Bitcoin puzzle transaction ~32 BTC prize to who solves it

[kTimesG]

There’s also a formula for removing the remainder, but it needs to be refined.

If You love mathematics and if You have skills, You can shorten Your suffering and make mathematical proof that it is imposible to separate residue. This is the beauty of eliptic curve multiplication.

BR
Damian

Yes, previously I was told that it’s impossible to obtain even an approximate value of the private key. But as you can see, it turned out to be not the case.

Congratulations for breaking modular arithmetic over prime fields and the discrete log problem. Now, instead of posting about this revolutionary breakthroughs in what has long established itself as the garbage thread of this entire forum (as labeled by the guy who actually solved the 120, 125 and 130 bits DLPs puzzles, with 135 in progress), publish the paper already!

[And24r]

Andr24 wtf? You start to sound like other user....what are you talking about there? If you have formulas why are you stil here with loosers? You are like a little child that say he is the best but he don't want to show....wtf? Grow up!!!
If you come with afirmations, come also with proofs otherwise you just have another theory of conspiration...

The spart guys who have something they stay in shadow, not talk like a child who discover the ice cream.....

You need to know how to talk technical stuff and share if you have something, and others will share to you....so you take info from others, but you keep for you....why anybody else will share to you or confirm anything if you are selfish?

I didn’t say I have formulas for obtaining a private key. But there are interesting formulas and prospects for this. Since you’re so smart, look at what I’m telling you: divide the X‑coordinate of the base point by the X‑coordinate of the public key and extract the square root. You’ll get the private key with a remainder. There’s also a formula for removing the remainder, but it needs to be refined. And once I refine it, we can move on to calculations with the modulus of a prime number and obtain the private key.

And after you've done that you'll still have no advantage to anybody else in finding the private key.

There is an advantage. For example, you can try to study the modulus of a prime number. For instance, 1mod59=1. 1/2mod59=30. 3/2mod59=31. The number 31mod59 is equivalent to 1,5. We need to figure out irrational numbers.

[GinnyBanzz]

Andr24 wtf? You start to sound like other user....what are you talking about there? If you have formulas why are you stil here with loosers? You are like a little child that say he is the best but he don't want to show....wtf? Grow up!!!
If you come with afirmations, come also with proofs otherwise you just have another theory of conspiration...

The spart guys who have something they stay in shadow, not talk like a child who discover the ice cream.....

You need to know how to talk technical stuff and share if you have something, and others will share to you....so you take info from others, but you keep for you....why anybody else will share to you or confirm anything if you are selfish?

I didn’t say I have formulas for obtaining a private key. But there are interesting formulas and prospects for this. Since you’re so smart, look at what I’m telling you: divide the X‑coordinate of the base point by the X‑coordinate of the public key and extract the square root. You’ll get the private key with a remainder. There’s also a formula for removing the remainder, but it needs to be refined. And once I refine it, we can move on to calculations with the modulus of a prime number and obtain the private key.

And after you've done that you'll still have no advantage to anybody else in finding the private key.

There is an advantage. For example, you can try to study the modulus of a prime number. For instance, 1mod59=1. 1/2mod59=30. 3/2mod59=31. The number 31mod59 is equivalent to 1,5. We need to figure out irrational numbers.

Do all of that, and then guess what, you're still no more advntaged than anybody else in finding a private key.

People will waste years of their life thinking they've found flaws, shortcuts or other tricks in ECDSA.

[mjojo]

@And24r

Keep writing your idea here bro, if someone dont like it they just need click ignore to hide your comment. Cheers

[fecell]

shortcuts or other tricks in ECDSA.

It's possible, i'm sure.
John Pollard once proposed a solution in 1978. However, the first cubic equations related to elliptic curves appear in the work "Arithmetic" by the ancient Greek mathematician Diophantus of Alexandria in the 3rd century CE.

It's just that no one has found a solution yet. Maybe we should wait a few centuries? Nobody knows.

Code:

Those who don't want something look for an excuse.
Those who       want something look for an opportunity.

[optioncmdPR]

You know you want to try it 

Code:

from ecdsa.ellipticcurve import CurveFp, Point
from ecdsa.numbertheory import square_root_mod_prime as mod_sqrt
from ecdsa.util import number_to_string


def compress_point(P, p):
    x = P.x()
    y = P.y()
    prefix = 0x02 | (y & 1)  # 0x02 if even, 0x03 if odd
    return bytes([prefix]) + x.to_bytes((x.bit_length()+7)//8, "big")


curves = {
    "secp160k1": {
        "p": 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFAC73,
        "a": 0,
        "b": 7,
        "Gx": 0x3B4C382CE37AA192A4019E763036F4F5DD4D7EBB,
        "Gy": 0x938CF935318FDCED6BC28286531733C3F03C4FEE,
        "n": 0x0100000000000000000001B8FA16DFAB9ACA16B6B3,
    },
    "secp192k1": {
        "p": 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFEE37,
        "a": 0,
        "b": 3,
        "Gx": 0xDB4FF10EC057E9AE26B07D0280B7F4341DA5D1B1EAE06C7D,
        "Gy": 0x9B2F2F6D9C5628A7844163D015BE86344082AA88D95E2F9D,
        "n": 0xFFFFFFFFFFFFFFFFFFFFFFFE26F2FC170F69466A74DEFD8D,
    },
    "secp224k1": {
        "p": 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFE56D,
        "a": 0,
        "b": 5,
        "Gx": 0xA1455B334DF099DF30FC28A169A467E9E47075A90F7E650EB6B7A45C,
        "Gy": 0x7E089FED7FBA344282CAFBD6F7E319F7C0B0BD59E2CA4BDB556D61A5,
        "n": 0x01000000000000000000000000001DCE8D2EC6184CAF0A971769FB1F7,
    },
    "secp256k1": {
        "p": 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F,
        "a": 0,
        "b": 7,
        "Gx": 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798,
        "Gy": 0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8,
        "n": 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141,
    }
}



def compute_pubkey(curve_name, k):
    params = curves[curve_name]

    p = params["p"]
    a = params["a"]
    b = params["b"]
    n = params["n"]

    curve = CurveFp(p, a, b)
    G = Point(curve, params["Gx"], params["Gy"], n)

    P = k * G
    return compress_point(P, p).hex()



if __name__ == "__main__":
    hex_k = input("Enter private key (hex): ").strip()
    k = int(hex_k, 16)

    print("\nCompressed public keys:\n")

    for name in curves:
        cpk = compute_pubkey(name, k)
        print(f"{name}: {cpk}")

[eggsylacer]

But after my geometric research: The points (n/2)·G and (n/2+1)·G have the exact same X coordinate (the one with leading zeros: 00000000...3b78ce563f...) — they differ only in Y parity. This is a (k, n-k) pair.

