Skip to main content
Share Your Experience: Take the 2024 Developer Survey
26 votes
Accepted

How do you derive the private key from two signatures that share the same k value?

ECDSA signatures are pairs (r,s) where r=(kG).x mod n, and s = (m + rx)/k mod n, where x is the secret key, k is the random nonce, and m is the message. If you have two s values s1 and s2 for the same ...
Pieter Wuille's user avatar
11 votes
Accepted

How is Bitcoin governed by mathematics?

This question may be opinion based in some ways, but I'm going to attempt to answer it as it is an important concept, and somewhat unlike traditional systems. Bitcoin is governed by math, in some ...
Raghav Sood's user avatar
  • 17.1k
10 votes
Accepted

How much entropy is lost alphabetising your mnemonics?

TL;DR: you get around a factor 500 million attack speedup for 12 words, bringing it not quite in the realm of feasible attacks, but it's getting close. For 24 words, the speedup is around a factor ...
Pieter Wuille's user avatar
8 votes
Accepted

What is the relationship between the three possible X coordinates corresponding to a Y coordinate?

Yes, there is! For a given Y coordinate y, if on the curve, the three corresponding X coordinates are the cube roots of y2 - 7. If you have any such cube root y0, then multiplying it with a cube root ...
Pieter Wuille's user avatar
6 votes

How much entropy is lost alphabetising your mnemonics?

The number of possible 12 word phrases (disregarding the checksum) is 2048 ^ 12 = 5444517870735015415413993718908291383296 The number of alphabetically ordered 12 word phrases is = ...
Mike D's user avatar
  • 3,569
5 votes
Accepted

Simple math in Script

This is the smallest script I could come up with, at 13 opcodes: OP_3DUP OP_ADD OP_ADD OP_15 OP_NUMEQUALVERIFY OP_8 OP_LESSTHAN OP_VERIFY OP_8 OP_LESSTHAN OP_VERIFY OP_8 OP_LESSTHAN It saves some ...
Vojtěch Strnad's user avatar
5 votes
Accepted

What is the largest value that the x & y coordinates respectively can be/reach

It is easy to find the largest integer solutions to the curve equation y2 = x3 + 7 mod p, where p = 2256-232-977, by simply trying numbers from high to low until you hit a solution. The highest ...
Pieter Wuille's user avatar
5 votes
Accepted

weak transaction in secp256k1

I believe this would be trivial to break. Let's say that: z = z0 + 2128z1, with 128-bit z0, z1. d = d0 + 2128d1, with 128-bit d0, d1. In that case, according to your construction, k = d1 + 2128z1. ...
Pieter Wuille's user avatar
5 votes
Accepted

How to calculate coins mined per day?

Average coins/day for a miner can be estimated by comparing the miner's hashrate with the hashrate of the network. where, Cm is total coins for the miner subsidy is the number of coins/block a ...
JBaczuk's user avatar
  • 7,418
5 votes

How is Bitcoin governed by mathematics?

That the network is secure by means of math instead of some central authority (e.g. a bank overseeing everything)? If so, what math? The math that makes PoW possible? The math that makes proof of ...
JBaczuk's user avatar
  • 7,418
4 votes
Accepted

Proof that blockchain converges to the longest chain

Without further qualifications or assumptions, no such proof exists because the statement isn't true. Proof of work, at best, makes it expensive for miners not to converge, but if miners had no regard ...
Pieter Wuille's user avatar
4 votes

Jimmy Song 'Programming Bitcoin' book math doubt

Ok, I found later on the book... Is about how to handle negative exponents using Fermat's little theorem. ap-1 = 1 so if a = 17 17-3 = 17-3 * 1 = 17-3 * 17p-1 = 17p-4
rubdottocom's user avatar
4 votes
Accepted

Are there risks to using the same private key for both ECDSA and Schnorr signatures?

Copying the summary from my mailing list post on this topic: To stay within the realm of provably security it's advisable to make sure ECDSA key and Schnorr keys use distinct hardened derivation ...
Pieter Wuille's user avatar
3 votes

How to calculate daily weekly monthly price change in percentage?

You need to change the denominator to Open Price (OP) because the 24hpercentage will be calculated on basis of OP not on the last traded price (P). priceChangeInPercentage = 100*(P - OP)/OP
Sumit Banik's user avatar
3 votes

What happens to bitcoin if math is found that makes reversing PQ multiplication, modular math, etc, easy to reverse in a few steps?

