Bitcoins uses a specific ECC called secp256k1 you can Google that but to make your life easier the parameters used by the Bitcoin ECC are on page 15 of this document:  http://www.secg.org/collateral/sec2_final.pdf

2.7.1 Recommended Parameters secp256k1

The elliptic curve domain parameters over Fp associated with a Koblitz curve secp256k1 are specified by the sextuple T = (p;a;b;G;n;h) where the finite field Fp is defined by:

p = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F

The curve E: y^2 = x^3+ax+b over Fp is defined by:

a = 0
b = 7

The base point G in compressed form is:

G = 02 79BE667E F9DCBBAC 55A06295 CE870B07 029BFCDB 2DCE28D9 59F2815B 16F81798

and in uncompressed form is:

G = 04 79BE667E F9DCBBAC 55A06295 CE870B07 029BFCDB 2DCE28D9 59F2815B 16F81798 483ADA77 26A3C465 5DA4FBFC 0E1108A8 FD17B448 A6855419 9C47D08F FB10D4B8

Finally the order n of G and the cofactor are:

n = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141
h = 01

Edit:  late nite, tired, stupid math mistake found, total BS deleted.

The math is correct.  If p = the private key, P = the public key and G = the base point of the EC crypto system then P = p(G) where p(G) is the scalar multiplication of p selected from the finite field used to generate the elliptical group with the base point G from the group.

So for any two key pairs: P0/p0 and P1/p1

P0 = p0(G)
P1 = p1(G)
P0 + P1 = p0(G) + p1(G) = (p0 + p1)(G)

So you can take two public keys and apply the defined elliptical group addition and the resulting public key will have the corresponding private key which it the simple modulus addition of the two private keys.

Do you like ketchup/catsup (spelling looks funny) on you underwear?

This is not voodoo it is fairly simple finite field math and group theory.  Check the algebra above.  Do you see any mistakes?

Check out this penny auction:

http://www.mokimarket.com/auction_details/296

Two bidders (or their bots?) went wild.  The "winner" paid $6.61 for a single BTC!

The math is correct.  If p = the private key, P = the public key and G = the base point of the EC crypto system then P = p(G) where p(G) is the scalar multiplication of p selected from the finite field used to generate the elliptical group with the base point G from the group.

So for any two key pairs: P0/p0 and P1/p1

P0 = p0(G)
P1 = p1(G)
P0 + P1 = p0(G) + p1(G) = (p0 + p1)(G)

So you can take two public keys and apply the defined elliptical group addition and the resulting public key will have the corresponding private key which it the simple modulus addition of the two private keys.

But you do bring up a good point.  Even though you no longer have to worry about the private key ever even having been calculated anywhere by anyone, you do have to trust two entities to properly put the two key pairs on to the item and at least one entity to have properly added the two public keys together.

Nice.

Just curious.  Would you trust them more if the bills had two holograms from two different entities/companies where neither company ever had access to the private key?  The person taking off both holograms would be the first person to have all the information needed to calculate the private key.

See this thread for more details:  https://bitcointalk.org/index.php?topic=53177.msg634864#msg634864

Seems pretty simple to me:

1) Make the bar or paper bill with spots for two holograms and a final public key address
2) First party gets the item
3) Put the first private key in mini private key format under the first hologram
4) Put the firstbits of the public key address on the outside of the first hologram
5) Ship the item along with the actual public key to the second party
6) Second party puts the second hologram on the item
7) Second private key in mini private key format under the second hologram
8. Firstbits of the second public key address on the outside of the hologram
9) NOW the second party verifies the public key shipped with the item with the public key address on the first hologram
10) then adds the two public keys together, creating the final public key
11) From the final public key calculate the final public key address
12) This final public key adddress is etched/printed on the item.
13) The BTC funds are transmitted to the final public key address

At this point no one could possibly know the private key since it has never even been calculated.

To redeem:

1) Pull off both stickers
2) Get the two private keys
3) At a web site that supports the two key option, enter both private keys (Mt Gox, StrongCoin, etc. could be talked into supporting this option)
4) The web sites that support this option would then simply add the two private keys together
5) You now have the private key for the combined public key address etched/printed on the item
6) Redeem the BTC from the item

Mt Gox codes are exactly that - a promise of actual BTC.  As long as Mt. Gox keeps exactly the number of BTC on account that they have promised in all of their outstanding unclaimed codes all is well with the world - peace, harmony and love.  However, if people start using the codes themselves as a longer term store of value or worse yet as a medium of exchange then Mt. Gox may be tempted into issuing more codes than they have BTC and the evil dark lord of fractional reserve banking will rise again  !

