressed public key
I need to store a public key in a variable of maximum 32 bytes.
I recover the compressed key and remove its prefix, but then I have to do the opposite: I have to rebuild the compressed address from it ...
- 11
2
votes
2
answers
276
views
is it possible to calculate the difference between 2 public keys of secp256k1
I am inquiring about the feasibility of calculating the point difference between two distinct secp256k1 elliptic curve points. Given the nature of secp256k1, which is widely used in cryptographic ...
- 31
2
votes
1
answer
139
views
Does using only one sign of secp256k1 publc keys weaken security?
As far as I understand, compressed public keys of secp256k1 can represent points either above or below the X axis, depending on whether they begin 0x02 or 0x03.
Am I correct in thinking that if you ...
- 968
1
vote
2
answers
77
views
In ECDSA over K256, Why R.x should be less than the subgroup order, not field order? But in BIP340 over K256, should be less than field order
I understand that R.x is a field element.
I don't understand why in ECDSA verification ie. FIPS 186-5 section 6.4.2 step 1, we check whether r is less than subgroup order.
If it has something to do ...
- 155
0
votes
2
answers
208
views
Trouble detecting cyclic group order crossovers in SECP256K1
There's a problem in detecting whether the sum of public key addition has crossed the cyclic group order boundary
For this example, think of public keys $Pub$ as private keys $Priv$, (private scalars),...
- 49
3
votes
1
answer
291
views
Does ECDH on secp256k produce a defined shared secret for two key pairs, or is it implementation defined?
Rust and NodeJS implementations of ECDH on secp256k1 produce different shared secrets, when using identical keypairs:
NodeJS:
...
- 968
1
vote
1
answer
98
views
Can anyone explain the algorithm that OpenSSL uses to add two points on an elliptic curve?
I am trying to understand how OpenSSL adds points on an elliptic curve. I have understood from here that ossl_ec_GFp_simple_add() is where the addition op works. Can anyone explain the algorithm used ...
- 11
2
votes
1
answer
1k
views
What is the relationship between NIST and secp256k1?
While exploring secp256k1, I came across what seems like the official definition at https://www.secg.org/, specifically in https://www.secg.org/sec2-v2.pdf. In terms of authorship, the document only ...
- 123
2
votes
2
answers
242
views
Can you find a secure curve defined over the scalar field of secp256k1?
Is it possible to find a secure curve which's base field is the scalar field of secp256k1?
In general, can you find a secure curve defined over the scalar field of any secure curve? (For example, a ...
- 361
2
votes
0
answers
130
views
Safety of reusing same seed to derive secp256k1 keys and AES-256-GCM
The use case here is to deterministically generate a multi-use wallet from a single 12-word BIP39 mnemonic. Currently a standard process for deriving secp256k1 keypairs is implemented, e.g., using a ...
- 21
6
votes
2
answers
792
views
Method to break a baby Elliptic Curve analog to secp256k1
What would be the method of choice to compute the private key from the public key on a baby analog of secp256k1, say with $p$ and $n$ 144-bit?
What would be the pros and cons of Pollard's rho and ...
- 61
2
votes
1
answer
428
views
A property of some Koblitz elliptic curves over a prime field
secp256k1 is an elliptic curve $E$ over a prime field $\mathbb F_p$, of equation $y^2\equiv x^3+b\pmod p$, with prime order $n$.
I noticed† that the different curve $E'$ over the prime field $\mathbb ...
- 145k
2
votes
1
answer
778
views
Help with adding and multiplying points on secp256k1
I'm currently working on implementing digital signatures on the curve secp256k1 (for learning purposes only), and I'm having some trouble implementing ECDSA on curve secp256k1. As I understand it, ...
- 41