Questions tagged [secp256k1]

This tag should be used for anything related to the secp256k1 algorithm used for Bitcoin's public key cryptography.

Filter by
Sorted by
Tagged with
1 vote
1 answer
239 views

Two private keys whose corresponding public keys have the same x-value?

For a given integer m, there are at most two points in the secp256k1 curve whose x-value is m. Have we ever actually found a pair of distinct private keys whose corresponding public keys have the same ...
mathboi's user avatar
  • 183
1 vote
1 answer
98 views

Is it possible to calculate the correct y coordinate from x coordinate given only x coordinate without any prefix

If I have a x coordinate without any prefix such as 03 or 02 fff97bd5755eeea420453a14355235d382f6472f8568a18b2f057a1460297556 will it be possible to compute the correct y coordinate that would be ...
Zetock's user avatar
  • 13
0 votes
1 answer
130 views

What is the relationship between parity and the sign of the points on the elliptic curve?

EDIT: I found out that the answer on the second question is just to do 10 * -G, that is, 10 * G(X, -Y) instead of -10 * G. However, I still do not understand relation between parity and the sign of ...
LeaBit's user avatar
  • 920
-1 votes
1 answer
105 views

How can I determine if a point on the secp256k1 curve was derived using point addition or point doubling?

I am working with the secp256k1 elliptic curve and I have a point Q on the curve. I am trying to determine whether this point Q was derived using the point addition formula or the point doubling ...
Favour's user avatar
  • 1
2 votes
1 answer
54 views

In the PrivateKey sign() method why are s and N-s equivalent solutions?

In the PrivateKey sign() method (Chapter 3 page 70) s is calculated like this # s = (z + re)/k s = (z + r * self.secret) * k_inv % N if s > N / 2: s = N - s Why does s and N - s work? Closest ...
Jon's user avatar
  • 23
1 vote
0 answers
53 views

Why assertion error in Point addition?

I am doing my research on SECP256k1 but now i am facing assertion error sometimes. I can't seem to find where it comes from, so i once thought its because the resulting point is point at affinity. So ...
Alexio puk2sefu's user avatar
6 votes
1 answer
434 views

What is the relationship between the three possible X coordinates corresponding to a Y coordinate?

Every possible X coordinate on secp256k1 has two corresponding Y coordinates, one of which is the negation of the other. I've also been told that every possible Y coordinate has three corresponding X ...
Vojtěch Strnad's user avatar
2 votes
1 answer
103 views

What is the largest value that the x & y coordinates respectively can be/reach

We are all familiar with the x & y coordinates of the curve parameters used in bitcoin (or at least we should be). In terms of being a collective point on graph, we know that the starting point G ...
AncientTides's user avatar
0 votes
1 answer
135 views

How to convert the results of point doubling (Rx1 and Ry1) to point addition (Rx2 and Ry2) without knowledge of (Qx, Qy) in secp256k1 elliptic curve [closed]

I'm working with the secp256k1 elliptic curve and have point doubling and point addition formulas for this curve. Given the following formulas: Point Addition Formula in Python3: s = (Qy - Gy) * pow(...
Aviril Smith's user avatar
0 votes
0 answers
73 views

Explain the use of inverse

I understand that from private key 1 to 57896044618658097711785492504343953926418782139537452191302581570759080747168 every public key is literal inverse of private key ...
Melwyn's user avatar
  • 1
0 votes
1 answer
145 views

Would two related nonces cause the private key to leak?

Let there be two signatures made with the same private key(d) using two nonces {k1, k2}. Would knowing that k1*u+f=k2 be sufficient to reveal the private key(d)?
Joakim20's user avatar
0 votes
0 answers
35 views

Why is my manually calculated public key different than libsecp?

I'm teaching myself ECC using the secp256k1 curve. Ultimately I'm interested in learning about Schnorr signature aggregation and MuSig protocols, but I'm starting from the ground up. I've attempted to ...
ursuscamp's user avatar
0 votes
0 answers
47 views

If I solved y²= (x³ * ax * b) mod p [as it is] what would I gain or be able to do with it's algorithm?

