Understanding the Calculation P = A[X1, Y] B[X2,Y]

6 replies 65 views
stackproSenior Member
Posts: 16 · Reputation: 1375
#1Jan 20, 2019, 02:14 PM
Hey everyone. So I've got these values: Px = 80761252842007823267676923098838519533867178259061318285796836088556437370050 Py = 10738555717992617802285220494903845365923729217029449460443518382927240297340 Ax = 93560427823998350675410474831001446736200963751037120112392597322455167739793 Ay = 93848508593538492915520554344759249877309109996279289133143629759880647227979 Bx = 50213163450946219488224773860514757649033909603552708244598159315971281928720 By = 93848508593538492915520554344759249877309109996279289133143629759880647227979 So, A minus B equals P. Both points A and B share the same Y coordinate. For every point P on this curve, we can find a pair of points A and B that satisfy A-B = P. Does this give us some kind of edge when it comes to figuring out the private key? P.S. My English might not be the best.
5 Reply Quote Share
Posts: 135 · Reputation: 83
#2Jan 20, 2019, 06:43 PM
Yes. But just when the only information you have is that the private key is anywhere between 1 and n - 1. In other words: good luck finding the specific pair of points that add up to P (or one of its equivalent endos).
2 Reply Quote Share
stackproSenior Member
Posts: 16 · Reputation: 1375
#3Jan 20, 2019, 07:21 PM
How to calculate the private key for my example?
3 Reply Quote Share
Posts: 135 · Reputation: 83
#4Jan 20, 2019, 09:11 PM
A - B = P A and B have same Y so are related by B = [lambda] * A (or maybe lambda**2, didn't bother to check which one, it can easily be done by comparing the X ratios) So you have [1 - lambda] * A = P To get P's key, you need to know either A's of B's key. To get A's or B's key, you need to know P's key. This is the only "advantage" in the equation you want to solve. If you don't know either key, this property only reduces the discrete log problem complexity accordingly, by a factor of sqrt(6), but only when searching over the entire group order, which is in 256-bit key-space. Hence, only slightly reducing the secp256k1 security to around 125 bits or so. If the key is known to exist inside a known interval, less than 253 bits in size, this property is useless, since the advantage is not useful for interval-DLP solving algorithms (and it just adds overhead).
2 Reply Quote Share
stackproSenior Member
Posts: 16 · Reputation: 1375
#5Jan 20, 2019, 10:38 PM
There are no keys to any point. I can only calculate suitable A and B for any point P
3 Reply Quote Share
Posts: 135 · Reputation: 83
#6Jan 21, 2019, 02:20 AM
Excuse me, but how do you expect to compute a private key of some point, when the only property you have is something that applies to all the points on the curve? You have A, from which you compute -B. Obviously P is their addition. So zero useful information. BTW all three points belong to the same endo class, so their field X Y values are directly derived one from another, without any need of point multiplication: So there's not something to "find" other than the key itself of one of the points, otherwise everything is just running in a circular logic. Nothing to compute. A + B + C = 0 is satisfied for any possible private key and all three points have the same Y. The sum of their X's is also 0. This is basic number theory in action due to the curve equation and the roots of unity.
3 Reply Quote Share
stackproSenior Member
Posts: 16 · Reputation: 1375
#7Jan 22, 2019, 04:01 PM
Thank you for the detailed answer! Initially I have not A, but P, ​​for which I find A and B
2 Reply Quote Share
?Reply
Sign in to reply to this topic

Related topics