What happens to bitcoin if math is found that makes reversing multiplication, modular math, etc, easy to reverse in a few steps? All of these are already easy. Reversing elliptic curve point ...
Pieter Wuille's user avatar
3 votes

Simple math in Script

OP_DUP OP_8 OP_LESSTHAN OP_VERIFY OP_SWAP OP_DUP OP_8 OP_LESSTHAN OP_VERIFY OP_ROT OP_DUP OP_8 OP_LESSTHAN OP_VERIFY OP_ADD OP_ADD OP_15 OP_NUMEQUAL Tracing the execution (for a successful input): ...
Pieter Wuille's user avatar
3 votes
Accepted

Why is the Schnorr verification formula working and actually verifying the validity of a signature?

To prove the validity of the signature, we must see that the tuple (R,s) actually came from the private key x. In particular that s was derived as s=r+cx. Obviously, we should not possess the private ...
Rene Pickhardt's user avatar
3 votes

What is the mathematics behind the maximum number of 21 million bitcoins that can be generated?

every detail of bitcoin can be changed by the developer by editing the source code. 21million was satoshi nakamotos design decision. afaik this number is not directly contained in the source-code. ...
anion's user avatar
  • 746
2 votes

Is BIP 32 Technology Cryptographic Curve Agnostic?

Any Elliptic Curve could work in the BIP32 scheme. The only property of a Curve that BIP32 relies on is that a * G + b *G = (a + b mod N) * G, which is true for any Elliptic Curve. Secp256k1 is a '...
morsecoder's user avatar
  • 14.2k
2 votes

Get uncompressed public key from compressed form

You can use bouncycastle ECPoint to do this conversion: static ECParameterSpec SPEC = ECNamedCurveTable.getParameterSpec("secp256k1"); static byte[] compressedToUncompressed(byte[] compKey) { ...
michaelliao's user avatar
2 votes
Accepted

Get uncompressed public key from compressed form

Yes, you can convert a 33-byte compressed public key into a 65-byte uncompressed public key in Java. Here is the code to perform the operation. It is correct, robust, and only requires Java SE ...
Nayuki's user avatar
  • 882
2 votes

Needed maths for full understanding

The signatures in Bitcoin (and Bitcoin Cash, Ethereum, and many other cryptocurrencies) are generated using elliptic curve curve cryptography. I found these videos very helpful in that regard: https://...
Thorkil Værge's user avatar
2 votes
Accepted

Secp256k1: Does there exist an identity public key for combinations of public keys?

As you pointed out, the identity is the point at infinity. It is also the only identity for addition over the elliptic curve. But infinity is not a valid public key, for a number of reasons, and thus ...
Pieter Wuille's user avatar
2 votes
Accepted

Low-s value in bitcoin signature

Details are in BIP 146: We require that the S value inside ECDSA signatures is at most the curve order divided by 2... ... A high S value in signature could be trivially replaced by S' = 0xFFFFFFFF ...
MCCCS's user avatar
  • 10.2k
2 votes

Verifying a zkSNARK on Bitcoin/Hope for a future with OP_MUL

I am trying to write a script that can verify a SNARK, but from what I understand OP_MUL is still is disabled in TapScript. It appears completely infeasible to me to implement a SNARK verifier in ...
Pieter Wuille's user avatar
1 vote
Accepted

What am I doing wrong in calculating point addition? Is something redundant in the formula I am using?

My point was that regardless of whether you do a modulo operation or not, you'll end up with the same point - if you treat differences of a multiple of 11 as "identical". If of course you do ...
Pieter Wuille's user avatar
1 vote

Why do private keys have a range limit?

n is the number of points on the curve (including the point at infinity). Private keys are numbers between 1 and n-1, inclusive. 0 is not a valid private key, because its corresponding point would be ...
Pieter Wuille's user avatar
1 vote
Accepted

how to calculate Entropy from series of outcome?

Try using the an open source program called ent. Here are the results for rolling a die six times with the result vector of <666666>. % echo -n "666666" | ./ent Entropy = 0.000000 bits per byte. ...
skaht's user avatar
  • 3,067
1 vote

Mixing Unequal Inputs

I don't have an answer to your question directly, but it's worth pointing out that anything other than 32 x 0.1btc inputs and 32 x 0.1btc outputs provides worse anonymity. Even having 0.3, 0.3, 0.3, 0....
user46871's user avatar
1 vote

How can I calculate the breakeven price for buying and reselling on cryptocurrency exchange?

Sell Rate = (Fee + 1) / ((1 / Buy Rate) - (1 / Buy Rate) * Fee) Key: Sell rate = Minimum sell rate required to break even Buy Rate = The rate that your initial trade is made at Fee = The fee that ...
dspaniard's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible