The 2024 Developer Survey results are live! See the results

# Tag Info

Accepted

### What is the relationship between the three possible X coordinates corresponding to a Y coordinate?

Yes, there is! For a given Y coordinate y, if on the curve, the three corresponding X coordinates are the cube roots of y2 - 7. If you have any such cube root y0, then multiplying it with a cube root ...
• 108k
Accepted

### Why does BIP-340 use secp256k1?

Couldn't it have used other curves, like Curve25519 and its signature schemes that are being used by many other projects? Curve25519 is a key agreement scheme, but if you're referring to the (related)...
• 108k

### Is there still a digital signature loophole in Bitcoin transactions?

Does the problem of repeating the value r still persist today in Bitcoin transactions? If your question is whether Bitcoin signatures are still vulnerable if their nonces are generated in a bad way: ...
• 108k
Accepted

### What is the largest value that the x & y coordinates respectively can be/reach

It is easy to find the largest integer solutions to the curve equation y2 = x3 + 7 mod p, where p = 2256-232-977, by simply trying numbers from high to low until you hit a solution. The highest ...
• 108k

### Two private keys whose corresponding public keys have the same x-value?

Yes, trivially. If private key d has public key X coordinate m, then so does private key n-d, where n is the order of the curve (as n-d equals -d modulo n). This follows from a basic rule in elliptic ...
• 108k

### How can I determine if a point on the secp256k1 curve was derived using point addition or point doubling?

Point addition on an elliptic curve involves two formulas (the addition formula and the doubling formula), but adding a point to itself is defined as equal to the doubling. This is because in case the ...
• 108k
Accepted

### What is the concept behind extracting point x from point y given that both are correspondants of G ^ k mod p

It isn't an encryption protocol as nothing is being encrypted. A public key is calculated from a private key and then the private key is used to generate digital signatures proving ownership of the ...
• 15.6k

### Is it possible to reduce the field size without disrupting generation of public keys?

i was wondering if its possible to reduce to field to a 130 bit or lower No, that would be woefully insecure. The security of elliptic curve cryptography scales with the half of the field size. A 133-...
• 108k
Accepted

### Is it possible to calculate the correct y coordinate from x coordinate given only x coordinate without any prefix

There is no known relation between the parity of the Y coordinate and any property of the private key (like whether it's in the low or high half). In BIP340, which defines the Schnorr-based digital ...
• 108k
Accepted

### What is the relationship between parity and the sign of the points on the elliptic curve?

First some background The X and Y coordinates of an elliptic curve are not integers. They are elements of a finite field. In secp256k1, that is the modulo p = 2256-232-977 field. In your example, that ...
• 108k
Accepted

### In the PrivateKey sign() method why are s and N-s equivalent solutions?

The verification equation for ECDSA is X coordinate of ((z/s)G + (r/s)Q) mod n = r Where the divisions happen modulo the order of the curve (n), and z is the message hash (taken modulo n again). Also,...
• 108k

### How does this field multiplication in libsecp256k1 work?

Is this algorithm inspired by a public paper? Any reference would be helpful, as I'm unable to follow reason about the code itself. I am not sure about "papers", but more or less formal ...
1 vote

### How to convert the results of point doubling (Rx1 and Ry1) to point addition (Rx2 and Ry2) without knowledge of (Qx, Qy) in secp256k1 elliptic curve

Yes, but it's pretty silly. If you use your addition formula for Qx = Gx, the intermediary s will be 0. From this, it follows that Rx = -2Qx = -2Gx and Ry = -Qy. So if you instead wanted doubling (all ...
• 108k
1 vote

### Would two related nonces cause the private key to leak?

Generally, if someone produces two valid signatures for two different messages with the same private key and either the same nonce or two nonces with known arithmetic relationship, this produces a ...
• 76.4k

Only top scored, non community-wiki answers of a minimum length are eligible