More interestingly — if you unfold the keys around n/2, you'll see perfect mirror symmetry:
n/2 - 1  ↔  n/2 + 2   (same X, flipped Y)
n/2 - 2  ↔  n/2 + 3
n/2 - 3  ↔  n/2 + 4

There is no (n/2)G point because n = 0 mod n. It is the point at infinity. You probably meant (n-1)/2 and (n+1)/2, e.g. -1/2 and 1/2.

So, after fixing your typo, yes, both 0 and "n/2" are symmetry "checkpoints". Think of them like opposite "inexistent inter-points" on a circle, where the circle points are consecutive points on the curve. It's not so interesting because we already know that 0 == n/2 so the mirror folding is known, as -1/2 + 1 = 1/2. But it is useful for some speed optimizations

The rest of the talk in this page is BS non-sense.

By definition, there are no fractional scalars on an elliptic curve, since a scalar itself has a definition of non-fractional.

[nsfida]

I believe my tool is sufficiently optimized for CPU-based execution. I have developed two separate implementations: a straightforward brute-force approach and a Pollard Kangaroo-based method.

Both tools are designed to run efficiently on standard CPU hardware and demonstrate strong performance in practice. You can review them at the following links:

https://triplem.vip/btcc/faster.html
https://triplem.vip/btcc/pointx.html

[Grzegorz2022]

But after my geometric research: The points (n/2)·G and (n/2+1)·G have the exact same X coordinate (the one with leading zeros: 00000000...3b78ce563f...) — they differ only in Y parity. This is a (k, n-k) pair.

More interestingly — if you unfold the keys around n/2, you'll see perfect mirror symmetry:
n/2 - 1  ↔  n/2 + 2   (same X, flipped Y)
n/2 - 2  ↔  n/2 + 3
n/2 - 3  ↔  n/2 + 4

There is no (n/2)G point because n = 0 mod n. It is the point at infinity. You probably meant (n-1)/2 and (n+1)/2, e.g. -1/2 and 1/2.

So, after fixing your typo, yes, both 0 and "n/2" are symmetry "checkpoints". Think of them like opposite "inexistent inter-points" on a circle, where the circle points are consecutive points on the curve. It's not so interesting because we already know that 0 == n/2 so the mirror folding is known, as -1/2 + 1 = 1/2. But it is useful for some speed optimizations

The rest of the talk in this page is BS non-sense.

By definition, there are no fractional scalars on an elliptic curve, since a scalar itself has a definition of non-fractional.

I have to disagree with the statement that 'fractional scalars do not exist on an elliptic curve.

The order of the secp256k1 group (n) is a prime number:
n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
This means Z/nZ is a field — GF(n). And in a field, EVERY division a/b (where b ≠ 0 mod n) is fully defined.

Examples:
1/2 mod n = 57896044618658097711785492504343953926418782139537452191302581570759080747169
Check: 2 × 578960...169 mod n = 1

1/3 mod n = 77194726158210796949047323339125271901891709519383269588403442094345440996225
Check: 3 × 771947...225 mod n = 1

7/2 mod n = 57896044618658097711785492504343953926418782139537452191302581570759080747172
Check: 2 × 578960...172 mod n = 7

5/7 mod n = 49625181101706940895816136432294817651216098976746387592545069917793497783288
Check: 7 × 496251...288 mod n = 5

Each of these 'fractions' has its own point on the curve with correct (x, y) coordinates.
Proof on the generator point:
(1/2)·G = inv2·G → point with x = 00000000000000000000003b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63
2 × ((1/2)·G) = G

So (1/2)·G exists, is a valid point on the curve, and doubling it gives back G.
The same for any k:
k = 7 (odd, 'not divisible by 2')
(7/2) mod n = 578960...172 (an integer!)
((7/2) mod n)·G = point P
2·P = 7·G

The statement 'there are no fractions' confuses representation with concept. Yes, results are written as integers from [0, n-1]. But the division operation is fully defined because Z/nZ is a field. The correct formulation is: 'scalars are elements of the finite field GF(n), not rational numbers Q' — but in GF(n), division exists and every fraction a/b has a unique value."

[brainless]

But after my geometric research: The points (n/2)·G and (n/2+1)·G have the exact same X coordinate (the one with leading zeros: 00000000...3b78ce563f...) — they differ only in Y parity. This is a (k, n-k) pair.

More interestingly — if you unfold the keys around n/2, you'll see perfect mirror symmetry:
n/2 - 1  ↔  n/2 + 2   (same X, flipped Y)
n/2 - 2  ↔  n/2 + 3
n/2 - 3  ↔  n/2 + 4

There is no (n/2)G point because n = 0 mod n. It is the point at infinity. You probably meant (n-1)/2 and (n+1)/2, e.g. -1/2 and 1/2.

So, after fixing your typo, yes, both 0 and "n/2" are symmetry "checkpoints". Think of them like opposite "inexistent inter-points" on a circle, where the circle points are consecutive points on the curve. It's not so interesting because we already know that 0 == n/2 so the mirror folding is known, as -1/2 + 1 = 1/2. But it is useful for some speed optimizations

The rest of the talk in this page is BS non-sense.

By definition, there are no fractional scalars on an elliptic curve, since a scalar itself has a definition of non-fractional.

I have to disagree with the statement that 'fractional scalars do not exist on an elliptic curve.

The order of the secp256k1 group (n) is a prime number:
n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
This means Z/nZ is a field — GF(n). And in a field, EVERY division a/b (where b ≠ 0 mod n) is fully defined.

Examples:
1/2 mod n = 57896044618658097711785492504343953926418782139537452191302581570759080747169
Check: 2 × 578960...169 mod n = 1

1/3 mod n = 77194726158210796949047323339125271901891709519383269588403442094345440996225
Check: 3 × 771947...225 mod n = 1

7/2 mod n = 57896044618658097711785492504343953926418782139537452191302581570759080747172
Check: 2 × 578960...172 mod n = 7

5/7 mod n = 49625181101706940895816136432294817651216098976746387592545069917793497783288
Check: 7 × 496251...288 mod n = 5

Each of these 'fractions' has its own point on the curve with correct (x, y) coordinates.
Proof on the generator point:
(1/2)·G = inv2·G → point with x = 00000000000000000000003b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63
2 × ((1/2)·G) = G

So (1/2)·G exists, is a valid point on the curve, and doubling it gives back G.
The same for any k:
k = 7 (odd, 'not divisible by 2')
(7/2) mod n = 578960...172 (an integer!)
((7/2) mod n)·G = point P
2·P = 7·G

The statement 'there are no fractions' confuses representation with concept. Yes, results are written as integers from [0, n-1]. But the division operation is fully defined because Z/nZ is a field. The correct formulation is: 'scalars are elements of the finite field GF(n), not rational numbers Q' — but in GF(n), division exists and every fraction a/b has a unique value."

Already fraction point discuss in this thread before 6 years
https://bitcointalk.org/index.php?topic=5244940.msg54606583#msg54606583

[And24r]

But after my geometric research: The points (n/2)·G and (n/2+1)·G have the exact same X coordinate (the one with leading zeros: 00000000...3b78ce563f...) — they differ only in Y parity. This is a (k, n-k) pair.

