9 votes

How can we reverse Elliptic Curves after solving the DLP problem?

The first thing to do in such a case would be to test that your method really achieves something new by replicating existing prime field DLog records. At the time of writing, the largest public ...
Polytropos's user avatar
9 votes
Accepted

Are curve secp256k1 ECDSA signatures distinguishable from random data?

We know that the standard encoding of points of an elliptic curve is not uniformly random since they must satisfy the curve equation. In another look, we don't have $2*p^2$ points, and if we consider ...
kelalaka's user avatar
  • 48.3k
8 votes
Accepted

Is the elliptic-curve cryptography library libsecp256k1 not susceptible to the Hertzbleed attack?

It's really much too early to make a definitive statement one way or the other on this. The information leakage is based on a feature of some CISC architectures to allow a variable clockrate depending ...
Daniel S's user avatar
  • 22.8k
7 votes
Accepted

Is there a relationship between the secp256k1 public key of the sum of two private keys, and the public keys of those original two private keys?

If I have two secp256k1 private keys and add them together, can I derive the public key for the sum, if I only know the public keys for the two original private keys? Yes. While the idea of 'public ...
poncho's user avatar
  • 146k
7 votes

Are curve secp256k1 ECDSA signatures distinguishable from random data?

Reformulating slightly1: Can we distinguish from 64-byte of random data an ECDSA signature (without ASN.1 formatting) for curve secp256k1, unknown random key pair and message? Yes, with excellent ...
fgrieu's user avatar
  • 140k
6 votes

How can we reverse Elliptic Curves after solving the DLP problem?

We can make a valid analogy between solving $5^x \bmod 17 = 13$ and breaking Elliptic Curve cryptography on secp256k1: $x$ is a Private Key $13$ is the matching Public Key $17$ is the curve's ...
fgrieu's user avatar
  • 140k
6 votes
Accepted

In Bitcoin, given half the 52-character private key in WIF format, is it possible to reconstruct the whole private key?

We must first wonder if the preconditions hold, in particular 1; that is: In Bitcoin, given half the 52-character private key in WIF format, is it possible to reconstruct the whole private key? The ...
5 votes

Modulo p in Elliptic Curve Cryptography

To carry out Elliptic Curve Cryptography between parties, are all elliptic curve equations considered to be in the form $\bmod p$? Yes for secp256k1 when it comes to point coordinates, but not for ...
fgrieu's user avatar
  • 140k
5 votes

Problem with point addition about [n-1]+[2]G and [n-1]+G on on Secp256k1

There is confusion about the Elliptic curve terminology in this question. Let deal some of them; Elliptic Curve Algebraically an elliptic curve is $$E(\mathbb{K}) := \{ (x, y) \in \mathbb{K}^2 \mid y^...
kelalaka's user avatar
  • 48.3k
5 votes
Accepted

secp256k1: is it theoretically possible to generate same signature with different key, message hash and k?

We want $(r,s)$ same for two different set of $d,k,h$ In ECDSA $r = x_0([k]G) \bmod n$ where $k \in [1,n-1]$ and $x_o$ is the x-coordinate of the scalar multiplication $[k]G$ $s = k^{-1}\cdot (h+r\...
kelalaka's user avatar
  • 48.3k
4 votes

secp256k1: is it theoretically possible to generate same signature with different key, message hash and k?

For a given private key $d$, random $k$ and message hash $h$: is it possible that there exists a different set of $d$, $k$ and $h$ which produces the same ECDSA signature using the $\text{secp256k1}$ ...
fgrieu's user avatar
  • 140k
4 votes
Accepted

ECC Point Addition on Jacob coordinate -- Not Commutative?

ECC point addition is commutative. The problem encountered is that in the Jacobian coordinate system, a point other than the neutral has several equally valid triplets of coordinates $(x,y,z)$, all ...
fgrieu's user avatar
  • 140k
4 votes

Is it possible to calculate the modular inverse of a secp256k1 public key?

Is there a way (other than brute force) to find an integer that results in 1 when the public key is multiplied by that integer? Actually, given a public key $H$, it is easy to find the smallest ...
poncho's user avatar
  • 146k
4 votes
Accepted

Convert secp256k1 private key to sr25519 private key

Is it possible to convert secp256k1 private key to valid sr25519 key? Yes. It's possible to convert any secret piece of data to private or secret key of any cryptosystem, by using that piece of data ...
fgrieu's user avatar
  • 140k
4 votes

Determine if an elliptic point is negative

There is no usual and well-defined meaning to "negative" for a point $P$ of an elliptic curve on a finite field, as used in cryptography. If $P=k\,G$ for negative $k$, then $P=k'\,G$ for $k'=...
fgrieu's user avatar
  • 140k
4 votes
Accepted

Given multiple incomplete ECDSA signatures, what can a quantum attacker learn in the following scenarios?

