Questions tagged [secp256k1]

This tag should be used for anything related to the secp256k1 algorithm used for Bitcoin's public key cryptography.

Filter by
Sorted by
Tagged with
2 votes
1 answer
44 views

Inconsistent behavior testing Taproot Workshop - Section: 0.2 Elliptic Curve Math

Workshop link: https://github.com/bitcoinops/taproot-workshop/ In the section 0.2.4 Programming Exercise: Distributivity of scalar operations we implement the following code: a_key = ECKey().set(a) ...
  • 172
1 vote
1 answer
47 views

What result of this sagemath script?

My sagemath cannot compute the result of the following code for such a large number N. Can someone provide the result for the first 10 points ? n=...
  • 31
1 vote
1 answer
41 views

What is a first, and second element of secp256k1?

What coordinates have a first, and second element of secp256k1 ? Br
  • 31
3 votes
1 answer
85 views

Code for computing SigHash for various input types

I am looking for code examples (in rust-bitcoin, but even in Python) of how to calculate sighash for various input types. Specifically, I need to calculate the sighashes for M of N multisig unlocking ...
0 votes
1 answer
40 views

Is there a way to handle scalar multiplication with the Secp256k1 generator to finalize a Bitcoin script in an atomic swap?

I know that Bitcoin can do Schnorr which allows for one way to finalize an atomic swap but on the other side of the current swap implementation( that I am working with), the script needs to multiply a ...
  • 172
-2 votes
1 answer
50 views

What is the step-by-step algorithmic process to find the modular multiplicative inverse of (n-1) mod np, where (n-1) and np are not coprime?

Having perused the stackexchange, I found some similar questions, but am having difficulty understanding how to arrive at the solution to (n-1)*x=1 mod np, where: n: Finite group order of the Bitcoin ...
0 votes
0 answers
43 views

secp256k1, reused nonce across two differents pubkeys

Edited: changing the notation according request by fgrieu. I have prepared 4 transactions for 2 pubkeys with the same r1 and r2. properties of secp256k1: p = ...
  • 23
1 vote
2 answers
91 views

What does it mean for an integer to be a member of secp256k1 group?

I'm reading the spending section of BIP47: Alice calculates a scalar shared secret using the x value of S: s = SHA256(Sx). If the value of s is not in the secp256k1 group, Alice MUST increment the ...
  • 13
7 votes
0 answers
82 views

How does this field multiplication in libsecp256k1 work?

I'm looking at libsecp256k1's codebase, for learning reasons (doubt I can contribute with anything useful there). While looking at the field implementation, the implementation of ...
0 votes
0 answers
29 views

Generate public key with point multiplication using bouncy castle

I'm trying to generate a public key in the secp256k1 curve using "low level" point multiplication. I've seen elsewhere how to generate a public/private key pair, but I'm trying to multiply a ...
  • 1
1 vote
1 answer
95 views

How to choose a nothing-up-my-sleeve (NUMS) point on secp256k1 for use in Taproot?

Per BIP-341, if you want to create a Taproot output that is only spendable via the script-path spend (and not a key-path spend), you must "pick as internal key a point with unknown discrete ...
1 vote
0 answers
57 views

Is Curve25519 better option than Secp256k1?

Are signatures over Curve25519 better than over Secp256k1 or are there major drawbacks? How do, for instance, EdDSA/Schnorr using Curve25519 compare with ECDSA/Schnorr for Secp256k1?
1 vote
1 answer
60 views

Need a detailed step-by-step P2PK signature validation example

In the process of validating transactions by hand with a new library in elixir. I am starting with f4184fc596403b9d638783cf57adfe4c75c605f6356fbc91338530e9831e9e16, which is one of the first P2PK ...
  • 127
-2 votes
1 answer
27 views

I have upgraded libsecp256k1 to latest master but I'm having issues to link it properly now. How can I resolve this?

I have upgraded libsecp256k1 to the latest master but I'm having issues to link it properly now. What is the problem and how might I resolve it? The error message is: collect2: error: ld returned 1 ...
1 vote
1 answer
98 views

How to add multihreading to a continuous SECP256K1 Python function?

I have an infinite loop Python function for measuring how fast are SECP256K1 public Keys are generated. The script: from time import time a = 0 b = 7 n = ...
1 vote
1 answer
49 views

Secp256k1: Does there exist an identity public key for combinations of public keys?

I am aware that the identity on elliptic curves is the infinity element. Long shot (as it would be very useful to me): with that being said, does there exist a public key, pk, on secp256k1 such that, ...
  • 35
2 votes
1 answer
120 views

How many elements does Bitcoin's secp256k1 have?