More interestingly — if you unfold the keys around n/2, you'll see perfect mirror symmetry:
n/2 - 1  ↔  n/2 + 2   (same X, flipped Y)
n/2 - 2  ↔  n/2 + 3
n/2 - 3  ↔  n/2 + 4

There is no (n/2)G point because n = 0 mod n. It is the point at infinity. You probably meant (n-1)/2 and (n+1)/2, e.g. -1/2 and 1/2.

So, after fixing your typo, yes, both 0 and "n/2" are symmetry "checkpoints". Think of them like opposite "inexistent inter-points" on a circle, where the circle points are consecutive points on the curve. It's not so interesting because we already know that 0 == n/2 so the mirror folding is known, as -1/2 + 1 = 1/2. But it is useful for some speed optimizations

The rest of the talk in this page is BS non-sense.

By definition, there are no fractional scalars on an elliptic curve, since a scalar itself has a definition of non-fractional.

I have to disagree with the statement that 'fractional scalars do not exist on an elliptic curve.

The order of the secp256k1 group (n) is a prime number:
n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
This means Z/nZ is a field — GF(n). And in a field, EVERY division a/b (where b ≠ 0 mod n) is fully defined.

Examples:
1/2 mod n = 57896044618658097711785492504343953926418782139537452191302581570759080747169
Check: 2 × 578960...169 mod n = 1

1/3 mod n = 77194726158210796949047323339125271901891709519383269588403442094345440996225
Check: 3 × 771947...225 mod n = 1

7/2 mod n = 57896044618658097711785492504343953926418782139537452191302581570759080747172
Check: 2 × 578960...172 mod n = 7

5/7 mod n = 49625181101706940895816136432294817651216098976746387592545069917793497783288
Check: 7 × 496251...288 mod n = 5

Each of these 'fractions' has its own point on the curve with correct (x, y) coordinates.
Proof on the generator point:
(1/2)·G = inv2·G → point with x = 00000000000000000000003b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63
2 × ((1/2)·G) = G

So (1/2)·G exists, is a valid point on the curve, and doubling it gives back G.
The same for any k:
k = 7 (odd, 'not divisible by 2')
(7/2) mod n = 578960...172 (an integer!)
((7/2) mod n)·G = point P
2·P = 7·G

The statement 'there are no fractions' confuses representation with concept. Yes, results are written as integers from [0, n-1]. But the division operation is fully defined because Z/nZ is a field. The correct formulation is: 'scalars are elements of the finite field GF(n), not rational numbers Q' — but in GF(n), division exists and every fraction a/b has a unique value."

Furthermore, you are likely aware that dividing an odd‑numbered data point by 2 yields a result located in the lower section of the curve’s branch, relative to the generator’s baseline point. In other words, we adopt the assumption that the generator’s base point resides at the upper portion of the curve.

[brainless]

But after my geometric research: The points (n/2)·G and (n/2+1)·G have the exact same X coordinate (the one with leading zeros: 00000000...3b78ce563f...) — they differ only in Y parity. This is a (k, n-k) pair.

More interestingly — if you unfold the keys around n/2, you'll see perfect mirror symmetry:
n/2 - 1  ↔  n/2 + 2   (same X, flipped Y)
n/2 - 2  ↔  n/2 + 3
n/2 - 3  ↔  n/2 + 4

There is no (n/2)G point because n = 0 mod n. It is the point at infinity. You probably meant (n-1)/2 and (n+1)/2, e.g. -1/2 and 1/2.

So, after fixing your typo, yes, both 0 and "n/2" are symmetry "checkpoints". Think of them like opposite "inexistent inter-points" on a circle, where the circle points are consecutive points on the curve. It's not so interesting because we already know that 0 == n/2 so the mirror folding is known, as -1/2 + 1 = 1/2. But it is useful for some speed optimizations

The rest of the talk in this page is BS non-sense.

By definition, there are no fractional scalars on an elliptic curve, since a scalar itself has a definition of non-fractional.

I have to disagree with the statement that 'fractional scalars do not exist on an elliptic curve.

The order of the secp256k1 group (n) is a prime number:
n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
This means Z/nZ is a field — GF(n). And in a field, EVERY division a/b (where b ≠ 0 mod n) is fully defined.

Examples:
1/2 mod n = 57896044618658097711785492504343953926418782139537452191302581570759080747169
Check: 2 × 578960...169 mod n = 1

1/3 mod n = 77194726158210796949047323339125271901891709519383269588403442094345440996225
Check: 3 × 771947...225 mod n = 1

7/2 mod n = 57896044618658097711785492504343953926418782139537452191302581570759080747172
Check: 2 × 578960...172 mod n = 7

5/7 mod n = 49625181101706940895816136432294817651216098976746387592545069917793497783288
Check: 7 × 496251...288 mod n = 5

Each of these 'fractions' has its own point on the curve with correct (x, y) coordinates.
Proof on the generator point:
(1/2)·G = inv2·G → point with x = 00000000000000000000003b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63
2 × ((1/2)·G) = G

So (1/2)·G exists, is a valid point on the curve, and doubling it gives back G.
The same for any k:
k = 7 (odd, 'not divisible by 2')
(7/2) mod n = 578960...172 (an integer!)
((7/2) mod n)·G = point P
2·P = 7·G

The statement 'there are no fractions' confuses representation with concept. Yes, results are written as integers from [0, n-1]. But the division operation is fully defined because Z/nZ is a field. The correct formulation is: 'scalars are elements of the finite field GF(n), not rational numbers Q' — but in GF(n), division exists and every fraction a/b has a unique value."

Furthermore, you are likely aware that dividing an odd‑numbered data point by 2 yields a result located in the lower section of the curve’s branch, relative to the generator’s baseline point. In other words, we adopt the assumption that the generator’s base point resides at the upper portion of the curve.

Maybe correct word is each point have mirror
Odd <-------> even

[Grzegorz2022]

But after my geometric research: The points (n/2)·G and (n/2+1)·G have the exact same X coordinate (the one with leading zeros: 00000000...3b78ce563f...) — they differ only in Y parity. This is a (k, n-k) pair.

More interestingly — if you unfold the keys around n/2, you'll see perfect mirror symmetry:
n/2 - 1  ↔  n/2 + 2   (same X, flipped Y)
n/2 - 2  ↔  n/2 + 3
n/2 - 3  ↔  n/2 + 4

There is no (n/2)G point because n = 0 mod n. It is the point at infinity. You probably meant (n-1)/2 and (n+1)/2, e.g. -1/2 and 1/2.

So, after fixing your typo, yes, both 0 and "n/2" are symmetry "checkpoints". Think of them like opposite "inexistent inter-points" on a circle, where the circle points are consecutive points on the curve. It's not so interesting because we already know that 0 == n/2 so the mirror folding is known, as -1/2 + 1 = 1/2. But it is useful for some speed optimizations

The rest of the talk in this page is BS non-sense.

