Questions tagged [secp256k1]
This tag should be used for anything related to the secp256k1 algorithm used for Bitcoin's public key cryptography.
141
questions
1
vote
1
answer
73
views
Is it possible to calculate the correct y coordinate from x coordinate given only x coordinate without any prefix
If I have a x coordinate without any prefix such as 03 or 02
fff97bd5755eeea420453a14355235d382f6472f8568a18b2f057a1460297556
will it be possible to compute the correct y coordinate that would be ...
- 13
0
votes
1
answer
105
views
What is the relationship between parity and the sign of the points on the elliptic curve?
EDIT: I found out that the answer on the second question is just to do 10 * -G, that is, 10 * G(X, -Y) instead of -10 * G. However, I still do not understand relation between parity and the sign of ...
- 642
-1
votes
1
answer
93
views
How can I determine if a point on the secp256k1 curve was derived using point addition or point doubling?
I am working with the secp256k1 elliptic curve and I have a point Q on the curve. I am trying to determine whether this point Q was derived using the point addition formula or the point doubling ...
- 1
2
votes
1
answer
47
views
In the PrivateKey sign() method why are s and N-s equivalent solutions?
In the PrivateKey sign() method (Chapter 3 page 70) s is calculated like this
# s = (z + re)/k
s = (z + r * self.secret) * k_inv % N
if s > N / 2:
s = N - s
Why does s and N - s work?
Closest ...
- 23
1
vote
0
answers
52
views
Why assertion error in Point addition?
I am doing my research on SECP256k1 but now i am facing assertion error sometimes.
I can't seem to find where it comes from, so i once thought its because the resulting point is point at affinity.
So ...
6
votes
1
answer
368
views
What is the relationship between the three possible X coordinates corresponding to a Y coordinate?
Every possible X coordinate on secp256k1 has two corresponding Y coordinates, one of which is the negation of the other. I've also been told that every possible Y coordinate has three corresponding X ...
- 6,823
2
votes
1
answer
96
views
What is the largest value that the x & y coordinates respectively can be/reach
We are all familiar with the x & y coordinates of the curve parameters used in bitcoin (or at least we should be).
In terms of being a collective point on graph, we know that the starting point G ...
- 97
0
votes
1
answer
117
views
How to convert the results of point doubling (Rx1 and Ry1) to point addition (Rx2 and Ry2) without knowledge of (Qx, Qy) in secp256k1 elliptic curve [closed]
I'm working with the secp256k1 elliptic curve and have point doubling and point addition formulas for this curve. Given the following formulas:
Point Addition Formula in Python3:
s = (Qy - Gy) * pow(...
0
votes
0
answers
60
views
Explain the use of inverse
I understand that from private key 1 to 57896044618658097711785492504343953926418782139537452191302581570759080747168 every public key is literal inverse of private key ...
- 1
0
votes
1
answer
136
views
Would two related nonces cause the private key to leak?
Let there be two signatures made with the same private key(d) using two nonces {k1, k2}. Would knowing that k1*u+f=k2 be sufficient to reveal the private key(d)?
- 1
0
votes
0
answers
33
views
Why is my manually calculated public key different than libsecp?
I'm teaching myself ECC using the secp256k1 curve. Ultimately I'm interested in learning about Schnorr signature aggregation and MuSig protocols, but I'm starting from the ground up.
I've attempted to ...
- 13
0
votes
0
answers
45
views
If I solved y²= (x³ * ax * b) mod p [as it is] what would I gain or be able to do with it's algorithm?
So the calculations for secp256k1 affirm to the formula y² = (x³ * ax * b) mod p of which is said to be impossible to calculate (as is) because of arbitrary large numbers involved.
Hypothetically if ...
- 97
1
vote
1
answer
63
views
What is the concept behind extracting point x from point y given that both are correspondants of G ^ k mod p
Within the encryption protocol that governs bitcoin (Secp256k1 to be precise), the generated points publicKey_x and publicKey_y are a results of calculated coordinates within the finite field " G^...
- 97
4
votes
1
answer
519
views
What does it mean that the security of Bitcoin public keys and 256-bit ECDSA is 128 bits?
I am reading the Master Bitcoin book and came across the following:
From a security perspective, the amount of entropy actually used for
the production of HD wallets is roughly 128 bits, which equals ...
- 1,029
1
vote
1
answer
235
views
Webpack issue with tiny-secp256k1 and ECPair
I am developing a browser extension using Webpack v5 and incorporating the bitcoinjs-lib and ecpair libraries to create a Bitcoin wallet. However, I am encountering an error when attempting to load ...
3
votes
1
answer
208
views
Questions about secp256k1_pubkey_load/save() implementation
I'm a newbie who has just started reading Bitcoin Core code. I have a lot of questions about seemingly trivial code. Right now, I have two questions.
When branching to an if statement, why is the ...
- 35
6
votes
1
answer
339
views
Can't verify Taproot signatures that use SIGHASH_ANYONECANPAY
I wrote a program that verifies signatures for Taproot transactions using the secp256k1 library. My program works perfectly for SIGHASH_ALL, SIGHASH_NONE and SIGHASH_SINGLE. But in February, we saw ...
- 658
3
votes
1
answer
68
views
Inconsistent behavior testing Taproot Workshop - Section: 0.2 Elliptic Curve Math
Workshop link: https://github.com/bitcoinops/taproot-workshop/
In the section 0.2.4 Programming Exercise: Distributivity of scalar operations we implement the following code:
a_key = ECKey().set(a)
...
- 633
1
vote
1
answer
83
views
What result of this sagemath script?
My sagemath cannot compute the result of the following code for such a large number N. Can someone provide the result for the first 10 points ?
n=...
- 11
1
vote
1
answer
96
views
Is there a way to handle scalar multiplication with the Secp256k1 generator to finalize a Bitcoin script in an atomic swap?
I know that Bitcoin can do Schnorr which allows for one way to finalize an atomic swap but on the other side of the current swap implementation( that I am working with), the script needs to multiply a ...
- 633
-2
votes
1
answer
79
views
What is the step-by-step algorithmic process to find the modular multiplicative inverse of (n-1) mod np, where (n-1) and np are not coprime?
Having perused the stackexchange, I found some similar questions, but am having difficulty understanding how to arrive at the solution to (n-1)*x=1 mod np, where:
n: Finite group order of the Bitcoin ...
0
votes
0
answers
94
views
secp256k1, reused nonce across two differents pubkeys
Edited: changing the notation according request by fgrieu.
I have prepared 4 transactions for 2 pubkeys with the same r1 and r2.
properties of secp256k1:
p = ...
- 23
1
vote
2
answers
143
views
What does it mean for an integer to be a member of secp256k1 group?
I'm reading the spending section of BIP47:
Alice calculates a scalar shared secret using the x value of S:
s = SHA256(Sx).
If the value of s is not in the secp256k1 group, Alice MUST increment the ...
- 13
9
votes
1
answer
185
views
How does this field multiplication in libsecp256k1 work?
I'm looking at libsecp256k1's codebase, for learning reasons (doubt I can contribute with anything useful there). While looking at the field implementation, the implementation of ...
- 951
0
votes
0
answers
57
views
Generate public key with point multiplication using bouncy castle
I'm trying to generate a public key in the secp256k1 curve using "low level" point multiplication. I've seen elsewhere how to generate a public/private key pair, but I'm trying to multiply a ...
- 1
1
vote
1
answer
133
views
How to choose a nothing-up-my-sleeve (NUMS) point on secp256k1 for use in Taproot?
Per BIP-341, if you want to create a Taproot output that is only spendable via the script-path spend (and not a key-path spend), you must "pick as internal key a point with unknown discrete ...
- 321
1
vote
0
answers
117
views
Is Curve25519 better option than Secp256k1?
Are signatures over Curve25519 better than over Secp256k1 or are there major drawbacks?
How do, for instance, EdDSA/Schnorr using Curve25519 compare with ECDSA/Schnorr for Secp256k1?
- 449
1
vote
1
answer
141
views
Need a detailed step-by-step P2PK signature validation example
In the process of validating transactions by hand with a new library in elixir. I am starting with f4184fc596403b9d638783cf57adfe4c75c605f6356fbc91338530e9831e9e16, which is one of the first P2PK ...
- 147
-2
votes
1
answer
41
views
I have upgraded libsecp256k1 to latest master but I'm having issues to link it properly now. How can I resolve this?
I have upgraded libsecp256k1 to the latest master but I'm having issues to link it properly now. What is the problem and how might I resolve it?
The error message is:
collect2: error: ld returned 1 ...
- 14.7k
1
vote
1
answer
125
views
How to add multihreading to a continuous SECP256K1 Python function?
I have an infinite loop Python function for measuring how fast are SECP256K1 public Keys are generated.
The script:
from time import time
a = 0
b = 7
n = ...
- 35
1
vote
1
answer
67
views
Secp256k1: Does there exist an identity public key for combinations of public keys?
I am aware that the identity on elliptic curves is the infinity element.
Long shot (as it would be very useful to me): with that being said, does there exist a public key, pk, on secp256k1 such that, ...
- 35
2
votes
1
answer
129
views
How many elements does Bitcoin's secp256k1 have?
I'm wondering whether it is known how many elements does Bitcoin's elliptic curve have? Have not been able to find an answer to this, only for specific subgroups.
- 255
1
vote
0
answers
219
views
secp256k1 library building for C++
The title says it all. How can I compile secp256k1 for use in a personal project. I have #include secp256k1.h but keep getting unresolved external linkers. I believe this is due to the lack of a ...
- 11
4
votes
1
answer
162
views
How does the BIP340 lift_x algorithm work?
