Questions tagged [secp256k1]
This tag should be used for anything related to the secp256k1 algorithm used for Bitcoin's public key cryptography.
127
questions
2
votes
1
answer
44
views
Inconsistent behavior testing Taproot Workshop - Section: 0.2 Elliptic Curve Math
Workshop link: https://github.com/bitcoinops/taproot-workshop/
In the section 0.2.4 Programming Exercise: Distributivity of scalar operations we implement the following code:
a_key = ECKey().set(a)
...
- 172
1
vote
1
answer
47
views
What result of this sagemath script?
My sagemath cannot compute the result of the following code for such a large number N. Can someone provide the result for the first 10 points ?
n=...
- 31
1
vote
1
answer
41
views
What is a first, and second element of secp256k1?
What coordinates have a first, and second element of secp256k1 ?
Br
- 31
3
votes
1
answer
85
views
Code for computing SigHash for various input types
I am looking for code examples (in rust-bitcoin, but even in Python) of how to calculate sighash for various input types. Specifically, I need to calculate the sighashes for M of N multisig unlocking ...
- 141
0
votes
1
answer
40
views
Is there a way to handle scalar multiplication with the Secp256k1 generator to finalize a Bitcoin script in an atomic swap?
I know that Bitcoin can do Schnorr which allows for one way to finalize an atomic swap but on the other side of the current swap implementation( that I am working with), the script needs to multiply a ...
- 172
-2
votes
1
answer
50
views
What is the step-by-step algorithmic process to find the modular multiplicative inverse of (n-1) mod np, where (n-1) and np are not coprime?
Having perused the stackexchange, I found some similar questions, but am having difficulty understanding how to arrive at the solution to (n-1)*x=1 mod np, where:
n: Finite group order of the Bitcoin ...
0
votes
0
answers
43
views
secp256k1, reused nonce across two differents pubkeys
Edited: changing the notation according request by fgrieu.
I have prepared 4 transactions for 2 pubkeys with the same r1 and r2.
properties of secp256k1:
p = ...
- 23
1
vote
2
answers
91
views
What does it mean for an integer to be a member of secp256k1 group?
I'm reading the spending section of BIP47:
Alice calculates a scalar shared secret using the x value of S:
s = SHA256(Sx).
If the value of s is not in the secp256k1 group, Alice MUST increment the ...
- 13
7
votes
0
answers
82
views
How does this field multiplication in libsecp256k1 work?
I'm looking at libsecp256k1's codebase, for learning reasons (doubt I can contribute with anything useful there). While looking at the field implementation, the implementation of ...
- 766
0
votes
0
answers
29
views
Generate public key with point multiplication using bouncy castle
I'm trying to generate a public key in the secp256k1 curve using "low level" point multiplication. I've seen elsewhere how to generate a public/private key pair, but I'm trying to multiply a ...
- 1
1
vote
1
answer
95
views
How to choose a nothing-up-my-sleeve (NUMS) point on secp256k1 for use in Taproot?
Per BIP-341, if you want to create a Taproot output that is only spendable via the script-path spend (and not a key-path spend), you must "pick as internal key a point with unknown discrete ...
- 321
1
vote
0
answers
57
views
Is Curve25519 better option than Secp256k1?
Are signatures over Curve25519 better than over Secp256k1 or are there major drawbacks?
How do, for instance, EdDSA/Schnorr using Curve25519 compare with ECDSA/Schnorr for Secp256k1?
- 328
1
vote
1
answer
60
views
Need a detailed step-by-step P2PK signature validation example
In the process of validating transactions by hand with a new library in elixir. I am starting with f4184fc596403b9d638783cf57adfe4c75c605f6356fbc91338530e9831e9e16, which is one of the first P2PK ...
- 127
-2
votes
1
answer
27
views
I have upgraded libsecp256k1 to latest master but I'm having issues to link it properly now. How can I resolve this?
I have upgraded libsecp256k1 to the latest master but I'm having issues to link it properly now. What is the problem and how might I resolve it?
The error message is:
collect2: error: ld returned 1 ...
- 12.7k
1
vote
1
answer
98
views
How to add multihreading to a continuous SECP256K1 Python function?
I have an infinite loop Python function for measuring how fast are SECP256K1 public Keys are generated.
The script:
from time import time
a = 0
b = 7
n = ...
- 35
1
vote
1
answer
49
views
Secp256k1: Does there exist an identity public key for combinations of public keys?
I am aware that the identity on elliptic curves is the infinity element.
Long shot (as it would be very useful to me): with that being said, does there exist a public key, pk, on secp256k1 such that, ...