By definition, there are no fractional scalars on an elliptic curve, since a scalar itself has a definition of non-fractional.

I have to disagree with the statement that 'fractional scalars do not exist on an elliptic curve.

The order of the secp256k1 group (n) is a prime number:
n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
This means Z/nZ is a field — GF(n). And in a field, EVERY division a/b (where b ≠ 0 mod n) is fully defined.

Examples:
1/2 mod n = 57896044618658097711785492504343953926418782139537452191302581570759080747169
Check: 2 × 578960...169 mod n = 1

1/3 mod n = 77194726158210796949047323339125271901891709519383269588403442094345440996225
Check: 3 × 771947...225 mod n = 1

7/2 mod n = 57896044618658097711785492504343953926418782139537452191302581570759080747172
Check: 2 × 578960...172 mod n = 7

5/7 mod n = 49625181101706940895816136432294817651216098976746387592545069917793497783288
Check: 7 × 496251...288 mod n = 5

Each of these 'fractions' has its own point on the curve with correct (x, y) coordinates.
Proof on the generator point:
(1/2)·G = inv2·G → point with x = 00000000000000000000003b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63
2 × ((1/2)·G) = G

So (1/2)·G exists, is a valid point on the curve, and doubling it gives back G.
The same for any k:
k = 7 (odd, 'not divisible by 2')
(7/2) mod n = 578960...172 (an integer!)
((7/2) mod n)·G = point P
2·P = 7·G

The statement 'there are no fractions' confuses representation with concept. Yes, results are written as integers from [0, n-1]. But the division operation is fully defined because Z/nZ is a field. The correct formulation is: 'scalars are elements of the finite field GF(n), not rational numbers Q' — but in GF(n), division exists and every fraction a/b has a unique value."

Furthermore, you are likely aware that dividing an odd‑numbered data point by 2 yields a result located in the lower section of the curve’s branch, relative to the generator’s baseline point. In other words, we adopt the assumption that the generator’s base point resides at the upper portion of the curve.

Yes, I talked about this earlier:
[ k -15 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747153
X:   6286bb9071f8887bc4fbb3f0a9ecb19efcdd2cf15e286da71bb60c9b5ff5e644
Pub: 026286bb9071f8887bc4fbb3f0a9ecb19efcdd2cf15e286da71bb60c9b5ff5e644  -> Adr: 15fS3Hy9oSSnoDHoj9wuVBThXjH5yTyQma
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747184
Pub: 036286bb9071f8887bc4fbb3f0a9ecb19efcdd2cf15e286da71bb60c9b5ff5e644  -> Adr: 1BE8jrkpvVpm1epztSXFRSJ7eYjfMT3TkX
----------------------------------------

[ k -14 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747154
X:   3905682b72282a782b8d8dba72cf147ade0025dca21521e1ea989040c248852b
Pub: 023905682b72282a782b8d8dba72cf147ade0025dca21521e1ea989040c248852b  -> Adr: 13xMdG58VuHFKESWs2wuhXbUXRP2jmGJBL
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747183
Pub: 033905682b72282a782b8d8dba72cf147ade0025dca21521e1ea989040c248852b  -> Adr: 1E77TAEg7VAdUcKLGUWMnwJuY5XqDtXy9Y
----------------------------------------

[ k -13 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747155
X:   561a2ccdca12b67fdad28ee2c3cee78acf8117669e4a2543c81b1ca6eb4bd16e
Pub: 03561a2ccdca12b67fdad28ee2c3cee78acf8117669e4a2543c81b1ca6eb4bd16e  -> Adr: 16mJRZXsiqw7TzVAZLAYeDxtHcDkAR8cbM
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747182
Pub: 02561a2ccdca12b67fdad28ee2c3cee78acf8117669e4a2543c81b1ca6eb4bd16e  -> Adr: 135yPWdDgsB7PtMUdsEAf8jxkv9wesKker
----------------------------------------

[ k -12 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747156
X:   75bdfa066a1a42a750f283e83ec91cc0a5b688296e6aa24a28a61e3365f378e5
Pub: 0375bdfa066a1a42a750f283e83ec91cc0a5b688296e6aa24a28a61e3365f378e5  -> Adr: 1Jh1JmV3RxMPDjgBPEHZHJRzyTQ4ynULkC
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747181
Pub: 0275bdfa066a1a42a750f283e83ec91cc0a5b688296e6aa24a28a61e3365f378e5  -> Adr: 1LZ35k6xrj62kaUxJpG45jFhEKu9Caspw6
----------------------------------------

[ k -11 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747157
X:   e881a840847aa2e22417cd3d3e798c561e6302905dff6bf7754d941998d401e3
Pub: 02e881a840847aa2e22417cd3d3e798c561e6302905dff6bf7754d941998d401e3  -> Adr: 1FewTQmntAiBarXqNCeC7YQfDd26kbsxRN
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747180
Pub: 03e881a840847aa2e22417cd3d3e798c561e6302905dff6bf7754d941998d401e3  -> Adr: 17HemTH2qLRSdTPWw8B1fseBjoZWHGuuNE
----------------------------------------

[ k -10 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747158
X:   1fb527e94e9c70e8657de7458b81ef9ee3c2b4e0128a675bf7e28980e18b201e
Pub: 021fb527e94e9c70e8657de7458b81ef9ee3c2b4e0128a675bf7e28980e18b201e  -> Adr: 131BCaYih8kkF8Er5nzdWkuYSW3Ngmhyqe
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747179
Pub: 031fb527e94e9c70e8657de7458b81ef9ee3c2b4e0128a675bf7e28980e18b201e  -> Adr: 1BmdayqdTekMjor84epMyG9qjkhNnBMpTr
----------------------------------------

[ k -9 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747159
X:   1c2bd878b94169da722a9de0c4e317cea8802aa96045830111a89d1d9de4270c
Pub: 031c2bd878b94169da722a9de0c4e317cea8802aa96045830111a89d1d9de4270c  -> Adr: 17jrgGw1wCK5eexxXVitD2TKsxfCxC8fq7
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747178
Pub: 021c2bd878b94169da722a9de0c4e317cea8802aa96045830111a89d1d9de4270c  -> Adr: 19KKCz4AcXTnqqs1i2DfSzBdbCeKaJNZ8q
----------------------------------------

[ k -8 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747160
X:   41f7fa0a9a59513ae221e3b84b91995fc9d40eb5d120a6d8e663452ad92099c8
Pub: 0241f7fa0a9a59513ae221e3b84b91995fc9d40eb5d120a6d8e663452ad92099c8  -> Adr: 16vVZ7R2q3DLLHX5PW1xA8uYLKV5Vp8zWc
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747177
Pub: 0341f7fa0a9a59513ae221e3b84b91995fc9d40eb5d120a6d8e663452ad92099c8  -> Adr: 1Krnz5cgFehW3jVMaFUVZgY85KvAS6FrNy
----------------------------------------