They obtain the first 32 bytes of each signature. All your scenarios make this assumption, and so lets dig into it. For ECDSA with RFC-6979, it gets the message and the private key, and generates the ...
poncho's user avatar
  • 146k
4 votes

Method to break a baby Elliptic Curve analog to secp256k1

Solving discrete logarithms in $144$-bit groups is hard Even scaling down to 144-bits is likely beyond current capability. To my knowledge the largest elliptic curve problem tackled with "black ...
Daniel S's user avatar
  • 22.8k
4 votes
Accepted

What is the relationship between NIST and secp256k1?

The NIST FIPS 186-4 digital signature standard (and earlier versions 186-2 and 18-3) recommended several elliptic curves suitable for Federal government use, specifically Appendix D lists curves that ...
Daniel S's user avatar
  • 22.8k
4 votes
Accepted

Does ECDH on secp256k produce a defined shared secret for two key pairs, or is it implementation defined?

ECDH produces a well-defined result given a specific private key and a specific public key. ECDH is very often used to generate the same shared secret from two programs that talk the same protocol, ...
Gilles 'SO- stop being evil''s user avatar
4 votes

is it possible to calculate the difference between 2 public keys of secp256k1

What you need depends on what you mean by 'point difference'. What your code appears to be attempting to do is compute the point $X$ such that $X + K2 = K1$. That is easy to do ($X = K1 + (-K2)$, or $...
poncho's user avatar
  • 146k
4 votes

Understanding Point Negation in secp256k1 Elliptic Curve

I would like to know how to determine if a point $P = (x, y)$ is negated or not ? It appears you are asking: I was just given the value $(x, y)$, and I want to know if the person who gave it to make ...
poncho's user avatar
  • 146k
4 votes

Loop back or cyclic nature of secp256k1 curve

Let $n$ be the order of the base point $G$ then we know $$[k]G = [k \bmod n]G \tag{1}\label{1}$$ This is due to the arithmetic fact that is $a\cdot n = 0 \bmod n$ This prevents us from unnecessary ...
kelalaka's user avatar
  • 48.3k
3 votes

Is it possible to calculate the modular inverse of a secp256k1 public key?

This is a bit extended answer; I was wondering if there were any other ways of calculating the modular multiplicative inverse of a point on an elliptic curve (like secp256k1)? Or perhaps a reason ...
kelalaka's user avatar
  • 48.3k
3 votes
Accepted

Modulo p in Elliptic Curve Cryptography

The prime in the definition of the curve Secp256k1 The prime $p$ is part of the curve design, analysis, and definition that defines the $\mathbb{F_P}$. If someone uses a different $p$ then they have ...
kelalaka's user avatar
  • 48.3k
3 votes
Accepted

Possible to directly calculate the Recovery ID from a msg, signature and public key in ECDSA/secp256k1?

Unfortunately I don't think that is possible without just testing which one works. That is because $[s]R$ and $[-s](-R)$ are the same curve point, and both $R$ and $-R$ have the same x-coordinate $r$, ...
meshcollider's user avatar
  • 1,573
3 votes

secp256k1: is it theoretically possible to generate same signature with different key, message hash and k?

It is totally possible and fairly easy to see without any advanced maths. The curve has order n (n Points in the curve) the private key d is [0... n-1] and the random number k [1... n-1] and there are ...
jjj's user avatar
  • 469
3 votes

How to choose secp256k1 private key?

You are confusing the concepts; the private key vs the public key. Your private key $k$ is an integer which is selected uniform randomly between $1$ to order of the base point $G$, $k \in[1,n-1]$. ...
kelalaka's user avatar
  • 48.3k
3 votes
Accepted

Is it acceptable to use a HMAC-SHA256 hash as a secp256k1 private key?

If your secret material (you call this my secret so I'll use that name) is chosen with sufficient min-entropy, then yes this scheme is acceptable. ...
Serpent27's user avatar
  • 1,451
3 votes

Is the elliptic-curve cryptography library libsecp256k1 not susceptible to the Hertzbleed attack?

To the best of my understanding, yes, the Bitcoin Core secp256k1 library is vulnerable to Hertzbleed, at least in principle, using attack techniques published in May 2023. The attack is challenging ...
Gilles 'SO- stop being evil''s user avatar
3 votes

How can we reverse Elliptic Curves after solving the DLP problem?

secp256k1 Elliptic Curve $E:y^2=x^3+7$ over $\mathbb F_p$ with $p = 2^{256} - 2^{32} - 2^9 - 2^8 - 2^7 - 2^6 - 2^4 - 1$ Generator $G = E(...
user93353's user avatar
  • 2,199

Only top scored, non community-wiki answers of a minimum length are eligible