So the calculations for secp256k1 affirm to the formula y² = (x³ * ax * b) mod p of which is said to be impossible to calculate (as is) because of arbitrary large numbers involved. Hypothetically if ...
AncientTides's user avatar
1 vote
1 answer
78 views

What is the concept behind extracting point x from point y given that both are correspondants of G ^ k mod p

Within the encryption protocol that governs bitcoin (Secp256k1 to be precise), the generated points publicKey_x and publicKey_y are a results of calculated coordinates within the finite field " G^...
AncientTides's user avatar
4 votes
1 answer
709 views

What does it mean that the security of Bitcoin public keys and 256-bit ECDSA is 128 bits?

I am reading the Master Bitcoin book and came across the following: From a security perspective, the amount of entropy actually used for the production of HD wallets is roughly 128 bits, which equals ...
dassd's user avatar
  • 1,059
1 vote
1 answer
401 views

Webpack issue with tiny-secp256k1 and ECPair

I am developing a browser extension using Webpack v5 and incorporating the bitcoinjs-lib and ecpair libraries to create a Bitcoin wallet. However, I am encountering an error when attempting to load ...
Vaibhav Patel's user avatar
3 votes
1 answer
212 views

Questions about secp256k1_pubkey_load/save() implementation

I'm a newbie who has just started reading Bitcoin Core code. I have a lot of questions about seemingly trivial code. Right now, I have two questions. When branching to an if statement, why is the ...
r_comma_s's user avatar
6 votes
1 answer
379 views

Can't verify Taproot signatures that use SIGHASH_ANYONECANPAY

I wrote a program that verifies signatures for Taproot transactions using the secp256k1 library. My program works perfectly for SIGHASH_ALL, SIGHASH_NONE and SIGHASH_SINGLE. But in February, we saw ...
Zephyrus's user avatar
  • 772
3 votes
1 answer
70 views

Inconsistent behavior testing Taproot Workshop - Section: 0.2 Elliptic Curve Math

Workshop link: https://github.com/bitcoinops/taproot-workshop/ In the section 0.2.4 Programming Exercise: Distributivity of scalar operations we implement the following code: a_key = ECKey().set(a) ...
Poseidon's user avatar
  • 693
1 vote
1 answer
97 views

What result of this sagemath script?

My sagemath cannot compute the result of the following code for such a large number N. Can someone provide the result for the first 10 points ? n=...
Donald's user avatar
  • 21
1 vote
1 answer
105 views

Is there a way to handle scalar multiplication with the Secp256k1 generator to finalize a Bitcoin script in an atomic swap?

I know that Bitcoin can do Schnorr which allows for one way to finalize an atomic swap but on the other side of the current swap implementation( that I am working with), the script needs to multiply a ...
Poseidon's user avatar
  • 693
-2 votes
1 answer
83 views

What is the step-by-step algorithmic process to find the modular multiplicative inverse of (n-1) mod np, where (n-1) and np are not coprime?

Having perused the stackexchange, I found some similar questions, but am having difficulty understanding how to arrive at the solution to (n-1)*x=1 mod np, where: n: Finite group order of the Bitcoin ...
Alfhilðr ínn Seiðkona's user avatar
0 votes
0 answers
131 views

secp256k1, reused nonce across two differents pubkeys

Edited: changing the notation according request by fgrieu. I have prepared 4 transactions for 2 pubkeys with the same r1 and r2. properties of secp256k1: p = ...
Ironic's user avatar
  • 23
1 vote
2 answers
156 views

What does it mean for an integer to be a member of secp256k1 group?

I'm reading the spending section of BIP47: Alice calculates a scalar shared secret using the x value of S: s = SHA256(Sx). If the value of s is not in the secp256k1 group, Alice MUST increment the ...
Merri's user avatar
  • 13
11 votes
1 answer
370 views

How does this field multiplication in libsecp256k1 work?

