Questions tagged [secp256k1]

This tag should be used for anything related to the secp256k1 algorithm used for Bitcoin's public key cryptography.

Filter by
Sorted by
Tagged with
4 votes
1 answer
2k views

In Bitcoin, given half the 52-character private key in WIF format, is it possible to reconstruct the whole private key?

Given the following two preconditions: It is almost impossible to reconstruct a bitcoin private key if an attacker only has one half of the private key as well as the public key. It is almost ...
Ohumeronen's user avatar
1 vote
0 answers
54 views

Using Deterministic ECDSA (secp256k1) Signature as a Cipher Key in Symmetric Encryption

I'm exploring the security implications of utilizing a deterministic ECDSA signature as a cipher key for symmetric encryption and would appreciate insights from the community. Here's the setup I'm ...
landabaso's user avatar
  • 111
2 votes
1 answer
125 views

Loop back or cyclic nature of secp256k1 curve

I am working with point addition and scalar multiplication on the secp256k1 curve for points $(x,y)$ or public keys to derive the next public key scalar k times further from it. Actually when I use a ...
Aflatoon's user avatar
1 vote
1 answer
119 views

How can we derive G from P and N?

I would like to find the fastest way to derive G for secp256k1 and secq256k1 curves, does anyone know the method, equation? Edit: I'm interested to know how can this happen, when we use n/2 of ...
Aggregator's user avatar
0 votes
1 answer
80 views

Z-coordinate in Jacobian coordinates

secp256k1 Generator:(G_X, G_Y, 0x1), secp256k1 any public key using affine coordinates : B=(X, Y) secp256k1 any Public key using jacobian coordinates:BB=(P_X, P_Y, P_Z) (B's private key)==(BB's ...
bnsage123's user avatar
1 vote
2 answers
199 views

Performing Point Division on secp256k1 Elliptic Curve for odd Integers

I'm exploring elliptic curve cryptography, specifically on the secp256k1 curve. I've come across the concept of point division by integers using scale multiplication, my question is how can I devide a ...
Favour's user avatar
  • 39
3 votes
0 answers
136 views

EC public key with leading zeros

Let us take example of secp256k1 curve. The current known public key with most leading zero (in x cordinate) is: ...
madhurkant's user avatar
6 votes
2 answers
2k views

Are curve secp256k1 ECDSA signatures distinguishable from random data?

Are the 64-byte curve secp256k1 ECDSA signatures distinguishable from random data? I.e. Given a random private key and random data, will there be patterns? Is there a proof or reasoning for this?
fadedbee's user avatar
  • 916
0 votes
3 answers
169 views

Understanding Point Negation in secp256k1 Elliptic Curve

I'm exploring the secp256k1 elliptic curve in the context of cryptography and encountered the concept of Point negation. I would appreciate clarification on what point negation means in this context. ...
Favour's user avatar
  • 39
0 votes
1 answer
235 views

Implementing Floor Division on secp256k1 Elliptic Curve in Python

I understand that the // operator is used for floor division in regular arithmetic result = 7 // 3 # This will result in 2 but ...
Favour's user avatar
  • 39
1 vote
1 answer
252 views

Finding scalar in scalar multiplication on secp256k1 elliptic curve

In elliptic curve cryptography using the secp256k1 curve, how can I determine the number of times the base point $G$ has been multiplied to derive a new point? The formula is as follow: $k * G = Q$ ...
Aviril Smith's user avatar
1 vote
0 answers
78 views

Can lattice attack work MSB or LSB are unkown but 16 bytes of private key are known?

I have been reading about lattice attack on ECDSA when partial bits of nonce are known for amount of signatures, So i went through some source code trying to understand how it works. First of all, ...
Alexio puk2sefu's user avatar
2 votes
1 answer
265 views

Point halving formula for Koblitz curve over prime field

Consider a Koblitz elliptic curve over a prime field $\mathbb F_p$, with equation $y^2=x^3+b$, prime order $n$ close to (but different from) $p$. This includes secp256k1, secp224k1, secp192k1, ...
angelo's user avatar
  • 21
-1 votes
1 answer
284 views

How to convert (Rx1 and Ry1) to (Rx2 and Ry2)

I'm working with the secp256k1 elliptic curve and have point doubling and point addition formulas for this curve. If a point is given $Q_x$ and $Q_y$ ...
Aviril Smith's user avatar
0 votes
0 answers
63 views

Same message different nonce but similarities in r value of the signatures(r,s)

I'm studying a case where when i sign a same message with the same private key and a different nonce, i sometimes get signatures (r,s) where r values share some similarities (same numbers at the same ...
PrinceZee's user avatar
  • 101
1 vote
1 answer
349 views

How to determine the prefix of a SECP256K1 compressed public key

I need to store a public key in a variable of maximum 32 bytes. I recover the compressed key and remove its prefix, but then I have to do the opposite: I have to rebuild the compressed address from it ...
Sino's user avatar
  • 11
2 votes
2 answers
141 views

is it possible to calculate the difference between 2 public keys of secp256k1

I am inquiring about the feasibility of calculating the point difference between two distinct secp256k1 elliptic curve points. Given the nature of secp256k1, which is widely used in cryptographic ...
Melwyn's user avatar
  • 21
2 votes
1 answer
106 views

Does using only one sign of secp256k1 publc keys weaken security?

As far as I understand, compressed public keys of secp256k1 can represent points either above or below the X axis, depending on whether they begin 0x02 or 0x03. Am I correct in thinking that if you ...
fadedbee's user avatar
  • 916
1 vote
2 answers
56 views

In ECDSA over K256, Why R.x should be less than the subgroup order, not field order? But in BIP340 over K256, should be less than field order

I understand that R.x is a field element. I don't understand why in ECDSA verification ie. FIPS 186-5 section 6.4.2 step 1, we check whether r is less than subgroup order. If it has something to do ...
Atonal's user avatar
  • 153
0 votes
1 answer
149 views

Trouble detecting cyclic group order crossovers in SECP256K1

There's a problem in detecting whether the sum of public key addition has crossed the cyclic group order boundary For this example, think of public keys $Pub$ as private keys $Priv$, (private scalars),...
Maltoon Yezi's user avatar
3 votes
1 answer
260 views

Does ECDH on secp256k produce a defined shared secret for two key pairs, or is it implementation defined?

Rust and NodeJS implementations of ECDH on secp256k1 produce different shared secrets, when using identical keypairs: NodeJS: ...
fadedbee's user avatar
  • 916
1 vote
1 answer
77 views

Can anyone explain the algorithm that OpenSSL uses to add two points on an elliptic curve?

I am trying to understand how OpenSSL adds points on an elliptic curve. I have understood from here that ossl_ec_GFp_simple_add() is where the addition op works. Can anyone explain the algorithm used ...
Knm's user avatar
  • 11
2 votes
1 answer
637 views

What is the relationship between NIST and secp256k1?

While exploring secp256k1, I came across what seems like the official definition at https://www.secg.org/, specifically in https://www.secg.org/sec2-v2.pdf. In terms of authorship, the document only ...
aryzing's user avatar
  • 123
2 votes
2 answers
170 views

Can you find a secure curve defined over the scalar field of secp256k1?

Is it possible to find a secure curve which's base field is the scalar field of secp256k1? In general, can you find a secure curve defined over the scalar field of any secure curve? (For example, a ...
RobinLinus's user avatar
2 votes
0 answers
93 views

Safety of reusing same seed to derive secp256k1 keys and AES-256-GCM

The use case here is to deterministically generate a multi-use wallet from a single 12-word BIP39 mnemonic. Currently a standard process for deriving secp256k1 keypairs is implemented, e.g., using a ...
snsdgm's user avatar
  • 21
6 votes
2 answers
364 views

Method to break a baby Elliptic Curve analog to secp256k1

What would be the method of choice to compute the private key from the public key on a baby analog of secp256k1, say with $p$ and $n$ 144-bit? What would be the pros and cons of Pollard's rho and ...
shy-student's user avatar
2 votes
1 answer
312 views

A property of some Koblitz elliptic curves over a prime field

secp256k1 is an elliptic curve $E$ over a prime field $\mathbb F_p$, of equation $y^2\equiv x^3+b\pmod p$, with prime order $n$. I noticed† that the different curve $E'$ over the prime field $\mathbb ...
fgrieu's user avatar
  • 140k
2 votes
1 answer
438 views

Help with adding and multiplying points on secp256k1

I'm currently working on implementing digital signatures on the curve secp256k1 (for learning purposes only), and I'm having some trouble implementing ECDSA on curve secp256k1. As I understand it, ...
Pedro's user avatar
  • 41
-2 votes
1 answer
201 views

What is secp256k1 and can we have a post quantum cryptography with that? [closed]

Please detail secp256k1 and its role in a public key cryptography. Please explain can we use it into a post-quantum cryptography and how can we do it?
Alireza's user avatar
  • 109
1 vote
1 answer
589 views

ECDSA SECP256k1 curve - same-r-value-is-used-for-two-different-addresses

Edited: changing the notation according request by fgrieu. I have prepared 4 transactions for 2 pubkeys with the same r1 and r2. properties of secp256k1: ...
Ironic's user avatar
  • 11
1 vote
1 answer
52 views

Can a quantum attacker prove that incomplete ECDSA signatures were produced with the same key?

Assume a 256-bit ECDSA private key used with Secp256k1 and SHA-256. This key signs multiple different messages in a fully deterministic manner as described in RFC-6979, so signing the same message ...
ostrich's user avatar
  • 43
3 votes
2 answers
165 views

Given multiple incomplete ECDSA signatures, what can a quantum attacker learn in the following scenarios?

Assume a 256-bit ECDSA private key used with Secp256k1 and SHA-256. This key signs multiple different messages in a fully deterministic manner as described in RFC-6979, so signing the same message ...
ostrich's user avatar
  • 43
2 votes
0 answers
40 views

Fusion auth versus jose4j library for jwt using secp256k [closed]

I am a beginner in-terms of JWT libraries in programming. How the keypair used (secp256k1) is related with the algorithmic header used for creation of JWT? And why authfusion doesn't need an ...
Benjamin's user avatar
2 votes
1 answer
147 views

Elliptic Curve - Is it possible to know whether a particular value is the result of ECadd or ECdouble?

