Questions tagged [secp256k1]

This tag should be used for anything related to the secp256k1 algorithm used for Bitcoin's public key cryptography.

Filter by
Sorted by
Tagged with
58
votes
2answers
37k views

What does the curve used in Bitcoin, secp256k1, look like?

I'm reading up on ECC curves and on many of them I see an illustration that looks like this What does the comparable curve in Bitcoin look like, or are all curves generally the same?
8
votes
1answer
987 views

Why was the Schnorr code removed from Bitcoin Core?

I was looking for the Schnorr implementation in Bitcoin Core and was surprised to see that it was removed on Nov 2016 (commit e06e878fd7dcc99825025fa99aedb86bc7d5c29f). Why was the source code ...
7
votes
1answer
536 views

Why doesn't basepoint G of Secp256K1 seem to be on the Elliptic Curve?

From what I understood are these the coordinates of basepoint G of Secp256K1 on the Elliptic Curve, in hexadecimal and decimal format. Hexadecimal Gx = (79BE667E F9DCBBAC 55A06295 CE870B07 029BFCDB ...
6
votes
1answer
1k views

Where and how is secp256k1 used within Bitcoin?

Bitcoin is unique that is uses secp256k1 to secure it's transactions; and any cryptographic attack against this algorithm is probably going to be percieved as an attack against the bitcoin network. ...
6
votes
2answers
1k views

BIP32 recommends a 256 bit seed. Why do most Bitcoin wallets only use a 128 bit seed?

According to BIP32's "Master key generation" section, "256 bits is advised". See https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#Master_key_generation Why did BIP32 consider 256 bits ...
6
votes
1answer
588 views

Is there a point on the secp256k1 curve for any given X coordinate?

There function in libsecp256k1 that allows you to directly set the field element to 32 bytes of your choice. Does secp256k1 always return a valid group element for any 32 byte value? ...
6
votes
3answers
2k views

How do you derive the lambda and beta values for endomorphism on the secp256k1 curve?

You can see a little background about this on this bitcointalk post by the late Hal Finney. Beta and lambda are the values on the secp256k1 curve where: λ^3 (mod N) = 1 β^3 (mod P) = 1 As seen ...
5
votes
1answer
2k views

How can a deterministic wallet have one private key but multiple public keys

If we take for example bread wallet. There is one mnemonic to remember, which means one private key? But when you use the app, your public address constantly changes. So more than one public key? ...
5
votes
2answers
5k views

Is this the proper way to use Bouncy Castle to generate a Bitcoin compatible key?

I'd like to use Bouncy Castle to generate the keypair for use with all *coin variants. Is this the correct implementation to get the correct ECC curve that the *coin variants use? Org....
5
votes
1answer
1k views

How were the secp256k1 base point coordinates decided?

79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798,483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8 seems very random to me. I see how this point is on the curve, but how ...
5
votes
1answer
2k views

order of group of points of secp256k1

points on curve secp256k1 form a group E(Fp) over field Fp. p = 2^256 - 2^32 - 2^9 - 2^8 - 2^7 - 2^6 - 2^4 - 1 is prime. n is the order of group E, n=...
5
votes
1answer
478 views

C secp256k1: What do prefixes 0x06 and 0x07 in an uncompressed public key signify?

In the eckey_impl.h header file, the implementation of secp256k1_eckey_pubkey_parse checks if the first byte of a 65-byte public key is 0x04, 0x06 or 0x07. Where can I find documentation regarding the ...
4
votes
3answers
2k views

What is the reasoning behind the choice of 2^256-2^32-977 for the prime on the secp256k1 curve?

In Bitcoin's elliptic curve (secp256k1), the prime p = 2^256 - 2^32 - 2^9 -2^8 - 2^7 - 2^6 - 2^4 - 1 the generator point Gx = 0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798 ...
4
votes
1answer
798 views

How to determine if a public key point y is negative or positive, odd or even?

Take a bitcoin public key (x, y) and its additive inverse (x, -y). How do you identify which is the positive point and which is the negative point? Example Private key 1 -> (x, y) x = ...
4
votes
1answer
129 views

What are the co-ordinates of generator G in his uncompressed form on secp256k1?

I was looking at BitcoinWiki and it says that G, in it's uncompressed form, has a value of: G = 04 79BE667E F9DCBBAC 55A06295 CE870B07 029BFCDB 2DCE28D9 59F2815B 16F81798 483ADA77 26A3C465 5DA4FBFC ...
4
votes
1answer
2k views

OpenSSL and Secp256k1 differing in implementation of ECDSA signatures?

