Share Your Experience: Take the 2024 Developer Survey

# Tag Info

Accepted

### How do you derive the private key from two signatures that share the same k value?

ECDSA signatures are pairs (r,s) where r=(kG).x mod n, and s = (m + rx)/k mod n, where x is the secret key, k is the random nonce, and m is the message. If you have two s values s1 and s2 for the same ...
• 106k
Accepted

### How is Bitcoin governed by mathematics?

This question may be opinion based in some ways, but I'm going to attempt to answer it as it is an important concept, and somewhat unlike traditional systems. Bitcoin is governed by math, in some ...
• 17.1k
Accepted

### How much entropy is lost alphabetising your mnemonics?

TL;DR: you get around a factor 500 million attack speedup for 12 words, bringing it not quite in the realm of feasible attacks, but it's getting close. For 24 words, the speedup is around a factor ...
• 106k
Accepted

### What is the relationship between the three possible X coordinates corresponding to a Y coordinate?

Yes, there is! For a given Y coordinate y, if on the curve, the three corresponding X coordinates are the cube roots of y2 - 7. If you have any such cube root y0, then multiplying it with a cube root ...
• 106k

### How much entropy is lost alphabetising your mnemonics?

The number of possible 12 word phrases (disregarding the checksum) is 2048 ^ 12 = 5444517870735015415413993718908291383296 The number of alphabetically ordered 12 word phrases is = ...
• 3,569
Accepted

### Simple math in Script

This is the smallest script I could come up with, at 13 opcodes: OP_3DUP OP_ADD OP_ADD OP_15 OP_NUMEQUALVERIFY OP_8 OP_LESSTHAN OP_VERIFY OP_8 OP_LESSTHAN OP_VERIFY OP_8 OP_LESSTHAN It saves some ...
• 8,659
Accepted

### What is the largest value that the x & y coordinates respectively can be/reach

It is easy to find the largest integer solutions to the curve equation y2 = x3 + 7 mod p, where p = 2256-232-977, by simply trying numbers from high to low until you hit a solution. The highest ...
• 106k
Accepted

### weak transaction in secp256k1

I believe this would be trivial to break. Let's say that: z = z0 + 2128z1, with 128-bit z0, z1. d = d0 + 2128d1, with 128-bit d0, d1. In that case, according to your construction, k = d1 + 2128z1. ...
• 106k
Accepted

### How to calculate coins mined per day?

Average coins/day for a miner can be estimated by comparing the miner's hashrate with the hashrate of the network. where, Cm is total coins for the miner subsidy is the number of coins/block a ...
• 7,418

### How is Bitcoin governed by mathematics?

That the network is secure by means of math instead of some central authority (e.g. a bank overseeing everything)? If so, what math? The math that makes PoW possible? The math that makes proof of ...
• 7,418
Accepted

### Proof that blockchain converges to the longest chain

Without further qualifications or assumptions, no such proof exists because the statement isn't true. Proof of work, at best, makes it expensive for miners not to converge, but if miners had no regard ...
• 106k

### Jimmy Song 'Programming Bitcoin' book math doubt

Ok, I found later on the book... Is about how to handle negative exponents using Fermat's little theorem. ap-1 = 1 so if a = 17 17-3 = 17-3 * 1 = 17-3 * 17p-1 = 17p-4
• 181
Accepted

### Are there risks to using the same private key for both ECDSA and Schnorr signatures?

Copying the summary from my mailing list post on this topic: To stay within the realm of provably security it's advisable to make sure ECDSA key and Schnorr keys use distinct hardened derivation ...
• 106k

### How to calculate daily weekly monthly price change in percentage?

You need to change the denominator to Open Price (OP) because the 24hpercentage will be calculated on basis of OP not on the last traded price (P). priceChangeInPercentage = 100*(P - OP)/OP
• 131

### What happens to bitcoin if math is found that makes reversing PQ multiplication, modular math, etc, easy to reverse in a few steps?