As we know the public key is generated from the private key and the process is point addition and point double and so on. If we see a list, it would look like a list of values coming from ECadd and ...
UnpluggedTrio's user avatar
3 votes
1 answer
398 views

Criteria for choice of prime field in secp256k1?

In secp256k1, the prime order field $\mathbb F_p$ uses $$p=2^{256}-2^{32}-977$$ This is the largest prime $p$ less than $2^{256}-2^{32}$ allowing to construct a Koblitz curve $y^2\equiv x^3+b\bmod p$ ...
fgrieu's user avatar
  • 140k
1 vote
0 answers
358 views

How to calculate points for twist?

How I can find the point to perform this twist attack - https://cryptodeep.ru/twist-attack/ English version of previous link: https://github.com/demining/Twist-Attack This video has additional ...
Matiy's user avatar
  • 29
3 votes
3 answers
1k views

How can we reverse Elliptic Curves after solving the DLP problem?

Suppose that I've solved the Discrete Logarithm problem. Can someone explain to me in terms of the example below how to arrange values of Elliptic Curve secp256k1 in a reverse form so that I can ...
UnpluggedTrio's user avatar
1 vote
0 answers
63 views

Troubleshooting ECDSA implementation in rust [closed]

I'm trying to implement ECDSA for learning purposes and have generated public and private keys, which seem to be correct as I have compared them with those generated by an online tool called noble. ...
Question's user avatar
1 vote
1 answer
289 views

Is the generator point in the curve in secp256k1?

Here is the fixed script ...
Reda Bourial's user avatar
0 votes
1 answer
323 views

Which P-256 is in Web Crypto? [duplicate]

Web Crypto API allows creating ECC keys with some known curves: https://developer.mozilla.org/en-US/docs/Web/API/EcKeyGenParams Those are P-256, P-384, P-521. However as answered at this answer https:/...
Dan D.'s user avatar
  • 103
4 votes
1 answer
802 views

Is it true that Public keys with even y coordinate correspond to private key that are less than n/2 and vice versa? (Secp256k1)

The question is somewhat complex and directed to clearing things out. Suppose that $n$ is the order of the cyclic group. It $n - 1$ is the number of all private keys possible ...
Emma Lincoln's user avatar
0 votes
1 answer
175 views

Proof that user compressed public key corresponds the curve equation (secp256k1)

I am trying to check if some compressed public key corresponds to an elliptic curve equation (secp256r1). As far as I know it should be valid once the following equation is fulfill y^2 = x^3 + ax + b ...
bladzio's user avatar
  • 103
0 votes
1 answer
262 views

Determine if an elliptic point is negative

How to determine if an elliptic point $kG$ is negative? Is $k<0?$ By example, for $k=1234$, the coordinate of the point $1234G$ using secp256k1 = $X= ...
PeterMacGonagan's user avatar
8 votes
2 answers
360 views

Is the elliptic-curve cryptography library libsecp256k1 not susceptible to the Hertzbleed attack?

I was reading up on the recently disclosed Hertzbleed side channel attack(s). It was speculated on Twitter that the elliptic-curve cryptography library libsecp256k1 is not susceptible to these attacks....
Michael Folkson's user avatar
1 vote
2 answers
732 views

How to expand elliptic curve public key from compressed form?

Following this page https://en.bitcoin.it/wiki/Secp256k1, secp256k1 curve's equation is $$y^2=x^3+7$$ Does this mean that I can substitute $G_x$ in the equation to get $G_y$? I think yes and that's ...
sshd's user avatar
  • 13
2 votes
2 answers
762 views

Is it possible to calculate the modular inverse of a secp256k1 public key?

I know that it wouldn't be possible to use the extended Euclidean algorithm, since it would require the ability to divide a public key and calculate the remainder. I was wondering if there were any ...
Rein Ernst's user avatar
1 vote
1 answer
167 views

How to do addition in Montgomery form?

I'm trying to do ECDSA signing, and I need to compute $$\left(k^{-1} \bmod n \cdot (m + d\cdot r) \bmod n\right) \bmod n$$ I'm able to do the inverse function and multiplication in Montgomery form, ...
kpeteL's user avatar
  • 13
0 votes
0 answers
913 views

ECDSA private key recovery

I have a bunch of signatures (1000) signed with ECDSA secp256k1 curve. I can verify all of them with the same public key. I have studied attacks are performed against ECDSA signatures using known MSB ...
Nightbird's user avatar
1 vote
0 answers
326 views

What data can be derived from ECDSA signature and message?

I generate a random message m sent to a device that calculates sig(m, privKey) with secp256k1...
ln3xp's user avatar
  • 11
0 votes
1 answer
120 views

Practical check the point is on the Curve [duplicate]

The curve I am using is secp256r1. Its formulae is $y^2 == x^3 + a\cdot x + b$ $a$ = 0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc (...
Renard's user avatar
  • 21