OpenSSL (from ssl in Mac OS X Version 10.11.6) and Secp256k1 (from the bitcoin-core repository) seem to differ in their implementations of ECDSA. I'm having issues with these differences and want to ...
3
votes
1answer
362 views

C secp256k1 : what is the purpose of secp256k1_context_randomize?

In the course of studying the secp256k1 library API, I came acrosssecp256k1_context_randomize which seems similar to providing a seed to a pseudo-random generator. At the same time, the file secp256k1....
3
votes
1answer
552 views

Bitcoin scripts that force disclosure of the private key

Context: I am creating an example code that would demonstrate an atomic swap between Elements and Bitcoin, with the aim that the swap transactions cannot be trivially linked, as it would be with ...
3
votes
2answers
161 views

Can a Bitcoin (secp256k1) key be converted to a Ed25519 (Tor v3) key?

If I have secp256k1 keypair that is widely known, like a Bitcoin address, can I convert that into a Ed25519 key pair such that someone could access a .onion address in a deterministic way?
3
votes
1answer
472 views

What are the weakest cryptographic guarantees in Bitcoin?

I read in this Github pull that Bitcoin relies on weaker cryptographic guarantees than SHA256. What are the weaker cryptographic guarantees being referred to? Could it be that RipeMD is 160 bits? ......
2
votes
2answers
2k views

Does the 256-bit integer secret exponent define the X, Y pair?

I'm trying to understand better how bitcoin works and I'm stuck. I've read a blog showing how to construct the WIF from the 256-bit secret integer and up to that point, I think I follow. However I'm "...
2
votes
3answers
375 views

How to subtract two points on an elliptic curve?

Please tell me if there is a formula for A-B, (That is, subtraction of two points / minus). I know how two points are added, A + B this addition is described in detail (Please tell me how you can ...
2
votes
1answer
330 views

Is there a list of coins that are bip-32 compatible?

BIP 32 allows me to derive keys based off a root key pair, and all these keys will be on the secp256k1 curve. That means I'll be able to use BIP 32 for other coins that are also based on your curve. ...
2
votes
1answer
1k views

SECP256K1 Minimum Value for Private Key

I've been looking into Elliptic Curve Cryptography, in particular the SECP256K1 spec which is used in Bitcoin and Ethereum. So I understand that the Generator point G is fixed based on the spec and ...
2
votes
1answer
90 views

Positive or negative private key of a bitcoin wallet?

Private key is a number. Is the question positive or negative? Is it possible to know a positive private key or negative if you only know the public key? For instance: Positive private key: 2 ...
2
votes
1answer
274 views

Can secp256k1 be implemented efficiently on a 8-bit processor and very limited RAM?

We are trying to build a much simpler version of Trezor. We do have an finished PCB design from a previous project and would like to know whether this design can be modified, without changing the ...
2
votes
0answers
44 views

Linking libsecp256k1 as shared library to Bitcoin Core

I'm not sure if this question is better suited in the context of Autotools, but since it's about Bitcoin Core, I'll try to ask it here. I am trying to Compile/Link libsecp256k1 as a shared library ...
2
votes
0answers
45 views

Is there a simpler form of BIP32-like key derivation?

I've read about BIP32 key derivation functions, and also: Any Elliptic Curve could work in the BIP32 scheme. The only property of a Curve that BIP32 relies on is that a * G + b *G = (a + b mod N) * G,...
2
votes
0answers
1k views

Cannot build secp256k1 C library on Debian stretch

I was hoping that someone would be able to suggest something about this (the same process works perfectly fine on my Debian Jessy machine) $ uname -a Linux front 4.8.0-1-amd64 #1 SMP Debian 4.8.7-1 (...
1
vote
2answers
153 views

Openssl magic values? Secp256k1 and ECDSA similarities? What makes secp256k1 special?

Part 1: Running this command seems to be a reliable way to produce a pubkey from a valid private key that for Bitcoin. Is this a correct assumption? openssl ec -inform DER -text -noout -in <(cat &...
1
vote
1answer
441 views

tiny-secp256k1 and ECDSA signing determinism

I noticed in bitcoin when using the tiny-secp256k1 library to sign the signature for a signature hash of an input, the signature is always the same. However in other ECDSA secp256k1 libraries (im ...
1
vote
1answer
159 views

C secp256k1 : ec_pubkey_parse successful on NULL context despite attribute

Looking at the main API file secp256k1.h of the C library, we have: SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_ec_pubkey_parse( const secp256k1_context* ctx, secp256k1_pubkey* ...
1
vote
2answers
741 views

How do I add two secp256k1 keys together?

