Questions tagged [secp256k1]

This tag should be used for anything related to the secp256k1 algorithm used for Bitcoin's public key cryptography.

Filter by
Sorted by
Tagged with
8 votes
2 answers
370 views

Is the elliptic-curve cryptography library libsecp256k1 not susceptible to the Hertzbleed attack?

I was reading up on the recently disclosed Hertzbleed side channel attack(s). It was speculated on Twitter that the elliptic-curve cryptography library libsecp256k1 is not susceptible to these attacks....
Michael Folkson's user avatar
6 votes
2 answers
2k views

Are curve secp256k1 ECDSA signatures distinguishable from random data?

Are the 64-byte curve secp256k1 ECDSA signatures distinguishable from random data? I.e. Given a random private key and random data, will there be patterns? Is there a proof or reasoning for this?
fadedbee's user avatar
  • 918
6 votes
2 answers
425 views

Method to break a baby Elliptic Curve analog to secp256k1

What would be the method of choice to compute the private key from the public key on a baby analog of secp256k1, say with $p$ and $n$ 144-bit? What would be the pros and cons of Pollard's rho and ...
shy-student's user avatar
4 votes
3 answers
1k views

secp256k1: is it theoretically possible to generate same signature with different key, message hash and k?

For a given private key $d$, random $k$ and message hash $h$ is it possible that there exists a different set of $d$, $k$ and $h$ which produces the same signature using $\text{secp256k1}$ curve?
Yaroslav's user avatar
4 votes
1 answer
2k views

In Bitcoin, given half the 52-character private key in WIF format, is it possible to reconstruct the whole private key?

Given the following two preconditions: It is almost impossible to reconstruct a bitcoin private key if an attacker only has one half of the private key as well as the public key. It is almost ...
Ohumeronen's user avatar
4 votes
1 answer
853 views

Is it true that Public keys with even y coordinate correspond to private key that are less than n/2 and vice versa? (Secp256k1)

The question is somewhat complex and directed to clearing things out. Suppose that $n$ is the order of the cyclic group. It $n - 1$ is the number of all private keys possible ...
Emma Lincoln's user avatar
4 votes
0 answers
819 views

secp256k1 scalar decomposing and prime field arithmetic

I'm currently studying the elliptic curve secp256k1 implementation. In my understanding, it has efficiently computable endomorphisms: We can find out a pair of number $\lambda$ and $\beta$ from the ...
luke's user avatar
  • 61
3 votes
3 answers
2k views

How can we reverse Elliptic Curves after solving the DLP problem?

Suppose that I've solved the Discrete Logarithm problem. Can someone explain to me in terms of the example below how to arrange values of Elliptic Curve secp256k1 in a reverse form so that I can ...
UnpluggedTrio's user avatar
3 votes
2 answers
1k views

Modulo p in Elliptic Curve Cryptography

To carry out Elliptic Curve Cryptography between parties, are all elliptic curve equations considered to be in the form $\bmod p$? For example, the $secp256k1$ Bitcoin curve of the equation $y^2=x^3+7$...
EKahyaoglu's user avatar
3 votes
1 answer
1k views

When incrementing a private key by 1, by how much is the public key Incremented?

If you have a secp256k1 keypair and you increment the private key by 1, then a faster way to compute the new public key is to perform an addition on the previous public key. But by how much? Some ...
user2284570's user avatar
3 votes
2 answers
179 views

Given multiple incomplete ECDSA signatures, what can a quantum attacker learn in the following scenarios?

Assume a 256-bit ECDSA private key used with Secp256k1 and SHA-256. This key signs multiple different messages in a fully deterministic manner as described in RFC-6979, so signing the same message ...
ostrich's user avatar
  • 43
3 votes
1 answer
937 views

Problem with point addition about [n-1]+[2]G and [n-1]+G on on Secp256k1

I apologize in advance for my question. I am trying to make my own simple Secp256k1 calculator, just addition and subtraction, and one thing keeps confusing me. When I add 2 points, and I know what ...
Franko's user avatar
  • 31
3 votes
1 answer
268 views

Does ECDH on secp256k produce a defined shared secret for two key pairs, or is it implementation defined?

Rust and NodeJS implementations of ECDH on secp256k1 produce different shared secrets, when using identical keypairs: NodeJS: ...
fadedbee's user avatar
  • 918
3 votes
1 answer
784 views

How to choose secp256k1 private key?

The private key is any random 256 bit (but smaller than prime p) number or must be prime or other condition? For selected $x$ can be found $y$ - decompressing key: ...
Andrzej's user avatar
  • 59
3 votes
1 answer
426 views

Criteria for choice of prime field in secp256k1?

In secp256k1, the prime order field $\mathbb F_p$ uses $$p=2^{256}-2^{32}-977$$ This is the largest prime $p$ less than $2^{256}-2^{32}$ allowing to construct a Koblitz curve $y^2\equiv x^3+b\bmod p$ ...
fgrieu's user avatar
  • 141k
3 votes
1 answer
330 views

The better algorithm for Modular Exponentiation on secp256k1/r1

I know Modular Exponentiation ($r = b^e \bmod m$) is important for RSA, and I can find some algorithm that if e is expressed in binary form (for exp: )--in such way for a n-bit long e, one can expect ~...
LeonMSH's user avatar
  • 111
3 votes
0 answers
160 views

EC public key with leading zeros

Let us take example of secp256k1 curve. The current known public key with most leading zero (in x cordinate) is: ...
madhurkant's user avatar
2 votes
2 answers
819 views

Is it possible to calculate the modular inverse of a secp256k1 public key?