I'm wondering whether it is known how many elements does Bitcoin's elliptic curve have? Have not been able to find an answer to this, only for specific subgroups.
  • 255
1 vote
0 answers
92 views

secp256k1 library building for C++

The title says it all. How can I compile secp256k1 for use in a personal project. I have #include secp256k1.h but keep getting unresolved external linkers. I believe this is due to the lack of a ...
  • 11
0 votes
0 answers
130 views

Is there a way to use Python GPU for ECC speed up?

Got interested recently in Cuda technology for existing Python SECP256K1 code speed up. Installed Nvidia 10.2 toolkit and it seems to be running OK to an extent. I've scrapped a small script for ...
4 votes
1 answer
107 views

How does the BIP340 lift_x algorithm work?

Couple questions of code that I'm reviewing trying to learn schnorr sigs. Why do we want an odd private key? I see even tests on the private key and then subtract it from the SECP256K1 Order to get an ...
  • 331
2 votes
1 answer
301 views

Why bitcoin's generator point does not satisfy Elliptic Curve Cryptography equation?

This is my Python program: Acurve = 0 Bcurve = 7 Gx = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798 Gy = 0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8 print(...
1 vote
1 answer
218 views

Is it true that Public keys with even y coordinate correspond to private key that are less than n/2 and vice versa? (Secp256k1)

The question is somewhat complex and directed to clearing thing out. Suppose that n is the order of the cyclic group. It n - 1 is the number of all private keys possible n = ...
1 vote
0 answers
27 views

Incorrectly counts the we have added a generator point to itself in a loop (SECP256K1, Python),

I have a script that converts a bitcoin private key into x and y coordinate with parameters of a Secp256k1 curve. Here's the script: a = 0 b = 7 #Order of the finite field prime = 2**256 - 2**32 - 977 ...
1 vote
1 answer
218 views

How to convert a compressed public key into uncompressed one in Python?

I've searched really hard for a Python script that coverts a compressed public key into uncompressed one, since I don't know how to code this. I stumbled upon these links: https://stackoverflow.com/...
2 votes
1 answer
164 views

Why g is 2 and 3 to derive the lambda and beta values for endomorphism on the secp256k1 curve?

As you can seen here, in hex, N and P are: N = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141 P = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F The ...
  • 21
1 vote
1 answer
138 views

Questions about generating a random number for ECDSA

One of the component of making of SECP256K1 signatures, is a random number that is later multiplied by the generator point in order to be used in further computations. If we imagine that k - is the ...
0 votes
1 answer
51 views

Does the libsecp256k1 API expose low level functionality such as group algebra? If not why not?

Does the libsecp256k1 API expose low level functionality such as group algebra (e.g. generator point, point at infinity)? If not, why not? This was asked by ProofOfKeags in this libsecp256k1 issue. ...
2 votes
1 answer
95 views

Fail at coding my private to public key converter (Pyhon)

Fail at coding my private to public key converter script for Bitcoin (Secp256k1) Currently going through the book "Programming Bitcoin by Jimmy Song", got stuck on page 61 (Chapter 3), but ...
2 votes
1 answer
100 views

Is there a subgroup of order 2^n (for large n) of the prime field that secp256k1 is defined over?

the curve secp256k1 is defined over the prime finite field F_p with p = 2^256 - 2^32 - 2^9 - 2^8 - 2^7 - 2^6 - 2^4 - 1. Is there any known cyclic subgroup of order 2^n of F_p?
  • 35
1 vote
1 answer
159 views

Is there code in libsecp256k1 that theoretically should be moved to the main Core codebase?

In this question on libsecp256k1 Pieter Wuille stated: libsecp256k1 provides implementations for all kinds of operations that involve private keys, public keys, or both. That includes key generation (...
1 vote
1 answer
100 views

why int128 in secp256k1?

Why do they write an int128 type in secp256k1, when there's already arbitrary length rational numbers? Is that fancy? Boredom? Isn't secp256k1 just for key pairs, and key pair arithmetic is seldom ...
  • 637
2 votes
0 answers
54 views

Why are coefficients a=0 and b=7 used to define the Weierstrass equation in SECp256k1?

Most of the private to public key implementations I've come across do not make use of the equation y^2=x^3+7 (the weierstrass equation defining SECp256k1). One that i often use is in the link below ...
1 vote
1 answer
82 views

How is a Bitcoin transaction signed using ECDSA?

