# Questions tagged [secp256k1]

This tag should be used for anything related to the secp256k1 algorithm used for Bitcoin's public key cryptography.

141 questions
Filter by
Sorted by
Tagged with
1 vote
73 views

### Is it possible to calculate the correct y coordinate from x coordinate given only x coordinate without any prefix

If I have a x coordinate without any prefix such as 03 or 02 fff97bd5755eeea420453a14355235d382f6472f8568a18b2f057a1460297556 will it be possible to compute the correct y coordinate that would be ...
105 views

### What is the relationship between parity and the sign of the points on the elliptic curve?

EDIT: I found out that the answer on the second question is just to do 10 * -G, that is, 10 * G(X, -Y) instead of -10 * G. However, I still do not understand relation between parity and the sign of ...
93 views

### How can I determine if a point on the secp256k1 curve was derived using point addition or point doubling?

I am working with the secp256k1 elliptic curve and I have a point Q on the curve. I am trying to determine whether this point Q was derived using the point addition formula or the point doubling ...
47 views

### In the PrivateKey sign() method why are s and N-s equivalent solutions?

In the PrivateKey sign() method (Chapter 3 page 70) s is calculated like this # s = (z + re)/k s = (z + r * self.secret) * k_inv % N if s > N / 2: s = N - s Why does s and N - s work? Closest ...
1 vote
52 views

### Why assertion error in Point addition?

I am doing my research on SECP256k1 but now i am facing assertion error sometimes. I can't seem to find where it comes from, so i once thought its because the resulting point is point at affinity. So ...
368 views

### What is the relationship between the three possible X coordinates corresponding to a Y coordinate?

Every possible X coordinate on secp256k1 has two corresponding Y coordinates, one of which is the negation of the other. I've also been told that every possible Y coordinate has three corresponding X ...
96 views

### What is the largest value that the x & y coordinates respectively can be/reach

We are all familiar with the x & y coordinates of the curve parameters used in bitcoin (or at least we should be). In terms of being a collective point on graph, we know that the starting point G ...
117 views

### How to convert the results of point doubling (Rx1 and Ry1) to point addition (Rx2 and Ry2) without knowledge of (Qx, Qy) in secp256k1 elliptic curve [closed]

I'm working with the secp256k1 elliptic curve and have point doubling and point addition formulas for this curve. Given the following formulas: Point Addition Formula in Python3: s = (Qy - Gy) * pow(...
60 views

### Explain the use of inverse

I understand that from private key 1 to 57896044618658097711785492504343953926418782139537452191302581570759080747168 every public key is literal inverse of private key ...
136 views

### Would two related nonces cause the private key to leak?

Let there be two signatures made with the same private key(d) using two nonces {k1, k2}. Would knowing that k1*u+f=k2 be sufficient to reveal the private key(d)?
33 views

### Why is my manually calculated public key different than libsecp?

I'm teaching myself ECC using the secp256k1 curve. Ultimately I'm interested in learning about Schnorr signature aggregation and MuSig protocols, but I'm starting from the ground up. I've attempted to ...
45 views

### If I solved y²= (x³ * ax * b) mod p [as it is] what would I gain or be able to do with it's algorithm?

So the calculations for secp256k1 affirm to the formula y² = (x³ * ax * b) mod p of which is said to be impossible to calculate (as is) because of arbitrary large numbers involved. Hypothetically if ...
1 vote
63 views

### What is the concept behind extracting point x from point y given that both are correspondants of G ^ k mod p

Within the encryption protocol that governs bitcoin (Secp256k1 to be precise), the generated points publicKey_x and publicKey_y are a results of calculated coordinates within the finite field " G^...
519 views

### What does it mean that the security of Bitcoin public keys and 256-bit ECDSA is 128 bits?

I am reading the Master Bitcoin book and came across the following: From a security perspective, the amount of entropy actually used for the production of HD wallets is roughly 128 bits, which equals ...
1 vote
235 views

### Webpack issue with tiny-secp256k1 and ECPair

I am developing a browser extension using Webpack v5 and incorporating the bitcoinjs-lib and ecpair libraries to create a Bitcoin wallet. However, I am encountering an error when attempting to load ...
208 views