I'm looking at libsecp256k1's codebase, for learning reasons (doubt I can contribute with anything useful there). While looking at the field implementation, the implementation of ...
Davidson Souza's user avatar
1 vote
1 answer
161 views

How to choose a nothing-up-my-sleeve (NUMS) point on secp256k1 for use in Taproot?

Per BIP-341, if you want to create a Taproot output that is only spendable via the script-path spend (and not a key-path spend), you must "pick as internal key a point with unknown discrete ...
James O'Beirne's user avatar
1 vote
0 answers
131 views

Is Curve25519 better option than Secp256k1?

Are signatures over Curve25519 better than over Secp256k1 or are there major drawbacks? How do, for instance, EdDSA/Schnorr using Curve25519 compare with ECDSA/Schnorr for Secp256k1?
Son Kaos999's user avatar
1 vote
1 answer
184 views

Need a detailed step-by-step P2PK signature validation example

In the process of validating transactions by hand with a new library in elixir. I am starting with f4184fc596403b9d638783cf57adfe4c75c605f6356fbc91338530e9831e9e16, which is one of the first P2PK ...
RooSoft's user avatar
  • 147
-2 votes
1 answer
47 views

I have upgraded libsecp256k1 to latest master but I'm having issues to link it properly now. How can I resolve this?

I have upgraded libsecp256k1 to the latest master but I'm having issues to link it properly now. What is the problem and how might I resolve it? The error message is: collect2: error: ld returned 1 ...
Michael Folkson's user avatar
1 vote
1 answer
134 views

How to add multihreading to a continuous SECP256K1 Python function?

I have an infinite loop Python function for measuring how fast are SECP256K1 public Keys are generated. The script: from time import time a = 0 b = 7 n = ...
Emma Lincoln's user avatar
1 vote
1 answer
78 views

Secp256k1: Does there exist an identity public key for combinations of public keys?

I am aware that the identity on elliptic curves is the infinity element. Long shot (as it would be very useful to me): with that being said, does there exist a public key, pk, on secp256k1 such that, ...
jet's user avatar
  • 35
2 votes
1 answer
132 views

How many elements does Bitcoin's secp256k1 have?

I'm wondering whether it is known how many elements does Bitcoin's elliptic curve have? Have not been able to find an answer to this, only for specific subgroups.
kuco 23's user avatar
  • 255
1 vote
0 answers
249 views

secp256k1 library building for C++

The title says it all. How can I compile secp256k1 for use in a personal project. I have #include secp256k1.h but keep getting unresolved external linkers. I believe this is due to the lack of a ...
CTME's user avatar
  • 11
4 votes
1 answer
174 views

How does the BIP340 lift_x algorithm work?

Couple questions of code that I'm reviewing trying to learn schnorr sigs. Why do we want an odd private key? I see even tests on the private key and then subtract it from the SECP256K1 Order to get an ...
Kaizen's user avatar
  • 331
2 votes
1 answer
362 views

Why bitcoin's generator point does not satisfy Elliptic Curve Cryptography equation?

This is my Python program: Acurve = 0 Bcurve = 7 Gx = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798 Gy = 0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8 print(...
Devanshu Linux's user avatar
1 vote
1 answer
555 views

Is it true that Public keys with even y coordinate correspond to private key that are less than n/2 and vice versa? (Secp256k1)

The question is somewhat complex and directed to clearing thing out. Suppose that n is the order of the cyclic group. It n - 1 is the number of all private keys possible n = ...
Emma Lincoln's user avatar
1 vote
0 answers
44 views

Incorrectly counts the we have added a generator point to itself in a loop (SECP256K1, Python),

I have a script that converts a bitcoin private key into x and y coordinate with parameters of a Secp256k1 curve. Here's the script: a = 0 b = 7 #Order of the finite field prime = 2**256 - 2**32 - 977 ...
Emma Lincoln's user avatar
1 vote
1 answer
753 views

How to convert a compressed public key into uncompressed one in Python?

