Skip to main content
The 2024 Developer Survey results are live! See the results
8 votes
Accepted

What is the relationship between the three possible X coordinates corresponding to a Y coordinate?

Yes, there is! For a given Y coordinate y, if on the curve, the three corresponding X coordinates are the cube roots of y2 - 7. If you have any such cube root y0, then multiplying it with a cube root ...
Pieter Wuille's user avatar
7 votes
Accepted

Why does BIP-340 use secp256k1?

Couldn't it have used other curves, like Curve25519 and its signature schemes that are being used by many other projects? Curve25519 is a key agreement scheme, but if you're referring to the (related)...
Pieter Wuille's user avatar
6 votes

Is there still a digital signature loophole in Bitcoin transactions?

Does the problem of repeating the value r still persist today in Bitcoin transactions? If your question is whether Bitcoin signatures are still vulnerable if their nonces are generated in a bad way: ...
Pieter Wuille's user avatar
5 votes
Accepted

What is the largest value that the x & y coordinates respectively can be/reach

It is easy to find the largest integer solutions to the curve equation y2 = x3 + 7 mod p, where p = 2256-232-977, by simply trying numbers from high to low until you hit a solution. The highest ...
Pieter Wuille's user avatar
4 votes

Two private keys whose corresponding public keys have the same x-value?

Yes, trivially. If private key d has public key X coordinate m, then so does private key n-d, where n is the order of the curve (as n-d equals -d modulo n). This follows from a basic rule in elliptic ...
Pieter Wuille's user avatar
4 votes

How can I determine if a point on the secp256k1 curve was derived using point addition or point doubling?

Point addition on an elliptic curve involves two formulas (the addition formula and the doubling formula), but adding a point to itself is defined as equal to the doubling. This is because in case the ...
Pieter Wuille's user avatar
3 votes
Accepted

What is the concept behind extracting point x from point y given that both are correspondants of G ^ k mod p

It isn't an encryption protocol as nothing is being encrypted. A public key is calculated from a private key and then the private key is used to generate digital signatures proving ownership of the ...
Michael Folkson's user avatar
2 votes

Is it possible to reduce the field size without disrupting generation of public keys?

i was wondering if its possible to reduce to field to a 130 bit or lower No, that would be woefully insecure. The security of elliptic curve cryptography scales with the half of the field size. A 133-...
Pieter Wuille's user avatar
2 votes
Accepted

Is it possible to calculate the correct y coordinate from x coordinate given only x coordinate without any prefix

There is no known relation between the parity of the Y coordinate and any property of the private key (like whether it's in the low or high half). In BIP340, which defines the Schnorr-based digital ...
Pieter Wuille's user avatar
2 votes
Accepted

What is the relationship between parity and the sign of the points on the elliptic curve?

First some background The X and Y coordinates of an elliptic curve are not integers. They are elements of a finite field. In secp256k1, that is the modulo p = 2256-232-977 field. In your example, that ...
Pieter Wuille's user avatar
2 votes
Accepted

In the PrivateKey sign() method why are s and N-s equivalent solutions?

The verification equation for ECDSA is X coordinate of ((z/s)G + (r/s)Q) mod n = r Where the divisions happen modulo the order of the curve (n), and z is the message hash (taken modulo n again). Also,...
Pieter Wuille's user avatar
2 votes

How does this field multiplication in libsecp256k1 work?

Is this algorithm inspired by a public paper? Any reference would be helpful, as I'm unable to follow reason about the code itself. I am not sure about "papers", but more or less formal ...
Julio Di Egidio's user avatar
1 vote

How to convert the results of point doubling (Rx1 and Ry1) to point addition (Rx2 and Ry2) without knowledge of (Qx, Qy) in secp256k1 elliptic curve

Yes, but it's pretty silly. If you use your addition formula for Qx = Gx, the intermediary s will be 0. From this, it follows that Rx = -2Qx = -2Gx and Ry = -Qy. So if you instead wanted doubling (all ...
Pieter Wuille's user avatar
1 vote

Would two related nonces cause the private key to leak?

Generally, if someone produces two valid signatures for two different messages with the same private key and either the same nonce or two nonces with known arithmetic relationship, this produces a ...
Murch's user avatar
  • 76.4k

Only top scored, non community-wiki answers of a minimum length are eligible