Understanding square and cube roots in secp224k1

So, we’re looking at four elliptic curves that were made together due to how their generator is set up. These are secp160k1, secp192k1, secp224k1, and secp256k1. When it comes to calculating square and cube roots, the first three have no issues with their p-values: secp160k1: secp192k1: secp256k1: But for some odd reason, the same approach falls flat on secp224k1’s p-value. If these curves were all created at the same time, why did they choose a different p-value for secp224k1 compared to the others? And what’s the best way to figure out square and cube roots for this particular curve? Plus, what about all the n-values? I’ve heard there are some algorithms that can help calculate those results no matter the value, but since these curves were chosen to make those operations “fast”, shouldn’t we be able to work it out with simple equations like "(p+x)/y", kind of like "(p+1)/4" and "(p+2)/9", right?

Just to be clear, this formula only calculates the square root and cube root for the"p" scalar, right? What would be the use of that? For obvious reasons, square root doesn't make sense for points, so that means that this is only for the numbers. But p is outside the range of allowed scalars which is from 1 to n. I'm just curious to see how all of this works.

You have the curve equation in all cases: "y^2=x^3+b". So, to calculate x-value or y-value, you have that: So, the most basic use case, is just to get a valid point on a curve. You pick x-value, and want to calculate y-value, or the other way around: for a given y-value, you want to get a valid x-value. And that means, when you generate a curve, you want to make those operations "easy". And I wonder, why it is the case in all three other curves, but doesn't work in case of secp224k1 specifically. All point coordinates are in range from 1 to (p-1). And then, private keys are in range from 1 to (n-1), but n-value is calculated later, when you already know p-value.

What do you think can it be used for compute private key for public key I mean can it be used for break Ecdsa?

I think you confused group scalar (k % n) with field values (x % p). For field elements x can be 0, and you get two totally valid points on the curve (as long as there's a valid square root to solve for y). y = 0 would also produce valid points as long as you can compute an x that satisfies the curve equation, and AFAIK this is mathematically impossible if the equation parameters forbid it, e.g no solution for (x1, x2, x3) = cuberoot(y**2 - d) = cuberoot(p - d). Modular sqrt if p % 4 != 3: https://en.wikipedia.org/wiki/Tonelli%E2%80%93Shanks_algorithm Note that the modular square root may not always exist.

If that's the case, then why someone generated some curves, where those operations are fast, and then picked secp224k1, to make it more complex, than the rest? Yes, but when it exists, then it can be usually checked in simple ways, for example by using "(p+1)/4". And when you create a curve, then you can pick any p-value. So, why p-value for secp224k1 was picked in a different way, than in three other curves? It would make much more sense, to use exactly the same algorithm for all four curves, so if that's not the case, then why it was done differently? Edit: Also, I wonder why "b=5" is used for secp224k1, where "b=2" would work as well. If someone started from "b=1", and just incremented it, to find some prime n-value, then why it landed on "b=5", and not "b=2"? Even the same x-value for half of the generator would work in that case!

There are "complex" algorithms: A remark on the computation of cube roots in finite fields One could solve the square and cube root in this case by "simple equation" too. To my knowledge this is not published anywhere. The smallest pair x & y for square root is (p+3)/8; and for cube root is (p+8)/27. r4 and r9 are non-trivial 4th and 9th roots of 1 mod p more info r4 = 11913830147633844989339888812832642491211314989669855304438134084459 r9 = 452128346974922831777605865588626403245808317223927710376180600773 b2 = a (mod p) if a(p-1)/2 = 1    ; if square root exists   b = a(p+3)/8   if b2 != a     b = b * r4 b3 = a (mod p) if a(p-1)/3 = 1    ; if cube root exists   b = a(p+8)/27   if b3 != a     b = b * r9   if b3 != a     b = b * r9