- 35
2
votes
1
answer
120
views
How many elements does Bitcoin's secp256k1 have?
I'm wondering whether it is known how many elements does Bitcoin's elliptic curve have? Have not been able to find an answer to this, only for specific subgroups.
- 255
1
vote
0
answers
92
views
secp256k1 library building for C++
The title says it all. How can I compile secp256k1 for use in a personal project. I have #include secp256k1.h but keep getting unresolved external linkers. I believe this is due to the lack of a ...
- 11
0
votes
0
answers
130
views
Is there a way to use Python GPU for ECC speed up?
Got interested recently in Cuda technology for existing Python SECP256K1 code speed up. Installed Nvidia 10.2 toolkit and it seems to be running OK to an extent.
I've scrapped a small script for ...
- 35
4
votes
1
answer
107
views
How does the BIP340 lift_x algorithm work?
Couple questions of code that I'm reviewing trying to learn schnorr sigs.
Why do we want an odd private key? I see even tests on the private key and then subtract it from the SECP256K1 Order to get an ...
- 331
2
votes
1
answer
301
views
Why bitcoin's generator point does not satisfy Elliptic Curve Cryptography equation?
This is my Python program:
Acurve = 0
Bcurve = 7
Gx = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798
Gy = 0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8
print(...
1
vote
1
answer
218
views
Is it true that Public keys with even y coordinate correspond to private key that are less than n/2 and vice versa? (Secp256k1)
The question is somewhat complex and directed to clearing thing out.
Suppose that n is the order of the cyclic group. It n - 1 is the number of all private keys possible
n = ...
- 35
1
vote
0
answers
27
views
Incorrectly counts the we have added a generator point to itself in a loop (SECP256K1, Python),
I have a script that converts a bitcoin private key into x and y coordinate with parameters of a Secp256k1 curve. Here's the script:
a = 0
b = 7
#Order of the finite field
prime = 2**256 - 2**32 - 977
...
- 35
1
vote
1
answer
218
views
How to convert a compressed public key into uncompressed one in Python?
I've searched really hard for a Python script that coverts a compressed public key into uncompressed one, since I don't know how to code this.
I stumbled upon these links:
https://stackoverflow.com/...
- 47
2
votes
1
answer
164
views
Why g is 2 and 3 to derive the lambda and beta values for endomorphism on the secp256k1 curve?
As you can seen here, in hex, N and P are:
N = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141
P = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F
The ...
- 21
1
vote
1
answer
138
views
Questions about generating a random number for ECDSA
One of the component of making of SECP256K1 signatures, is a random number that is later multiplied by the generator point in order to be used in further computations.
If we imagine that k - is the ...
- 47
0
votes
1
answer
51
views
Does the libsecp256k1 API expose low level functionality such as group algebra? If not why not?
Does the libsecp256k1 API expose low level functionality such as group algebra (e.g. generator point, point at infinity)? If not, why not?
This was asked by ProofOfKeags in this libsecp256k1 issue. ...
- 12.7k
2
votes
1
answer
95
views
Fail at coding my private to public key converter (Pyhon)
Fail at coding my private to public key converter script for Bitcoin (Secp256k1)
Currently going through the book "Programming Bitcoin by Jimmy Song", got stuck on page 61 (Chapter 3), but ...
- 47
2
votes
1
answer
100
views
Is there a subgroup of order 2^n (for large n) of the prime field that secp256k1 is defined over?
the curve secp256k1 is defined over the prime finite field F_p with p = 2^256 - 2^32 - 2^9 - 2^8 - 2^7 - 2^6 - 2^4 - 1.
Is there any known cyclic subgroup of order 2^n of F_p?
- 35
1
vote
1
answer
159
views
Is there code in libsecp256k1 that theoretically should be moved to the main Core codebase?
In this question on libsecp256k1 Pieter Wuille stated:
libsecp256k1 provides implementations for all kinds of operations that involve private keys, public keys, or both. That includes key generation (...
- 12.7k
1
vote
1
answer
100
views
why int128 in secp256k1?
Why do they write an int128 type in secp256k1, when there's already arbitrary length rational numbers?
Is that fancy? Boredom? Isn't secp256k1 just for key pairs, and key pair arithmetic is seldom ...
- 637
2
votes
0
answers
54
views
Why are coefficients a=0 and b=7 used to define the Weierstrass equation in SECp256k1?
Most of the private to public key implementations I've come across do not make use of the equation y^2=x^3+7 (the weierstrass equation defining SECp256k1).
One that i often use is in the link below ...
1
vote
1
answer
82
views
How is a Bitcoin transaction signed using ECDSA?