I have two public/private keypairs, A and B. I want to add them together to get a new keypair AB. I'd also like to be able to add the public keys of A and B to get the public key of AB. How do I do ...
1
vote
1answer
47 views

Using secp256k1 in personal project

I am trying to use secp256k1 for a toy project that I am working on for learning purposes. I am using Ubuntu 20.04 and I can clone and compile the library just fine. I have tried to include it in a ...
1
vote
2answers
186 views

produce a public key from private key with ecc, with clear description about k=k*g

According to this answer: https://bitcoin.stackexchange.com/a/63996/100526 When he wants to generate a public key from the private key, he has used K=k*G. but I can't understand it's result. If we ...
1
vote
1answer
96 views

Why not every [x,y] coordinate on the Secp256k1 curve corresponds to a valid uncompressed publicKey?

First, some background. 1. There are some coordinates x,y satisfying y^2(mod p)=x^3+7(mod p) on the Secp256k1 curve that do not correspond to a valid Bitcoin uncompressed publicKey of the form 04[x,...
1
vote
2answers
391 views

Private key exported from Electrum, unable to recreate Address with Python

I have created a new Electrum wallet, and here is an address: 1JkZLnmFfpVFLT2ZMtKzc6BuXMdmY41EHA By right-clicking on it, I choose "Private key" which gives: ...
1
vote
1answer
2k views

Is the following a valid bitcoin private key? - FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE

In secp256k1 (Bitcoin's elliptic curve) it is defined that valid private keys may range from 1 to FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141 - 1. (https://crypto....
1
vote
2answers
2k views

C++ and secp256k1

I am working on a tiny C++ bitcoin application for a university project. I'm using Blockcypher API to create transactions, but I faced a problem with signing transaction's hash that returns one of the ...
1
vote
1answer
199 views

x , y coordination division

python code def inverse(x, p): return pow(x,p-2,p) p = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f #private key 2 -->(x , y) value xx = ...
1
vote
2answers
232 views

What sort of tasks can an ASIC be developed to do?

I know requiring a lot of memory is one thing that makes an algorithm ASIC resist. Are there any others? Could an ASIC be developed to do Elliptic Curve Crypto? Like adding two points, or signing a ...
1
vote
0answers
25 views

4 ERRORS GENERATED WHILE INSTALLING BITCOIND

I need your help plz. I have been struggling for weeks to make bitcoind work in my mac terminal. I installed all required programs and dependencies: xcode, bitcoin core, openssl, homebrew, and cloned ...
1
vote
0answers
50 views

C secp256k1: creating bindings in another language with FFI

I am attempting to create bindings from the C library libsecp256k1 into Scheme (the guile implementation) but I am guessing my question applies to other target languages. Say I want to export the ...
1
vote
0answers
474 views

Can I quickly check the cofactor of secp256k1 is 1

I was wondering if there was a quick way to check that the group underlying the elliptic curve secp256k1 was indeed cyclic with the usual point G a generator. I am given the prime number underlying ...
0
votes
1answer
91 views

Private key generation doubt

I read that the private key pk has to be any number between 1 and n, where n is almost 10^77. Since pk' s function is practically to be used as a scalar for multiplying the generator point G, why does ...
0
votes
2answers
78 views

C secp256k1: What is the purpose of the idiom '(void)data;'?

The following code is contained in the file secp256k1.c: static void default_illegal_callback_fn( const char* str, void* data) { (void)data; fprintf(stderr, "[libsecp256k1] illegal ...
0
votes
2answers
73 views

How to change the field of the elliptic curve to the new value N while keeping the default Secp256k1 parameters?

I want to change the margin of the elliptic curve to the new N value, while doing so I want to keep the parameters Standard G-point Generator Secp256k1 that is, I want to replace: N = ...
0
votes
1answer
138 views

Generator Point G multiple

if in a curve y2 mod p = x3+ 7 mod p ( ecdsa-secp256k1) p=115792089237316195423570985008687907853269984665640564039457584007908834671663 G=...
0
votes
1answer
250 views

What is the context in libsecp256k1?

I am experimenting with making a wallet for educational purposes, and would like to use libsecp256k1 directly. Aside from creating a context, and using it in calls, all I have perhaps learned so far ...
0
votes
1answer
40 views

In compressed public keys, is the 2 or 3 the parity or the sign?

In different places I've read that the 2 or 3 is the sign or is the parity of the elided Y coordinate? Which of these is it, or are the sign and parity equivalent in some way?