Couple questions of code that I'm reviewing trying to learn schnorr sigs.
Why do we want an odd private key? I see even tests on the private key and then subtract it from the SECP256K1 Order to get an ...
- 331
2
votes
1
answer
349
views
Why bitcoin's generator point does not satisfy Elliptic Curve Cryptography equation?
This is my Python program:
Acurve = 0
Bcurve = 7
Gx = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798
Gy = 0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8
print(...
1
vote
1
answer
470
views
Is it true that Public keys with even y coordinate correspond to private key that are less than n/2 and vice versa? (Secp256k1)
The question is somewhat complex and directed to clearing thing out.
Suppose that n is the order of the cyclic group. It n - 1 is the number of all private keys possible
n = ...
- 35
1
vote
0
answers
43
views
Incorrectly counts the we have added a generator point to itself in a loop (SECP256K1, Python),
I have a script that converts a bitcoin private key into x and y coordinate with parameters of a Secp256k1 curve. Here's the script:
a = 0
b = 7
#Order of the finite field
prime = 2**256 - 2**32 - 977
...
- 35
1
vote
1
answer
637
views
How to convert a compressed public key into uncompressed one in Python?
I've searched really hard for a Python script that coverts a compressed public key into uncompressed one, since I don't know how to code this.
I stumbled upon these links:
https://stackoverflow.com/...
- 47
2
votes
1
answer
222
views
Why g is 2 and 3 to derive the lambda and beta values for endomorphism on the secp256k1 curve?
As you can seen here, in hex, N and P are:
N = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141
P = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F
The ...
- 21
1
vote
1
answer
340
views
Questions about generating a random number for ECDSA
One of the component of making of SECP256K1 signatures, is a random number that is later multiplied by the generator point in order to be used in further computations.
If we imagine that k - is the ...
- 47
0
votes
1
answer
65
views
Does the libsecp256k1 API expose low level functionality such as group algebra? If not why not?
Does the libsecp256k1 API expose low level functionality such as group algebra (e.g. generator point, point at infinity)? If not, why not?
This was asked by ProofOfKeags in this libsecp256k1 issue. ...
- 14.7k
2
votes
1
answer
124
views
Fail at coding my private to public key converter (Pyhon)
Fail at coding my private to public key converter script for Bitcoin (Secp256k1)
Currently going through the book "Programming Bitcoin by Jimmy Song", got stuck on page 61 (Chapter 3), but ...
- 47
2
votes
1
answer
137
views
Is there a subgroup of order 2^n (for large n) of the prime field that secp256k1 is defined over?
the curve secp256k1 is defined over the prime finite field F_p with p = 2^256 - 2^32 - 2^9 - 2^8 - 2^7 - 2^6 - 2^4 - 1.
Is there any known cyclic subgroup of order 2^n of F_p?
- 35
1
vote
1
answer
178
views
Is there code in libsecp256k1 that theoretically should be moved to the main Core codebase?
In this question on libsecp256k1 Pieter Wuille stated:
libsecp256k1 provides implementations for all kinds of operations that involve private keys, public keys, or both. That includes key generation (...
- 14.7k
1
vote
1
answer
147
views
why int128 in secp256k1?
Why do they write an int128 type in secp256k1, when there's already arbitrary length rational numbers?
Is that fancy? Boredom? Isn't secp256k1 just for key pairs, and key pair arithmetic is seldom ...
- 795
2
votes
0
answers
75
views
Why are coefficients a=0 and b=7 used to define the Weierstrass equation in SECp256k1?
Most of the private to public key implementations I've come across do not make use of the equation y^2=x^3+7 (the weierstrass equation defining SECp256k1).
One that i often use is in the link below ...
1
vote
1
answer
108
views
How is a Bitcoin transaction signed using ECDSA?
I am quite familiar with the way secp256k1 ECDSA works as well as the equations that are utilised. However, I have no idea how this ECDSA applies to signing Bitcoin (SegWit Format) and transferring it ...
- 157
2
votes
1
answer
234
views
How does ECDSA work when generating the public key?
I know the curve has formula y^{2}=x^{3}+ax+b. However, some websites are saying that a=0 and b=7 for secp256k1?
What is secp256k1? Is it the curve that is always used or does it generate the field in ...
- 157
1
vote
1
answer
316
views
Why is the Generator Point G for secp256k1 curve typically indicated in (y,-x) quadrant?
Generator Point G for the secp256k1 curve is typically indicated below where the curve intersects the y-axis. At x=0, y=sqrt(7) and -sqrt(7), which are both small numbers less than 3, but G is an ...
- 33
1
vote
1
answer
169
views
Is it feasible to calculate EC private key k from public key K for very low values of k?
If an EC private key k is very small, say "1", is it feasible to calculate the private key k from its public key K, since there would only be one step back to generator point G and therefore ...
- 33