[ k -7 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747161
X:   e5cbd62789c6a84325a2440789b88dbb1dc55afb9e8296e6bb8af7de57a50e60
Pub: 02e5cbd62789c6a84325a2440789b88dbb1dc55afb9e8296e6bb8af7de57a50e60  -> Adr: 14owJG3qQCU4nXz8esjFiL85dEezjj5kxa
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747176
Pub: 03e5cbd62789c6a84325a2440789b88dbb1dc55afb9e8296e6bb8af7de57a50e60  -> Adr: 1BF2E5wfufEGgiroV1YjtGttRuWYgJ36hR
----------------------------------------

[ k -6 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747162
X:   eb3bc68c623b1f46ab905412c7f2d588fa25abb77a7bd782ba9bb3aac05a70ae
Pub: 02eb3bc68c623b1f46ab905412c7f2d588fa25abb77a7bd782ba9bb3aac05a70ae  -> Adr: 17FNBNmR1FvJvc1jZ88uGsVeWnY8uiscV3
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747175
Pub: 03eb3bc68c623b1f46ab905412c7f2d588fa25abb77a7bd782ba9bb3aac05a70ae  -> Adr: 19FqQtumUjgtwQK5wJvSRvjFvksNuHUE94
----------------------------------------

[ k -5 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747163
X:   5702fb8a2602f41f52699f688d4b005a128762e11dfd13fd22ea751ccbedb2ef
Pub: 035702fb8a2602f41f52699f688d4b005a128762e11dfd13fd22ea751ccbedb2ef  -> Adr: 1JCHSxKTt6orSkg9QHhennEZdybz2zSEbD
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747174
Pub: 025702fb8a2602f41f52699f688d4b005a128762e11dfd13fd22ea751ccbedb2ef  -> Adr: 1AXP4CRCPVA2KmfCJwCX2Taw6kmtZZbdkM
----------------------------------------

[ k -4 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747164
X:   66954eca0543426304036fc70fc0fe3381f5195e88433bc32c5a8a60341e2859
Pub: 0266954eca0543426304036fc70fc0fe3381f5195e88433bc32c5a8a60341e2859  -> Adr: 1Eepuc2uUoPfSRCUFHiuX5wtPt1hU8xdEd
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747173
Pub: 0366954eca0543426304036fc70fc0fe3381f5195e88433bc32c5a8a60341e2859  -> Adr: 18nHHZTwsNQwRFozvMjkUV7d8BwEPBpDft
----------------------------------------

[ k -3 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747165
X:   592152c398d6c719636a03a6dad64246a5a6814aa62c156b0ce5332f6759b031
Pub: 02592152c398d6c719636a03a6dad64246a5a6814aa62c156b0ce5332f6759b031  -> Adr: 1MiZBmHMMCmRSqmD5K1MwNgs2EEnm3Am1H
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747172
Pub: 03592152c398d6c719636a03a6dad64246a5a6814aa62c156b0ce5332f6759b031  -> Adr: 18kSSgqXCr43XgesM2aFnDdebevBu4hXYn
----------------------------------------

[ k -2 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747166
X:   5699b93fc6e1bd29e09a328d657a607b4155b61a6b5fcbedd7c12df7c67df8f5
Pub: 025699b93fc6e1bd29e09a328d657a607b4155b61a6b5fcbedd7c12df7c67df8f5  -> Adr: 12NqA1nEZw2w2o2BrkmymQHDTMgcxBSH6w
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747171
Pub: 035699b93fc6e1bd29e09a328d657a607b4155b61a6b5fcbedd7c12df7c67df8f5  -> Adr: 1LtmtRzYDJLEw6cjoD8AxqzAsL4NEBvRab
----------------------------------------

[ k -1 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747167
X:   c62c910e502cb615a27c58512b6cc2c94f5742f76cb3d12ec993400a3695d413
Pub: 03c62c910e502cb615a27c58512b6cc2c94f5742f76cb3d12ec993400a3695d413  -> Adr: 1AsPTrDFPaz6uYyuNgnmnrt8mEkfjYFmYq
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747170
Pub: 02c62c910e502cb615a27c58512b6cc2c94f5742f76cb3d12ec993400a3695d413  -> Adr: 134yamsYAgAyWVr7z4KjH6h52UigkEnrL5
----------------------------------------

[ k +0 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747168
X:   00000000000000000000003b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63
Pub: 0300000000000000000000003b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63  -> Adr: 1LVAsnUyEtJgZ9HzLfbtiJZuZMzHLX1n6k
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747169
Pub: 0200000000000000000000003b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63  -> Adr: 13see6qjfupx1YWgRefwEkccZeM8QGTAiJ
----------------------------------------

[ k +1 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747169
X:   00000000000000000000003b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63
Pub: 0200000000000000000000003b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63  -> Adr: 13see6qjfupx1YWgRefwEkccZeM8QGTAiJ
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747168
Pub: 0300000000000000000000003b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63  -> Adr: 1LVAsnUyEtJgZ9HzLfbtiJZuZMzHLX1n6k
----------------------------------------

[ k +2 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747170
X:   c62c910e502cb615a27c58512b6cc2c94f5742f76cb3d12ec993400a3695d413
Pub: 02c62c910e502cb615a27c58512b6cc2c94f5742f76cb3d12ec993400a3695d413  -> Adr: 134yamsYAgAyWVr7z4KjH6h52UigkEnrL5
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747167
Pub: 03c62c910e502cb615a27c58512b6cc2c94f5742f76cb3d12ec993400a3695d413  -> Adr: 1AsPTrDFPaz6uYyuNgnmnrt8mEkfjYFmYq
----------------------------------------

[ k +3 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747171
X:   5699b93fc6e1bd29e09a328d657a607b4155b61a6b5fcbedd7c12df7c67df8f5
Pub: 035699b93fc6e1bd29e09a328d657a607b4155b61a6b5fcbedd7c12df7c67df8f5  -> Adr: 1LtmtRzYDJLEw6cjoD8AxqzAsL4NEBvRab
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747166
Pub: 025699b93fc6e1bd29e09a328d657a607b4155b61a6b5fcbedd7c12df7c67df8f5  -> Adr: 12NqA1nEZw2w2o2BrkmymQHDTMgcxBSH6w
----------------------------------------

[ k +4 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747172
X:   592152c398d6c719636a03a6dad64246a5a6814aa62c156b0ce5332f6759b031
Pub: 03592152c398d6c719636a03a6dad64246a5a6814aa62c156b0ce5332f6759b031  -> Adr: 18kSSgqXCr43XgesM2aFnDdebevBu4hXYn
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747165
Pub: 02592152c398d6c719636a03a6dad64246a5a6814aa62c156b0ce5332f6759b031  -> Adr: 1MiZBmHMMCmRSqmD5K1MwNgs2EEnm3Am1H
----------------------------------------