I'm a newbie who has just started reading Bitcoin Core code. I have a lot of questions about seemingly trivial code. Right now, I have two questions. When branching to an if statement, why is the ...
339 views

### Can't verify Taproot signatures that use SIGHASH_ANYONECANPAY

I wrote a program that verifies signatures for Taproot transactions using the secp256k1 library. My program works perfectly for SIGHASH_ALL, SIGHASH_NONE and SIGHASH_SINGLE. But in February, we saw ...
68 views

### Inconsistent behavior testing Taproot Workshop - Section: 0.2 Elliptic Curve Math

Workshop link: https://github.com/bitcoinops/taproot-workshop/ In the section 0.2.4 Programming Exercise: Distributivity of scalar operations we implement the following code: a_key = ECKey().set(a) ...
1 vote
83 views

### What result of this sagemath script?

My sagemath cannot compute the result of the following code for such a large number N. Can someone provide the result for the first 10 points ? n=...
1 vote
96 views

### Is there a way to handle scalar multiplication with the Secp256k1 generator to finalize a Bitcoin script in an atomic swap?

I know that Bitcoin can do Schnorr which allows for one way to finalize an atomic swap but on the other side of the current swap implementation( that I am working with), the script needs to multiply a ...
79 views

### What is the step-by-step algorithmic process to find the modular multiplicative inverse of (n-1) mod np, where (n-1) and np are not coprime?

Having perused the stackexchange, I found some similar questions, but am having difficulty understanding how to arrive at the solution to (n-1)*x=1 mod np, where: n: Finite group order of the Bitcoin ...
94 views

### secp256k1, reused nonce across two differents pubkeys

Edited: changing the notation according request by fgrieu. I have prepared 4 transactions for 2 pubkeys with the same r1 and r2. properties of secp256k1: p = ...
1 vote
143 views

### What does it mean for an integer to be a member of secp256k1 group?

I'm reading the spending section of BIP47: Alice calculates a scalar shared secret using the x value of S: s = SHA256(Sx). If the value of s is not in the secp256k1 group, Alice MUST increment the ...
185 views

### How does this field multiplication in libsecp256k1 work?

I'm looking at libsecp256k1's codebase, for learning reasons (doubt I can contribute with anything useful there). While looking at the field implementation, the implementation of ...
57 views

### Generate public key with point multiplication using bouncy castle

I'm trying to generate a public key in the secp256k1 curve using "low level" point multiplication. I've seen elsewhere how to generate a public/private key pair, but I'm trying to multiply a ...
1 vote
133 views

### How to choose a nothing-up-my-sleeve (NUMS) point on secp256k1 for use in Taproot?

Per BIP-341, if you want to create a Taproot output that is only spendable via the script-path spend (and not a key-path spend), you must "pick as internal key a point with unknown discrete ...
1 vote
117 views

### Is Curve25519 better option than Secp256k1?

Are signatures over Curve25519 better than over Secp256k1 or are there major drawbacks? How do, for instance, EdDSA/Schnorr using Curve25519 compare with ECDSA/Schnorr for Secp256k1?
1 vote
141 views

### Need a detailed step-by-step P2PK signature validation example

In the process of validating transactions by hand with a new library in elixir. I am starting with f4184fc596403b9d638783cf57adfe4c75c605f6356fbc91338530e9831e9e16, which is one of the first P2PK ...
41 views

### I have upgraded libsecp256k1 to latest master but I'm having issues to link it properly now. How can I resolve this?

I have upgraded libsecp256k1 to the latest master but I'm having issues to link it properly now. What is the problem and how might I resolve it? The error message is: collect2: error: ld returned 1 ...
1 vote
125 views

I have an infinite loop Python function for measuring how fast are SECP256K1 public Keys are generated. The script: from time import time a = 0 b = 7 n = ...
1 vote
67 views

### Secp256k1: Does there exist an identity public key for combinations of public keys?

I am aware that the identity on elliptic curves is the infinity element. Long shot (as it would be very useful to me): with that being said, does there exist a public key, pk, on secp256k1 such that, ...
129 views

### How many elements does Bitcoin's secp256k1 have?

I'm wondering whether it is known how many elements does Bitcoin's elliptic curve have? Have not been able to find an answer to this, only for specific subgroups.
1 vote
219 views