What happens to bitcoin if math is found that makes reversing multiplication, modular math, etc, easy to reverse in a few steps? All of these are already easy. Reversing elliptic curve point ...
• 106k

### Simple math in Script

OP_DUP OP_8 OP_LESSTHAN OP_VERIFY OP_SWAP OP_DUP OP_8 OP_LESSTHAN OP_VERIFY OP_ROT OP_DUP OP_8 OP_LESSTHAN OP_VERIFY OP_ADD OP_ADD OP_15 OP_NUMEQUAL Tracing the execution (for a successful input): ...
• 106k
Accepted

### Why is the Schnorr verification formula working and actually verifying the validity of a signature?

To prove the validity of the signature, we must see that the tuple (R,s) actually came from the private key x. In particular that s was derived as s=r+cx. Obviously, we should not possess the private ...
• 11.8k

### What is the mathematics behind the maximum number of 21 million bitcoins that can be generated?

every detail of bitcoin can be changed by the developer by editing the source code. 21million was satoshi nakamotos design decision. afaik this number is not directly contained in the source-code. ...
• 746

### Is BIP 32 Technology Cryptographic Curve Agnostic?

Any Elliptic Curve could work in the BIP32 scheme. The only property of a Curve that BIP32 relies on is that a * G + b *G = (a + b mod N) * G, which is true for any Elliptic Curve. Secp256k1 is a '...
• 14.2k

### Get uncompressed public key from compressed form

You can use bouncycastle ECPoint to do this conversion: static ECParameterSpec SPEC = ECNamedCurveTable.getParameterSpec("secp256k1"); static byte[] compressedToUncompressed(byte[] compKey) { ...
Accepted

### Get uncompressed public key from compressed form

Yes, you can convert a 33-byte compressed public key into a 65-byte uncompressed public key in Java. Here is the code to perform the operation. It is correct, robust, and only requires Java SE ...
• 882

### Needed maths for full understanding

The signatures in Bitcoin (and Bitcoin Cash, Ethereum, and many other cryptocurrencies) are generated using elliptic curve curve cryptography. I found these videos very helpful in that regard: https://...
• 1,047
Accepted

### Secp256k1: Does there exist an identity public key for combinations of public keys?

As you pointed out, the identity is the point at infinity. It is also the only identity for addition over the elliptic curve. But infinity is not a valid public key, for a number of reasons, and thus ...
• 106k
Accepted

### Low-s value in bitcoin signature

Details are in BIP 146: We require that the S value inside ECDSA signatures is at most the curve order divided by 2... ... A high S value in signature could be trivially replaced by S' = 0xFFFFFFFF ...
• 10.2k

### Verifying a zkSNARK on Bitcoin/Hope for a future with OP_MUL

I am trying to write a script that can verify a SNARK, but from what I understand OP_MUL is still is disabled in TapScript. It appears completely infeasible to me to implement a SNARK verifier in ...
• 106k
1 vote
Accepted

### What am I doing wrong in calculating point addition? Is something redundant in the formula I am using?

My point was that regardless of whether you do a modulo operation or not, you'll end up with the same point - if you treat differences of a multiple of 11 as "identical". If of course you do ...
• 106k
1 vote

### Why do private keys have a range limit?

n is the number of points on the curve (including the point at infinity). Private keys are numbers between 1 and n-1, inclusive. 0 is not a valid private key, because its corresponding point would be ...
• 106k
1 vote
Accepted

### how to calculate Entropy from series of outcome?

Try using the an open source program called ent. Here are the results for rolling a die six times with the result vector of <666666>. % echo -n "666666" | ./ent Entropy = 0.000000 bits per byte. ...
• 3,067
1 vote

### Mixing Unequal Inputs

I don't have an answer to your question directly, but it's worth pointing out that anything other than 32 x 0.1btc inputs and 32 x 0.1btc outputs provides worse anonymity. Even having 0.3, 0.3, 0.3, 0....
1 vote

### How can I calculate the breakeven price for buying and reselling on cryptocurrency exchange?

Sell Rate = (Fee + 1) / ((1 / Buy Rate) - (1 / Buy Rate) * Fee) Key: Sell rate = Minimum sell rate required to break even Buy Rate = The rate that your initial trade is made at Fee = The fee that ...

Only top scored, non community-wiki answers of a minimum length are eligible