[ k +5 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747173
X:   66954eca0543426304036fc70fc0fe3381f5195e88433bc32c5a8a60341e2859
Pub: 0366954eca0543426304036fc70fc0fe3381f5195e88433bc32c5a8a60341e2859  -> Adr: 18nHHZTwsNQwRFozvMjkUV7d8BwEPBpDft
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747164
Pub: 0266954eca0543426304036fc70fc0fe3381f5195e88433bc32c5a8a60341e2859  -> Adr: 1Eepuc2uUoPfSRCUFHiuX5wtPt1hU8xdEd
----------------------------------------

[ k +6 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747174
X:   5702fb8a2602f41f52699f688d4b005a128762e11dfd13fd22ea751ccbedb2ef
Pub: 025702fb8a2602f41f52699f688d4b005a128762e11dfd13fd22ea751ccbedb2ef  -> Adr: 1AXP4CRCPVA2KmfCJwCX2Taw6kmtZZbdkM
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747163
Pub: 035702fb8a2602f41f52699f688d4b005a128762e11dfd13fd22ea751ccbedb2ef  -> Adr: 1JCHSxKTt6orSkg9QHhennEZdybz2zSEbD
----------------------------------------

[ k +7 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747175
X:   eb3bc68c623b1f46ab905412c7f2d588fa25abb77a7bd782ba9bb3aac05a70ae
Pub: 03eb3bc68c623b1f46ab905412c7f2d588fa25abb77a7bd782ba9bb3aac05a70ae  -> Adr: 19FqQtumUjgtwQK5wJvSRvjFvksNuHUE94
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747162
Pub: 02eb3bc68c623b1f46ab905412c7f2d588fa25abb77a7bd782ba9bb3aac05a70ae  -> Adr: 17FNBNmR1FvJvc1jZ88uGsVeWnY8uiscV3
----------------------------------------

[ k +8 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747176
X:   e5cbd62789c6a84325a2440789b88dbb1dc55afb9e8296e6bb8af7de57a50e60
Pub: 03e5cbd62789c6a84325a2440789b88dbb1dc55afb9e8296e6bb8af7de57a50e60  -> Adr: 1BF2E5wfufEGgiroV1YjtGttRuWYgJ36hR
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747161
Pub: 02e5cbd62789c6a84325a2440789b88dbb1dc55afb9e8296e6bb8af7de57a50e60  -> Adr: 14owJG3qQCU4nXz8esjFiL85dEezjj5kxa
----------------------------------------

[ k +9 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747177
X:   41f7fa0a9a59513ae221e3b84b91995fc9d40eb5d120a6d8e663452ad92099c8
Pub: 0341f7fa0a9a59513ae221e3b84b91995fc9d40eb5d120a6d8e663452ad92099c8  -> Adr: 1Krnz5cgFehW3jVMaFUVZgY85KvAS6FrNy
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747160
Pub: 0241f7fa0a9a59513ae221e3b84b91995fc9d40eb5d120a6d8e663452ad92099c8  -> Adr: 16vVZ7R2q3DLLHX5PW1xA8uYLKV5Vp8zWc
----------------------------------------

[ k +10 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747178
X:   1c2bd878b94169da722a9de0c4e317cea8802aa96045830111a89d1d9de4270c
Pub: 021c2bd878b94169da722a9de0c4e317cea8802aa96045830111a89d1d9de4270c  -> Adr: 19KKCz4AcXTnqqs1i2DfSzBdbCeKaJNZ8q
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747159
Pub: 031c2bd878b94169da722a9de0c4e317cea8802aa96045830111a89d1d9de4270c  -> Adr: 17jrgGw1wCK5eexxXVitD2TKsxfCxC8fq7
----------------------------------------

[ k +11 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747179
X:   1fb527e94e9c70e8657de7458b81ef9ee3c2b4e0128a675bf7e28980e18b201e
Pub: 031fb527e94e9c70e8657de7458b81ef9ee3c2b4e0128a675bf7e28980e18b201e  -> Adr: 1BmdayqdTekMjor84epMyG9qjkhNnBMpTr
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747158
Pub: 021fb527e94e9c70e8657de7458b81ef9ee3c2b4e0128a675bf7e28980e18b201e  -> Adr: 131BCaYih8kkF8Er5nzdWkuYSW3Ngmhyqe
----------------------------------------

[ k +12 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747180
X:   e881a840847aa2e22417cd3d3e798c561e6302905dff6bf7754d941998d401e3
Pub: 03e881a840847aa2e22417cd3d3e798c561e6302905dff6bf7754d941998d401e3  -> Adr: 17HemTH2qLRSdTPWw8B1fseBjoZWHGuuNE
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747157
Pub: 02e881a840847aa2e22417cd3d3e798c561e6302905dff6bf7754d941998d401e3  -> Adr: 1FewTQmntAiBarXqNCeC7YQfDd26kbsxRN
----------------------------------------

[ k +13 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747181
X:   75bdfa066a1a42a750f283e83ec91cc0a5b688296e6aa24a28a61e3365f378e5
Pub: 0275bdfa066a1a42a750f283e83ec91cc0a5b688296e6aa24a28a61e3365f378e5  -> Adr: 1LZ35k6xrj62kaUxJpG45jFhEKu9Caspw6
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747156
Pub: 0375bdfa066a1a42a750f283e83ec91cc0a5b688296e6aa24a28a61e3365f378e5  -> Adr: 1Jh1JmV3RxMPDjgBPEHZHJRzyTQ4ynULkC
----------------------------------------

[ k +14 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747182
X:   561a2ccdca12b67fdad28ee2c3cee78acf8117669e4a2543c81b1ca6eb4bd16e
Pub: 02561a2ccdca12b67fdad28ee2c3cee78acf8117669e4a2543c81b1ca6eb4bd16e  -> Adr: 135yPWdDgsB7PtMUdsEAf8jxkv9wesKker
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747155
Pub: 03561a2ccdca12b67fdad28ee2c3cee78acf8117669e4a2543c81b1ca6eb4bd16e  -> Adr: 16mJRZXsiqw7TzVAZLAYeDxtHcDkAR8cbM
----------------------------------------

[ k +15 ]
k:   57896044618658097711785492504343953926418782139537452191302581570759080747183
X:   3905682b72282a782b8d8dba72cf147ade0025dca21521e1ea989040c248852b
Pub: 033905682b72282a782b8d8dba72cf147ade0025dca21521e1ea989040c248852b  -> Adr: 1E77TAEg7VAdUcKLGUWMnwJuY5XqDtXy9Y
n-k: 57896044618658097711785492504343953926418782139537452191302581570759080747154
Pub: 023905682b72282a782b8d8dba72cf147ade0025dca21521e1ea989040c248852b  -> Adr: 13xMdG58VuHFKESWs2wuhXbUXRP2jmGJBL
----------------------------------------

[And24r]

But after my geometric research: The points (n/2)·G and (n/2+1)·G have the exact same X coordinate (the one with leading zeros: 00000000...3b78ce563f...) — they differ only in Y parity. This is a (k, n-k) pair.

More interestingly — if you unfold the keys around n/2, you'll see perfect mirror symmetry:
n/2 - 1  ↔  n/2 + 2   (same X, flipped Y)
n/2 - 2  ↔  n/2 + 3
n/2 - 3  ↔  n/2 + 4

There is no (n/2)G point because n = 0 mod n. It is the point at infinity. You probably meant (n-1)/2 and (n+1)/2, e.g. -1/2 and 1/2.

So, after fixing your typo, yes, both 0 and "n/2" are symmetry "checkpoints". Think of them like opposite "inexistent inter-points" on a circle, where the circle points are consecutive points on the curve. It's not so interesting because we already know that 0 == n/2 so the mirror folding is known, as -1/2 + 1 = 1/2. But it is useful for some speed optimizations

The rest of the talk in this page is BS non-sense.

By definition, there are no fractional scalars on an elliptic curve, since a scalar itself has a definition of non-fractional.

I have to disagree with the statement that 'fractional scalars do not exist on an elliptic curve.

The order of the secp256k1 group (n) is a prime number:
n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
This means Z/nZ is a field — GF(n). And in a field, EVERY division a/b (where b ≠ 0 mod n) is fully defined.

Examples:
1/2 mod n = 57896044618658097711785492504343953926418782139537452191302581570759080747169
Check: 2 × 578960...169 mod n = 1

1/3 mod n = 77194726158210796949047323339125271901891709519383269588403442094345440996225
Check: 3 × 771947...225 mod n = 1

7/2 mod n = 57896044618658097711785492504343953926418782139537452191302581570759080747172
Check: 2 × 578960...172 mod n = 7

5/7 mod n = 49625181101706940895816136432294817651216098976746387592545069917793497783288
Check: 7 × 496251...288 mod n = 5

Each of these 'fractions' has its own point on the curve with correct (x, y) coordinates.
Proof on the generator point:
(1/2)·G = inv2·G → point with x = 00000000000000000000003b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63
2 × ((1/2)·G) = G

So (1/2)·G exists, is a valid point on the curve, and doubling it gives back G.
The same for any k:
k = 7 (odd, 'not divisible by 2')
(7/2) mod n = 578960...172 (an integer!)
((7/2) mod n)·G = point P
2·P = 7·G

The statement 'there are no fractions' confuses representation with concept. Yes, results are written as integers from [0, n-1]. But the division operation is fully defined because Z/nZ is a field. The correct formulation is: 'scalars are elements of the finite field GF(n), not rational numbers Q' — but in GF(n), division exists and every fraction a/b has a unique value."

Already fraction point discuss in this thread before 6 years
https://bitcointalk.org/index.php?topic=5244940.msg54606583#msg54606583

Thanks, I'll check it out.

Grzegorz2022.
What do you think — is there a way to figure out whether a point is on the lower or upper branch of the curve, given that the generator point is on the upper branch?

[Grzegorz2022]

But after my geometric research: The points (n/2)·G and (n/2+1)·G have the exact same X coordinate (the one with leading zeros: 00000000...3b78ce563f...) — they differ only in Y parity. This is a (k, n-k) pair.

More interestingly — if you unfold the keys around n/2, you'll see perfect mirror symmetry:
n/2 - 1  ↔  n/2 + 2   (same X, flipped Y)
n/2 - 2  ↔  n/2 + 3
n/2 - 3  ↔  n/2 + 4

There is no (n/2)G point because n = 0 mod n. It is the point at infinity. You probably meant (n-1)/2 and (n+1)/2, e.g. -1/2 and 1/2.

So, after fixing your typo, yes, both 0 and "n/2" are symmetry "checkpoints". Think of them like opposite "inexistent inter-points" on a circle, where the circle points are consecutive points on the curve. It's not so interesting because we already know that 0 == n/2 so the mirror folding is known, as -1/2 + 1 = 1/2. But it is useful for some speed optimizations

The rest of the talk in this page is BS non-sense.

By definition, there are no fractional scalars on an elliptic curve, since a scalar itself has a definition of non-fractional.

I have to disagree with the statement that 'fractional scalars do not exist on an elliptic curve.

The order of the secp256k1 group (n) is a prime number:
n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
This means Z/nZ is a field — GF(n). And in a field, EVERY division a/b (where b ≠ 0 mod n) is fully defined.

Examples:
1/2 mod n = 57896044618658097711785492504343953926418782139537452191302581570759080747169
Check: 2 × 578960...169 mod n = 1

1/3 mod n = 77194726158210796949047323339125271901891709519383269588403442094345440996225
Check: 3 × 771947...225 mod n = 1

7/2 mod n = 57896044618658097711785492504343953926418782139537452191302581570759080747172
Check: 2 × 578960...172 mod n = 7

5/7 mod n = 49625181101706940895816136432294817651216098976746387592545069917793497783288
Check: 7 × 496251...288 mod n = 5

Each of these 'fractions' has its own point on the curve with correct (x, y) coordinates.
Proof on the generator point:
(1/2)·G = inv2·G → point with x = 00000000000000000000003b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63
2 × ((1/2)·G) = G

So (1/2)·G exists, is a valid point on the curve, and doubling it gives back G.
The same for any k:
k = 7 (odd, 'not divisible by 2')
(7/2) mod n = 578960...172 (an integer!)
((7/2) mod n)·G = point P
2·P = 7·G

The statement 'there are no fractions' confuses representation with concept. Yes, results are written as integers from [0, n-1]. But the division operation is fully defined because Z/nZ is a field. The correct formulation is: 'scalars are elements of the finite field GF(n), not rational numbers Q' — but in GF(n), division exists and every fraction a/b has a unique value."

Already fraction point discuss in this thread before 6 years
https://bitcointalk.org/index.php?topic=5244940.msg54606583#msg54606583

Thanks, I'll check it out.

Grzegorz2022.
What do you think — is there a way to figure out whether a point is on the lower or upper branch of the curve, given that the generator point is on the upper branch?

There is a way to get a point in the lower half negation (just flip y, it's free). Given any point P (with scalar k), its negation -P has scalar n-k. One of them is always in the lower half, the other in the upper half. The problem is: you don't know WHICH one is in which half without knowing k. If someone could determine the parity of k from the public key alone, they could iteratively halve the scalar 256 times and recover the full private key breaking ECDLP entirely. This is exactly why this remains an open problem.
And this is where the modular wrap-around destroys information:
In normal math:
  6 / 2 = 3 (integer → you see it's even)
  7 / 2 = 3.5 (fraction → you see it's odd)
On the curve (mod n):
  6 × inv2 mod n = 3 (small, no wrap)
  7 × inv2 mod n = 578960...172 (256 bit! wrapped around n)
A small odd number like k=7 produces a 256-bit result after halving, identical in size to what a huge number like k=n-3 would produce. The wrap around mod n destroys all information about size, parity, and position of the original scalar.
This is exactly why ECDLP is hard modular arithmetic wraps the numbers and hides their structure.