I am quite familiar with the way secp256k1 ECDSA works as well as the equations that are utilised. However, I have no idea how this ECDSA applies to signing Bitcoin (SegWit Format) and transferring it ...
  • 157
2 votes
1 answer
123 views

How does ECDSA work when generating the public key?

I know the curve has formula y^{2}=x^{3}+ax+b. However, some websites are saying that a=0 and b=7 for secp256k1? What is secp256k1? Is it the curve that is always used or does it generate the field in ...
  • 157
1 vote
1 answer
171 views

Why is the Generator Point G for secp256k1 curve typically indicated in (y,-x) quadrant?

Generator Point G for the secp256k1 curve is typically indicated below where the curve intersects the y-axis. At x=0, y=sqrt(7) and -sqrt(7), which are both small numbers less than 3, but G is an ...
  • 33
1 vote
1 answer
124 views

Is it feasible to calculate EC private key k from public key K for very low values of k?

If an EC private key k is very small, say "1", is it feasible to calculate the private key k from its public key K, since there would only be one step back to generator point G and therefore ...
  • 33
1 vote
1 answer
193 views

Is there a way to determine whether a specific point on the secp256k1 curve is a valid Bitcoin public key?

Let's first define a valid Bitcoin private key as a number in the range of [1, 115792089237316195423570985008687907852837564279074904382605163141518161494336], and a valid Bitcoin public key as a ...
  • 107
2 votes
1 answer
86 views

Can secp256k1 have different parameters and still be called secp256k1?

The secp256k1 standard (as defined in https://www.secg.org/sec2-v2.pdf, section 2.4.1) has a set of recommended parameters. Is there a particular reason why these parameters are just 'recommended', ...
  • 107
4 votes
1 answer
266 views

Who is the creator of the secp256k1 standard?

There are different accounts as to who created the secp256k1 standard, for example: Mastering Bitcoin, p.61: Bitcoin uses a specific elliptic curve and set of mathematical constants, as defined in a ...
  • 107
1 vote
1 answer
124 views

Elliptic Curve and SECP256K1

Just for curiosity, considering that there is a server communicating with other machine (local machine let's call it). If we have the two public keys from Local and Server and we know that Private and ...
9 votes
2 answers
1k views

How is the generator point G chosen in the secp256k1 curve used in Bitcoin?

The generator point G in the secp256k1 curve used in Bitcoin is a known constant: Gx = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798 Gy = ...
  • 1,011
1 vote
1 answer
50 views

What will be the security risks if we persist "e" as part of schnorr signature=(r,s,e) and extract publicKey from signature at verification

We know unlike ecrecover, it is impossible to get to public key given schnorr signature = (r,s) since rG = sG-eP . So, would like to understand what are the security risks, if we say signature=F(r,s,e)...
0 votes
3 answers
261 views

Why do private keys have a range limit?

I am reading about ECDSA, and I find that the private key must be in (0,n), with n = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141. Is n the total number of points on the ...
1 vote
1 answer
83 views

How is the secp256k1 API defined? In what ways is it restricted?

I'm familiar with proprietary APIs where a third party decides what data and functionality is available to developers communicating with their server. However, secp256k1 is an open source ...
1 vote
2 answers
50 views

Error while installing libwally

I am trying to install libwally on my debian machine. I followed the installation guide but running ./configure I got the warning === configuring in src/secp256k1 (/home/standup/libwally-core/src/...
  • 323
16 votes
3 answers
5k views

Why is it not possible to get the private key out of the public key?

From how I understand it, the equation for the public key is defined as so: K = k * G With K being the public key, k the private key and G the generator point. Is G a constant? (as far as I read, ...
0 votes
1 answer
32 views

What are the risks of using a non-randomized context with signing contexts?

I am designing an API which will utilize libsecp256k1. I am trying to hide most of the low-level stuff, and context is one of the things I want to handle for a consumer of my API. It would be ...
0 votes
1 answer
324 views

public key to private key using HASH TABLE (Pollard's kangaroo for SECPK1)

I have done a little bit of research on HASH TABLE (Pollard's kangaroo for SECPK1) I was wondering if there is any way to extract the private key range using the public key or the public address..??
-2 votes
1 answer
327 views

How to get bitcoin transaction nonce from transaction signature?

Subj. Looking for a code for calculate/get bitcoin transaction nonce. Help me please. ??? Thank you.
0 votes
1 answer
164 views

Difference between Bitcoin private key space and secp256k1 modulo

I've read online that the group order for the Bitcoin secp256k1 curve is: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141 Its decimal is: ...