38
votes
Accepted
Why is it not possible to get the private key out of the public key?
How I understood it, the equation for the public key is defined as so K = k * G
With K being the public key, k the private key and G the generator point.
That's correct.
Now my first question, is G ...
- 110k
35
votes
What does the curve used in Bitcoin, secp256k1, look like?
you can check the Bitcoin doc https://en.bitcoin.it/wiki/Secp256k1 ,
there you will find some technical details about the secp256k1 used in bitcoin.
Below an illustration of the secp256k1's elliptic ...
- 1,161
28
votes
Accepted
How is the generator point G chosen in the secp256k1 curve used in Bitcoin?
We don't know. The secp256k1 curve (and the corresponding generator) was defined and standardized by people at Certicom. I know people have inquired about its origins, but it appears those involved ...
- 110k
14
votes
Accepted
What is the reasoning behind the choice of 2^256-2^32-977 for the prime on the secp256k1 curve?
Secp256k1 was designed to be a 256-bit size elliptic curve without cofactor and admitting an efficient endomorphism for optimization purposes. The choices of the relevant parameters are derived from ...
- 7,727
12
votes
How is the generator point G chosen in the secp256k1 curve used in Bitcoin?
As Pieter already described in his answer it is not known why the multiplicative inverse of 2 of the generator point of secp256k1 is such a short (166 bit) number.
But interestingly all prime order ...
- 181
11
votes
Accepted
BIP32 recommends a 256 bit seed. Why do most Bitcoin wallets only use a 128 bit seed?
The reasons for the 3 numbers:
Bitcoin uses 256-bit ECDSA signatures. These require in the order of 2128 steps to find a private key from the public key is known. This is Bitcoin's security level: we ...
- 110k
11
votes
Accepted
How can a deterministic wallet have one private key but multiple public keys
No, there is not one private key. There is one Master private key. The master private key is then used to generate more private keys in a deterministic fashion, i.e. using the same master private key, ...
- 72.2k
11
votes
Accepted
Why was the Schnorr code removed from Bitcoin Core?
The Schnorr implementation was never in Bitcoin Core. Rather it is in the libsecp256k1 library that is a subtree in Bitcoin Core. The commit you reference is actually a commit in that library which ...
- 72.2k
11
votes
Why doesn't basepoint G of Secp256K1 seem to be on the Elliptic Curve?
The secp256k1 curve is defined over x and y coordinates that are members of the finite field GF(2^256 - 2^32 - 977), or in other words, their operations hold only when considered modulo ...
- 110k
9
votes
Accepted
Is there a point on the secp256k1 curve for any given X coordinate?
The size of secp256k1's coordinate field is 2256 - 232 - 977.
That means there are only 232 + 977 (about 4 billion) possible 32-byte combinations that are not a valid coordinate.
Only slightly less ...
- 110k
9
votes
Accepted
What is the difference between secp256k1_ecmult_gen and secp256k1_ecmult?
How should these two functions be used properly?
A simple answer is "not at all". Those functions are not exposed in the public API of libsecp256k1, and that's the reason why they don't ...
- 511
8
votes
Accepted
What is the relationship between the three possible X coordinates corresponding to a Y coordinate?
Yes, there is!
For a given Y coordinate y, if on the curve, the three corresponding X coordinates are the cube roots of y2 - 7. If you have any such cube root y0, then multiplying it with a cube root ...
- 110k
7
votes
Accepted
C secp256k1: What is the purpose of the idiom '(void)data;'?
Without (void) data;, gcc will complain about data being an unused variable. This is used throughout the codebase, especially for context objects, to deal with parameters which are required for API/...
- 1,210
7
votes
Accepted
Private key generation doubt
You're right, there is no strict requirement that the private key is strictly less than the group order.
However, it is required that the resulting public key is uniform, which implies that (x % n) ...
- 110k
7
votes
Accepted
Why Schnorr was added to secp256k1 library instead of a separate library?
Yes, the BIP340 signature scheme that was added to libsecp256k1 is an Elliptic Curve based variant of Schnorr signatures. Traditionally Schnorr signatures use a group of integer multiplication modulo ...