[And24r]

But after my geometric research: The points (n/2)·G and (n/2+1)·G have the exact same X coordinate (the one with leading zeros: 00000000...3b78ce563f...) — they differ only in Y parity. This is a (k, n-k) pair.

More interestingly — if you unfold the keys around n/2, you'll see perfect mirror symmetry:
n/2 - 1  ↔  n/2 + 2   (same X, flipped Y)
n/2 - 2  ↔  n/2 + 3
n/2 - 3  ↔  n/2 + 4

There is no (n/2)G point because n = 0 mod n. It is the point at infinity. You probably meant (n-1)/2 and (n+1)/2, e.g. -1/2 and 1/2.

So, after fixing your typo, yes, both 0 and "n/2" are symmetry "checkpoints". Think of them like opposite "inexistent inter-points" on a circle, where the circle points are consecutive points on the curve. It's not so interesting because we already know that 0 == n/2 so the mirror folding is known, as -1/2 + 1 = 1/2. But it is useful for some speed optimizations

The rest of the talk in this page is BS non-sense.

By definition, there are no fractional scalars on an elliptic curve, since a scalar itself has a definition of non-fractional.

I have to disagree with the statement that 'fractional scalars do not exist on an elliptic curve.

The order of the secp256k1 group (n) is a prime number:
n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
This means Z/nZ is a field — GF(n). And in a field, EVERY division a/b (where b ≠ 0 mod n) is fully defined.

Examples:
1/2 mod n = 57896044618658097711785492504343953926418782139537452191302581570759080747169
Check: 2 × 578960...169 mod n = 1

1/3 mod n = 77194726158210796949047323339125271901891709519383269588403442094345440996225
Check: 3 × 771947...225 mod n = 1

7/2 mod n = 57896044618658097711785492504343953926418782139537452191302581570759080747172
Check: 2 × 578960...172 mod n = 7

5/7 mod n = 49625181101706940895816136432294817651216098976746387592545069917793497783288
Check: 7 × 496251...288 mod n = 5

Each of these 'fractions' has its own point on the curve with correct (x, y) coordinates.
Proof on the generator point:
(1/2)·G = inv2·G → point with x = 00000000000000000000003b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63
2 × ((1/2)·G) = G

So (1/2)·G exists, is a valid point on the curve, and doubling it gives back G.
The same for any k:
k = 7 (odd, 'not divisible by 2')
(7/2) mod n = 578960...172 (an integer!)
((7/2) mod n)·G = point P
2·P = 7·G

The statement 'there are no fractions' confuses representation with concept. Yes, results are written as integers from [0, n-1]. But the division operation is fully defined because Z/nZ is a field. The correct formulation is: 'scalars are elements of the finite field GF(n), not rational numbers Q' — but in GF(n), division exists and every fraction a/b has a unique value."

Already fraction point discuss in this thread before 6 years
https://bitcointalk.org/index.php?topic=5244940.msg54606583#msg54606583

Thanks, I'll check it out.

Grzegorz2022.
What do you think — is there a way to figure out whether a point is on the lower or upper branch of the curve, given that the generator point is on the upper branch?

There is a way to get a point in the lower half negation (just flip y, it's free). Given any point P (with scalar k), its negation -P has scalar n-k. One of them is always in the lower half, the other in the upper half. The problem is: you don't know WHICH one is in which half without knowing k. If someone could determine the parity of k from the public key alone, they could iteratively halve the scalar 256 times and recover the full private key breaking ECDLP entirely. This is exactly why this remains an open problem.
And this is where the modular wrap-around destroys information:
In normal math:
  6 / 2 = 3 (integer → you see it's even)
  7 / 2 = 3.5 (fraction → you see it's odd)
On the curve (mod n):
  6 × inv2 mod n = 3 (small, no wrap)
  7 × inv2 mod n = 578960...172 (256 bit! wrapped around n)
A small odd number like k=7 produces a 256-bit result after halving, identical in size to what a huge number like k=n-3 would produce. The wrap around mod n destroys all information about size, parity, and position of the original scalar.
This is exactly why ECDLP is hard modular arithmetic wraps the numbers and hides their structure.

I’ll say more. The problem is that there are two square roots in modular arithmetic. That’s exactly why it’s impossible to determine which half‑plane the point is in. If there were only one square root, it would be possible to derive the y‑coordinate from the x‑coordinate and determine where the point on the curve is located.


It’s also interesting that if you multiply a point by 2, the half‑plane doesn’t change if the private key is not large or vice versa, it’s located almost at the end  There might be a mathematical formula that doesn’t multiply the point by 2 but instead shifts it by the first generator point in only one direction — closer to the point y=0 (although such a point doesn’t exist), regardless of the half‑plane.

In other words, we move only along the x‑coordinate, regardless of the y‑coordinate. This is exactly what the point doubling formula does. I hope you understand me.

[eggsylacer]

I also learned that, as it turns out, you can do some fun things with the curve y^2=x^3. For example, you can multiply a point by any rational number, or divide a point. You can square it or raise it to any power. Moreover, if you square a point, the y‑coordinate always ends up “positive”, in the upper half‑plane. You can even multiply a point by another point. There are specific formulas for that.

Raise this point 03b8c7b22d914381cb7175574ea7fb81a13d63c6e9e7d570fd8f486b9c6ac7c1ac to (1/2) power. Point(03b8c7b22d914381cb7175574ea7fb81a13d63c6e9e7d570fd8f486b9c6ac7c1ac)^(1/2) = ?

[And24r]

I also learned that, as it turns out, you can do some fun things with the curve y^2=x^3. For example, you can multiply a point by any rational number, or divide a point. You can square it or raise it to any power. Moreover, if you square a point, the y‑coordinate always ends up “positive”, in the upper half‑plane. You can even multiply a point by another point. There are specific formulas for that.

Raise this point 03b8c7b22d914381cb7175574ea7fb81a13d63c6e9e7d570fd8f486b9c6ac7c1ac to (1/2) power. Point(03b8c7b22d914381cb7175574ea7fb81a13d63c6e9e7d570fd8f486b9c6ac7c1ac)^(1/2) = ?

This point belongs to the elliptic curve y^2=x^3?

[And24r]

If this point relates to modular arithmetic, then it needs to be calculated. In general, the formula for squaring or raising to another power is as follows: divide the x‑coordinate of the base point by the x‑coordinate of any point on the curve, then raise the result to the power of two (or another power), and then divide the x‑coordinate of the base point by the resulting value after exponentiation. For the y‑coordinate, the process is similar — just replace x with y.

[eggsylacer]

If this point relates to modular arithmetic, then it needs to be calculated. In general, the formula for squaring or raising to another power is as follows: divide the x‑coordinate of the base point by the x‑coordinate of any point on the curve, then raise the result to the power of two (or another power), and then divide the x‑coordinate of the base point by the resulting value after exponentiation. For the y‑coordinate, the process is similar — just replace x with y.

Let's assume that this will work for the curve used in bitcoin. How will you perform such operations modulo P?