As consumers we can prevent this by using the Mt. Gox codes for only a short period of time and claiming them as soon as possible.  Also ony accept actual BTC as payment (coins ok as they contain actual BTC) - never accept promises of BTC for payment.

There is already a market for the codes.  You can buy them with credit card payment at http://www.mrcoins.org
 

I strongly suggest that we immediately require that all future T.P.S. reports must be submitted on genuine DUNDER-MIFFLIN paper:

http://www.quill.com/content/iw/adv/2011/12/107/default.aspx?cm_sp=W11_08_125_M1D94V2HP-_-Na-_-Na&web_track_id=128548547&position_id=1&promo_code=99999&lcb=1

For anyone who missed the previous memo – and you know who you are – here is the new cover page for all future T.P.S. reports.

http://www.premiereventslive.com/TPSreport.pdf

I was thinking use this year as the base year and then use one of the x spots to encode the next 58 years, use the second x spot to encode the production week 1-52 mapped onto the base 58 digit.

The entire public address is the "serial number"

Mike is right.  I don't really care about a refund and would rather pay for and have the prototype bills for my collection and to support the project.  There is a lot of great ideas here and it looks like they are converging on a viable product.

I would buy the bills as currently described above for circulation (back to back holograms, laser etched, hole in paper for contact between the holograms, etc.) and I believe others would buy them also.

The last idea of using a vanity address for the denomination is very interesting maybe 1xx001... 1xx005... 1xx010.., 1xx020... 1xx050... 1xx100... where xx is some sort of production code (encoding production year/month or something like that)?

What is the status of this project?  I would like to buy some but the purchase page is still disabled?  Any idea if/when you might be up and running again?

Yes, I am one of the nutjobs that likes collecting Bitcoin physical money and other Bitcoin related items for my future Bitcoin display at the Smithsonian

For example I collected some of Mike's paper wallets that he made before https://www.bitaddress.org basically overtook that business.

Speaking of which:  What the heck ever happened to BitBills at http://bitbills.com    I never was able to order any and the ordering page at http://bitbills.com/order is still disabled.  Are they ever coming back?  I think they had a great idea - embed the private key inside the plastic card so you have to destroy the card to get it out.  Except for the nutty idea of making physical Bitcoin money in the first place - these looked like a pretty good way to go - and I need some for my collection.

But the "price" paid was 11 pencils, not 1.1 dollars.  Also, I assume that if there was another loaf of bread the shop keeper was still selling it for 1 dollar to the next customer.  He has not raised his price in general he just made a swap for 11 pencils instead of 1 dollar.  Are you saying that because of this one trade he will now start selling all future bread for 1.1 dollars?  That does not make any sense to me.

Interesting.  I will give it a try once you open.

See here https://www.casascius.com to buy physical Bitcoins with electronic Bitcoins

See here http://memorydealers.ecomm-search.com/search?catalog=memorydealers&keywords=bitcoins to by physical Bitcoins using a credit card

I own many 1 BTC coins and a few 25 BTC coins.

See here https://bitcointalk.org/index.php?topic=52998.0 for a thread discussing paper Bitcoins under developement.  I bought a few of the "proof of concept" Bitcoin bills but we all expect them to improve (read the entire thread to learn about concerns) before they "hit the market".

I use this wallet application on my phone:  https://bitcointalk.org/index.php?topic=4384.0 Seems to work pretty well but remember it is still buggy so do not too many coins on it as you may lose them.

Here is an example of a project to develop a Bitcoin specific point of sale scanner:  https://bitcointalk.org/index.php?topic=46366.0 don't know the status of the project.

One last thing since it was mentioned above.  I use https://www.strongcoin.com as my online wallet because it appears to be written in a way which is safe as far as private key handling and also it is handy for importing private keys in different formats.  I use it to hold all of my vanity addresses like this one 1BurtWEejbnKeBRsvcydJvsNztB1bXV5iQ (donations accepted and appreciated)

A while back when I dreamed up this same project my idea was to print the public key QR code on one side of a small piece of material and print the private key on the other side.  That way they are physically together, then create a hologram with a window and place the material under the windowed hologram with the public key showing.  This fixes some of the objections but not all.

The hologram MUST be custom or, as has been stated, anyone can make totally empty fakes by just running off multiple copies one of your good bills and then pasting stickers on them.  They don't even need to put a private key of any kind on them - just leave that blank.

Since I just bought one of each of your bills, technically I am set up to be a bad guy.  I just fund them, buy some holograms, and then make many copies of each bill and start passing them off.  Customer checks the public key, shows good, open it up, no private key to be seen.

On my client (may be a bit older than yours) you just click on the address book, then go to your receiving addresses tab, then highlight the address you want to use, then there is a button called "Copy to Clipboard"

Would be nice, but probably not critical to have a very nice custom watermark on the paper...