I am quite familiar with the way secp256k1 ECDSA works as well as the equations that are utilised. However, I have no idea how this ECDSA applies to signing Bitcoin (SegWit Format) and transferring it ...
- 157
2
votes
1
answer
123
views
How does ECDSA work when generating the public key?
I know the curve has formula y^{2}=x^{3}+ax+b. However, some websites are saying that a=0 and b=7 for secp256k1?
What is secp256k1? Is it the curve that is always used or does it generate the field in ...
- 157
1
vote
1
answer
171
views
Why is the Generator Point G for secp256k1 curve typically indicated in (y,-x) quadrant?
Generator Point G for the secp256k1 curve is typically indicated below where the curve intersects the y-axis. At x=0, y=sqrt(7) and -sqrt(7), which are both small numbers less than 3, but G is an ...
- 33
1
vote
1
answer
124
views
Is it feasible to calculate EC private key k from public key K for very low values of k?
If an EC private key k is very small, say "1", is it feasible to calculate the private key k from its public key K, since there would only be one step back to generator point G and therefore ...
- 33
1
vote
1
answer
193
views
Is there a way to determine whether a specific point on the secp256k1 curve is a valid Bitcoin public key?
Let's first define a valid Bitcoin private key as a number in the range of [1, 115792089237316195423570985008687907852837564279074904382605163141518161494336], and a valid Bitcoin public key as a ...
- 107
2
votes
1
answer
86
views
Can secp256k1 have different parameters and still be called secp256k1?
The secp256k1 standard (as defined in https://www.secg.org/sec2-v2.pdf, section 2.4.1) has a set of recommended parameters.
Is there a particular reason why these parameters are just 'recommended', ...
- 107
4
votes
1
answer
266
views
Who is the creator of the secp256k1 standard?
There are different accounts as to who created the secp256k1 standard, for example:
Mastering Bitcoin, p.61:
Bitcoin uses a specific elliptic curve and set of mathematical constants, as defined in a ...
- 107
1
vote
1
answer
124
views
Elliptic Curve and SECP256K1
Just for curiosity, considering that there is a server communicating with other machine (local machine let's call it). If we have the two public keys from Local and Server and we know that Private and ...
9
votes
2
answers
1k
views
How is the generator point G chosen in the secp256k1 curve used in Bitcoin?
The generator point G in the secp256k1 curve used in Bitcoin is a known constant:
Gx = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798
Gy = ...
- 1,011
1
vote
1
answer
50
views
What will be the security risks if we persist "e" as part of schnorr signature=(r,s,e) and extract publicKey from signature at verification
We know unlike ecrecover, it is impossible to get to public key given schnorr signature = (r,s) since rG = sG-eP .
So, would like to understand what are the security risks,
if we say
signature=F(r,s,e)...
0
votes
3
answers
261
views
Why do private keys have a range limit?
I am reading about ECDSA, and I find that the private key must be in (0,n), with n = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141.
Is n the total number of points on the ...
1
vote
1
answer
83
views
How is the secp256k1 API defined? In what ways is it restricted?
I'm familiar with proprietary APIs where a third party decides what data and functionality is available to developers communicating with their server.
However, secp256k1 is an open source ...
- 12.7k
1
vote
2
answers
50
views
Error while installing libwally
I am trying to install libwally on my debian machine. I followed the installation guide but running ./configure I got the warning
=== configuring in src/secp256k1 (/home/standup/libwally-core/src/...
- 323
16
votes
3
answers
5k
views
Why is it not possible to get the private key out of the public key?
From how I understand it, the equation for the public key is defined as so:
K = k * G
With K being the public key, k the private key and G the generator point.
Is G a constant? (as far as I read, ...
- 275
0
votes
1
answer
32
views
What are the risks of using a non-randomized context with signing contexts?
I am designing an API which will utilize libsecp256k1.
I am trying to hide most of the low-level stuff, and context is one of the things I want to handle for a consumer of my API. It would be ...
- 208
0
votes
1
answer
324
views
public key to private key using HASH TABLE (Pollard's kangaroo for SECPK1)
I have done a little bit of research on HASH TABLE (Pollard's kangaroo for SECPK1) I was wondering if there is any way to extract the private key range using the public key or the public address..??
- 1
-2
votes
1
answer
327
views
How to get bitcoin transaction nonce from transaction signature?
Subj.
Looking for a code for calculate/get bitcoin transaction nonce. Help me please.
???
Thank you.
0
votes
1
answer
164
views
Difference between Bitcoin private key space and secp256k1 modulo
I've read online that the group order for the Bitcoin secp256k1 curve is:
0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
Its decimal is:
...
- 103