- 110k
7
votes
Why is it not possible to get the private key out of the public key?
Mathematicians like their analogies, sometimes those analogies can be helpful, but they can equally be confusing, particularly to those new to a field.
In mathematics a "group" consists of a ...
- 269
7
votes
Accepted
Is there a subgroup of order 2^n (for large n) of the prime field that secp256k1 is defined over?
No, there cannot be.
There are two groups defined by the secp256k1 field, the addition group, and the group of multiplication of its non-zero elements.
Neither has a large 2n subgroup, because the ...
- 110k
7
votes
Accepted
Why bitcoin's generator point does not satisfy Elliptic Curve Cryptography equation?
The secp256k1 arithmetic is defined over the finite field of integers modulo 2256 - 232 - 977.
The following code works:
M = 2**256 - 2**32 - 977
Acurve = 0
Bcurve = 7
Gx = ...
- 110k
7
votes
Accepted
Why does BIP-340 use secp256k1?
Couldn't it have used other curves, like Curve25519 and its signature schemes that are being used by many other projects?
Curve25519 is a key agreement scheme, but if you're referring to the (related)...
- 110k
6
votes
tiny-secp256k1 and ECDSA signing determinism
The secp256k1 library uses RFC6979 to generate deterministic nonce values (k). It essentially takes the hash of both the private key and the message being signed in order to get k. This means that ...
- 72.2k
6
votes
Accepted
SECP256K1 Minimum Value for Private Key
If people in general would more often pick lower integers as private keys than larger integers, then it would be a good strategy for an attacker to start with lower integers.
However, the opposite ...
- 110k
6
votes
How were the secp256k1 base point coordinates decided?
Since the secp256k1 curve order is prime, every point on the curve except the point at infinity is a generator.
Nothing is known about how the designers of the curve chose this specific generator.
...
- 110k
6
votes
Schnorr batch validation speed statistics
Speedup in well optimized cryptographic functions are hard to come by. In libsecp256k1 we'll usually celebrate a 4% algorithmic speedup. Figures on the order of 2x are reasonable for the usage in ...
- 7,727
6
votes
Openssl magic values? Secp256k1 and ECDSA similarities? What makes secp256k1 special?
You are using the eliptic curve function of openssl and providing a serialized bytestring as an input. DER (Distinguished Encoding Rules) is a restricted variant of BER for producing unequivocal ...
6
votes
Accepted
What are the co-ordinates of generator G in his uncompressed form on secp256k1?
The 04 first byte header indicates this is an uncompressed point (02 indicates compressed).
From there, it is simply an x followed by y representation - The first 32 bytes are x, the following 32 ...
- 17.3k
6
votes
Accepted
Who is the creator of the secp256k1 standard?
It can be found in https://www.secg.org/sec2-v2.pdf:
SEC 2: Recommended Elliptic Curve Domain Parameters
Certicom Research
Contact: Daniel R. L. Brown ([email protected])
January 27, 2010
Version 2....
- 110k
6
votes
Accepted
Can secp256k1 have different parameters and still be called secp256k1?
The SEC2 document recommends the use of a number of curves. One of these curves is called secp256k1.
The recommendation doesn't refer to the parameters. What is recommended is the use of the secp256k1 ...
- 110k
6
votes
Accepted
why int128 in secp256k1?
I assume you're referring to the C implementation of secp256k1 arithmetic, perhaps specfically this pull request? If not, comment and I'll revise my answer.
Why do they write an int128 type in ...
- 110k
6
votes
Accepted
How many elements does Bitcoin's secp256k1 have?
Over the field GF(2256 - 232 - 977), the equation y2 = x3 + 7 has exactly
115792089237316195423570985008687907852837564279074904382605163141518161494336
distinct solutions for (x, y), or roughly 2256 -...
- 110k
6
votes
Accepted
Questions about secp256k1_pubkey_load/save() implementation
Wouldn't the code below work just as well?
Possibly, but I believe it would be undefined behavior (and if it isn't, it'd need careful language lawyering to make sure it isn't). The existing code is ...
- 110k
Only top scored, non community-wiki answers of a minimum length are eligible