I've searched really hard for a Python script that coverts a compressed public key into uncompressed one, since I don't know how to code this. I stumbled upon these links: https://stackoverflow.com/...
Maltoon Yezi's user avatar
2 votes
1 answer
271 views

Why g is 2 and 3 to derive the lambda and beta values for endomorphism on the secp256k1 curve?

As you can seen here, in hex, N and P are: N = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141 P = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F The ...
tony pham's user avatar
1 vote
1 answer
422 views

Questions about generating a random number for ECDSA

One of the component of making of SECP256K1 signatures, is a random number that is later multiplied by the generator point in order to be used in further computations. If we imagine that k - is the ...
Maltoon Yezi's user avatar
0 votes
1 answer
71 views

Does the libsecp256k1 API expose low level functionality such as group algebra? If not why not?

Does the libsecp256k1 API expose low level functionality such as group algebra (e.g. generator point, point at infinity)? If not, why not? This was asked by ProofOfKeags in this libsecp256k1 issue. ...
Michael Folkson's user avatar
2 votes
1 answer
134 views

Fail at coding my private to public key converter (Pyhon)

Fail at coding my private to public key converter script for Bitcoin (Secp256k1) Currently going through the book "Programming Bitcoin by Jimmy Song", got stuck on page 61 (Chapter 3), but ...
Maltoon Yezi's user avatar
2 votes
1 answer
183 views

Is there a subgroup of order 2^n (for large n) of the prime field that secp256k1 is defined over?

the curve secp256k1 is defined over the prime finite field F_p with p = 2^256 - 2^32 - 2^9 - 2^8 - 2^7 - 2^6 - 2^4 - 1. Is there any known cyclic subgroup of order 2^n of F_p?
jet's user avatar
  • 35
1 vote
1 answer
185 views

Is there code in libsecp256k1 that theoretically should be moved to the main Core codebase?

In this question on libsecp256k1 Pieter Wuille stated: libsecp256k1 provides implementations for all kinds of operations that involve private keys, public keys, or both. That includes key generation (...
Michael Folkson's user avatar
1 vote
1 answer
155 views

why int128 in secp256k1?

Why do they write an int128 type in secp256k1, when there's already arbitrary length rational numbers? Is that fancy? Boredom? Isn't secp256k1 just for key pairs, and key pair arithmetic is seldom ...
Mercedes's user avatar
  • 802
2 votes
0 answers
79 views

Why are coefficients a=0 and b=7 used to define the Weierstrass equation in SECp256k1?

Most of the private to public key implementations I've come across do not make use of the equation y^2=x^3+7 (the weierstrass equation defining SECp256k1). One that i often use is in the link below ...
Moussa Al-Basheer's user avatar
1 vote
1 answer
118 views

How is a Bitcoin transaction signed using ECDSA?

I am quite familiar with the way secp256k1 ECDSA works as well as the equations that are utilised. However, I have no idea how this ECDSA applies to signing Bitcoin (SegWit Format) and transferring it ...
Jamo's user avatar
  • 167
2 votes
1 answer
284 views

How does ECDSA work when generating the public key?

I know the curve has formula y^{2}=x^{3}+ax+b. However, some websites are saying that a=0 and b=7 for secp256k1? What is secp256k1? Is it the curve that is always used or does it generate the field in ...
Jamo's user avatar
  • 167
1 vote
1 answer
389 views

Why is the Generator Point G for secp256k1 curve typically indicated in (y,-x) quadrant?

Generator Point G for the secp256k1 curve is typically indicated below where the curve intersects the y-axis. At x=0, y=sqrt(7) and -sqrt(7), which are both small numbers less than 3, but G is an ...
b0d's user avatar
  • 33
1 vote
1 answer
186 views

Is it feasible to calculate EC private key k from public key K for very low values of k?

If an EC private key k is very small, say "1", is it feasible to calculate the private key k from its public key K, since there would only be one step back to generator point G and therefore ...
b0d's user avatar
  • 33