### secp256k1 library building for C++

The title says it all. How can I compile secp256k1 for use in a personal project. I have #include secp256k1.h but keep getting unresolved external linkers. I believe this is due to the lack of a ...
162 views

### How does the BIP340 lift_x algorithm work?

Couple questions of code that I'm reviewing trying to learn schnorr sigs. Why do we want an odd private key? I see even tests on the private key and then subtract it from the SECP256K1 Order to get an ...
349 views

### Why bitcoin's generator point does not satisfy Elliptic Curve Cryptography equation?

This is my Python program: Acurve = 0 Bcurve = 7 Gx = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798 Gy = 0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8 print(...
1 vote
470 views

### Is it true that Public keys with even y coordinate correspond to private key that are less than n/2 and vice versa? (Secp256k1)

The question is somewhat complex and directed to clearing thing out. Suppose that n is the order of the cyclic group. It n - 1 is the number of all private keys possible n = ...
1 vote
43 views

### Incorrectly counts the we have added a generator point to itself in a loop (SECP256K1, Python),

I have a script that converts a bitcoin private key into x and y coordinate with parameters of a Secp256k1 curve. Here's the script: a = 0 b = 7 #Order of the finite field prime = 2**256 - 2**32 - 977 ...
1 vote
637 views

### How to convert a compressed public key into uncompressed one in Python?

I've searched really hard for a Python script that coverts a compressed public key into uncompressed one, since I don't know how to code this. I stumbled upon these links: https://stackoverflow.com/...
222 views

### Why g is 2 and 3 to derive the lambda and beta values for endomorphism on the secp256k1 curve?

As you can seen here, in hex, N and P are: N = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141 P = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F The ...
1 vote
340 views

### Questions about generating a random number for ECDSA

One of the component of making of SECP256K1 signatures, is a random number that is later multiplied by the generator point in order to be used in further computations. If we imagine that k - is the ...
65 views

### Does the libsecp256k1 API expose low level functionality such as group algebra? If not why not?

Does the libsecp256k1 API expose low level functionality such as group algebra (e.g. generator point, point at infinity)? If not, why not? This was asked by ProofOfKeags in this libsecp256k1 issue. ...
124 views

### Fail at coding my private to public key converter (Pyhon)

Fail at coding my private to public key converter script for Bitcoin (Secp256k1) Currently going through the book "Programming Bitcoin by Jimmy Song", got stuck on page 61 (Chapter 3), but ...
137 views

### Is there a subgroup of order 2^n (for large n) of the prime field that secp256k1 is defined over?

the curve secp256k1 is defined over the prime finite field F_p with p = 2^256 - 2^32 - 2^9 - 2^8 - 2^7 - 2^6 - 2^4 - 1. Is there any known cyclic subgroup of order 2^n of F_p?
1 vote
178 views

### Is there code in libsecp256k1 that theoretically should be moved to the main Core codebase?

In this question on libsecp256k1 Pieter Wuille stated: libsecp256k1 provides implementations for all kinds of operations that involve private keys, public keys, or both. That includes key generation (...
1 vote
147 views

### why int128 in secp256k1?

Why do they write an int128 type in secp256k1, when there's already arbitrary length rational numbers? Is that fancy? Boredom? Isn't secp256k1 just for key pairs, and key pair arithmetic is seldom ...
75 views

### Why are coefficients a=0 and b=7 used to define the Weierstrass equation in SECp256k1?

Most of the private to public key implementations I've come across do not make use of the equation y^2=x^3+7 (the weierstrass equation defining SECp256k1). One that i often use is in the link below ...
1 vote
108 views

### How is a Bitcoin transaction signed using ECDSA?

I am quite familiar with the way secp256k1 ECDSA works as well as the equations that are utilised. However, I have no idea how this ECDSA applies to signing Bitcoin (SegWit Format) and transferring it ...
234 views

### How does ECDSA work when generating the public key?

I know the curve has formula y^{2}=x^{3}+ax+b. However, some websites are saying that a=0 and b=7 for secp256k1? What is secp256k1? Is it the curve that is always used or does it generate the field in ...
1 vote