I know that it wouldn't be possible to use the extended Euclidean algorithm, since it would require the ability to divide a public key and calculate the remainder. I was wondering if there were any ...
Rein Ernst's user avatar
2 votes
2 answers
2k views

Is there a relationship between the secp256k1 public key of the sum of two private keys, and the public keys of those original two private keys?

If I have two secp256k1 private keys and add them together, can I derive the public key for the sum, if I only know the public keys for the two original private keys? (I think this may be the core of ...
fadedbee's user avatar
  • 918
2 votes
2 answers
153 views

is it possible to calculate the difference between 2 public keys of secp256k1

I am inquiring about the feasibility of calculating the point difference between two distinct secp256k1 elliptic curve points. Given the nature of secp256k1, which is widely used in cryptographic ...
Melwyn's user avatar
  • 21
2 votes
1 answer
135 views

Loop back or cyclic nature of secp256k1 curve

I am working with point addition and scalar multiplication on the secp256k1 curve for points $(x,y)$ or public keys to derive the next public key scalar k times further from it. Actually when I use a ...
Aflatoon's user avatar
2 votes
1 answer
767 views

What is the relationship between NIST and secp256k1?

While exploring secp256k1, I came across what seems like the official definition at https://www.secg.org/, specifically in https://www.secg.org/sec2-v2.pdf. In terms of authorship, the document only ...
aryzing's user avatar
  • 123
2 votes
1 answer
425 views

Convert secp256k1 private key to sr25519 private key

Is it possible to convert secp256k1 private key to valid sr25519 key?
Mikky Snowman's user avatar
2 votes
1 answer
289 views

ECC Point Addition on Jacob coordinate -- Not Commutative?

I have a python script that does the ECC point addition (code paste below), it simply performs the P =Q1+Q2 on Jacob coordination. However, when doing some regression tests, I found that if I exchange ...
LeonMSH's user avatar
  • 111
2 votes
1 answer
111 views

Does using only one sign of secp256k1 publc keys weaken security?

As far as I understand, compressed public keys of secp256k1 can represent points either above or below the X axis, depending on whether they begin 0x02 or 0x03. Am I correct in thinking that if you ...
fadedbee's user avatar
  • 918
2 votes
2 answers
188 views

Can you find a secure curve defined over the scalar field of secp256k1?

Is it possible to find a secure curve which's base field is the scalar field of secp256k1? In general, can you find a secure curve defined over the scalar field of any secure curve? (For example, a ...
RobinLinus's user avatar
2 votes
1 answer
333 views

A property of some Koblitz elliptic curves over a prime field

secp256k1 is an elliptic curve $E$ over a prime field $\mathbb F_p$, of equation $y^2\equiv x^3+b\pmod p$, with prime order $n$. I noticed† that the different curve $E'$ over the prime field $\mathbb ...
fgrieu's user avatar
  • 141k
2 votes
1 answer
519 views

Help with adding and multiplying points on secp256k1

I'm currently working on implementing digital signatures on the curve secp256k1 (for learning purposes only), and I'm having some trouble implementing ECDSA on curve secp256k1. As I understand it, ...
Pedro's user avatar
  • 41
2 votes
1 answer
151 views

Elliptic Curve - Is it possible to know whether a particular value is the result of ECadd or ECdouble?

As we know the public key is generated from the private key and the process is point addition and point double and so on. If we see a list, it would look like a list of values coming from ECadd and ...
UnpluggedTrio's user avatar
2 votes
1 answer
308 views

Point halving formula for Koblitz curve over prime field

Consider a Koblitz elliptic curve over a prime field $\mathbb F_p$, with equation $y^2=x^3+b$, prime order $n$ close to (but different from) $p$. This includes secp256k1, secp224k1, secp192k1, ...
angelo's user avatar
  • 21
2 votes
1 answer
2k views

How to calculate the order of secp256k1?

The elliptic curve secp256k1 is defined as $y^2 = x^3 + 7$. The prime for the field is set to: ...
Andy's user avatar
  • 123
2 votes
1 answer
389 views

Is it safe to implement elliptic curve Diffie Hellman with secp256k1

I need to implement X3DH Key Agreement Protocol according to Signal specification, in the document they suggest using either X25519 or X448 curves. I assume those curves have been chosen for this ...
shotex's user avatar
  • 121
2 votes
0 answers
94 views

Safety of reusing same seed to derive secp256k1 keys and AES-256-GCM

The use case here is to deterministically generate a multi-use wallet from a single 12-word BIP39 mnemonic. Currently a standard process for deriving secp256k1 keypairs is implemented, e.g., using a ...
snsdgm's user avatar
  • 21
2 votes
0 answers
41 views

Fusion auth versus jose4j library for jwt using secp256k [closed]

I am a beginner in-terms of JWT libraries in programming. How the keypair used (secp256k1) is related with the algorithmic header used for creation of JWT? And why authfusion doesn't need an ...
Benjamin's user avatar
1 vote
2 answers
61 views

In ECDSA over K256, Why R.x should be less than the subgroup order, not field order? But in BIP340 over K256, should be less than field order

I understand that R.x is a field element. I don't understand why in ECDSA verification ie. FIPS 186-5 section 6.4.2 step 1, we check whether r is less than subgroup order. If it has something to do ...
Atonal's user avatar
  • 155
1 vote
2 answers
772 views

How to expand elliptic curve public key from compressed form?

Following this page https://en.bitcoin.it/wiki/Secp256k1, secp256k1 curve's equation is $$y^2=x^3+7$$ Does this mean that I can substitute $G_x$ in the equation to get $G_y$? I think yes and that's ...
sshd's user avatar
  • 13
1 vote
1 answer
342 views

Is it acceptable to use a HMAC-SHA256 hash as a secp256k1 private key?

Say I want to generate a deterministic private key related to some data, for instance to a domain name. The easiest way I can think of is: take a secret material which will work as "generator&...
anton kumaigorodski's user avatar
1 vote
1 answer
304 views

Finding scalar in scalar multiplication on secp256k1 elliptic curve

In elliptic curve cryptography using the secp256k1 curve, how can I determine the number of times the base point $G$ has been multiplied to derive a new point? The formula is as follow: $k * G = Q$ ...
Aviril Smith's user avatar
1 vote
1 answer
462 views

How to determine the prefix of a SECP256K1 compressed public key

I need to store a public key in a variable of maximum 32 bytes. I recover the compressed key and remove its prefix, but then I have to do the opposite: I have to rebuild the compressed address from it ...
Sino's user avatar
  • 11
1 vote
1 answer
53 views

Can a quantum attacker prove that incomplete ECDSA signatures were produced with the same key?

Assume a 256-bit ECDSA private key used with Secp256k1 and SHA-256. This key signs multiple different messages in a fully deterministic manner as described in RFC-6979, so signing the same message ...
ostrich's user avatar
  • 43
1 vote
1 answer
347 views

Is the generator point in the curve in secp256k1?

Here is the fixed script ...
Reda Bourial's user avatar
1 vote
1 answer
177 views

How to do addition in Montgomery form?

I'm trying to do ECDSA signing, and I need to compute $$\left(k^{-1} \bmod n \cdot (m + d\cdot r) \bmod n\right) \bmod n$$ I'm able to do the inverse function and multiplication in Montgomery form, ...
kpeteL's user avatar
  • 13
1 vote
1 answer
377 views

Reusing additional data k' nonce from RFC6979 ECDSA

It is known that you must not reuse k in ECDSA; doing so will leak your private key. That's one of the reasons RFC6979 deterministic signatures were invented. Now, ...
Paul Miller's user avatar
1 vote
3 answers
1k views

secp256k1 prime modulus vs order

For curve secp256k1 prime modulus is $2^{256}-2^{32}-977$ and order is smaller number but has near half of starting bits set. If I draw number to be private key, it must be less than order. All field ...
Andrzej's user avatar
  • 59
1 vote
1 answer
124 views

How can we derive G from P and N?

I would like to find the fastest way to derive G for secp256k1 and secq256k1 curves, does anyone know the method, equation? Edit: I'm interested to know how can this happen, when we use n/2 of ...
Aggregator's user avatar
1 vote
2 answers
254 views

Performing Point Division on secp256k1 Elliptic Curve for odd Integers

I'm exploring elliptic curve cryptography, specifically on the secp256k1 curve. I've come across the concept of point division by integers using scale multiplication, my question is how can I devide a ...
Favour's user avatar
  • 37
1 vote
1 answer
79 views

Can anyone explain the algorithm that OpenSSL uses to add two points on an elliptic curve?

I am trying to understand how OpenSSL adds points on an elliptic curve. I have understood from here that ossl_ec_GFp_simple_add() is where the addition op works. Can anyone explain the algorithm used ...
Knm's user avatar
  • 11
1 vote
1 answer
629 views

ECDSA SECP256k1 curve - same-r-value-is-used-for-two-different-addresses

Edited: changing the notation according request by fgrieu. I have prepared 4 transactions for 2 pubkeys with the same r1 and r2. properties of secp256k1: ...
Ironic's user avatar
  • 11
1 vote
2 answers
229 views

How to select $r$ in Pedersen commitment scheme?

I'm implementing Pedersen commitment scheme in order to enhance entropy of a pre-image of a hash. I'm using secp256k1 for my curve parameters. I am following naming conventions from here: What is a ...
Ilia Sidorenko's user avatar
1 vote
1 answer
621 views

Shor's algorithm and ECDSA in Bitcoin - why is finding the private key still difficult when we know the base point?

I'm learning about Shor's algorithm and how it can be applied to break ECDSA. I've clearly missed something basic here - I thought I understood that the challenge ECDSA presented was to find the ...
compp's user avatar
  • 13