Half of any bitcoin (crypto) public key - (public key half)

[archyone]

In secp256k1 there are two important primes - the prime p which is used for coordinates x and y (2^256 - 2^32 - 977), and the prime n, which is the group order (2^256 - 432420386565659656852420866394968145599).

The group is defined by two operations - addition of two points, and doubling a point.

From this we easily could multiply a point by scalar, this is series of additions and doublings.

Multiplying a point by scalar gives another point. Multiplying a point by n gives the point at infinity (0,0).

Dividing by 2 in a group with order n is equivalent to multiplying by the scalar 1/2 (mod n).

One can find the inverse of 2 modulo n by the Extended Euclidean Algorithm.
1/2 (mod n) = 57896044618658097711785492504343953926418782139537452191302581570759080747169

You'd have to multiply (x,y) by 1/2 (mod n), this gives
x = 21505829891763648114329055987619236494102133314575206970830385799158076338148
y = 98003708678762621233683240503080860129026887322874138805529884920309963580118

How I just reread your post and I understand that you manage to do it ?
So my question is simple, how multiply a point (x,y) by 1/2 (mod n) ? I can't get a working méthod with python

Assume i have this public key (x = 72488970228380509287422715226575535698893157273063074627791787432852706183111 , y = 2898698443831883535403436258712770888294397026493185421712108624767191)
what is the math méthod to multiply (x,y) by 1/2 (mod n) --> it is also assumed that I do not know the private key
How get (x = 21505829891763648114329055987619236494102133314575206970830385799158076338148 , y = 98003708678762621233683240503080860129026887322874138805529884920309963580118)

 

[j2002ba2]

In secp256k1 there are two important primes - the prime p which is used for coordinates x and y (2^256 - 2^32 - 977), and the prime n, which is the group order (2^256 - 432420386565659656852420866394968145599).

The group is defined by two operations - addition of two points, and doubling a point.

From this we easily could multiply a point by scalar, this is series of additions and doublings.

Multiplying a point by scalar gives another point. Multiplying a point by n gives the point at infinity (0,0).

Dividing by 2 in a group with order n is equivalent to multiplying by the scalar 1/2 (mod n).

One can find the inverse of 2 modulo n by the Extended Euclidean Algorithm.
1/2 (mod n) = 57896044618658097711785492504343953926418782139537452191302581570759080747169

You'd have to multiply (x,y) by 1/2 (mod n), this gives
x = 21505829891763648114329055987619236494102133314575206970830385799158076338148
y = 98003708678762621233683240503080860129026887322874138805529884920309963580118

How I just reread your post and I understand that you manage to do it ?
So my question is simple, how multiply a point (x,y) by 1/2 (mod n) ? I can't get a working méthod with python

Assume i have this public key (x = 72488970228380509287422715226575535698893157273063074627791787432852706183111 , y = 2898698443831883535403436258712770888294397026493185421712108624767191)
what is the math méthod to multiply (x,y) by 1/2 (mod n) --> it is also assumed that I do not know the private key
How get (x = 21505829891763648114329055987619236494102133314575206970830385799158076338148 , y = 98003708678762621233683240503080860129026887322874138805529884920309963580118)

 

Multiply by 57896044618658097711785492504343953926418782139537452191302581570759080747169


Let the point you want to multiply is G, and the multiplication constant is c. The result will be P=c*G

One way to do it is:

1. Start with the point at infinity P = (0,0) = 0*G, Q = G = 1*G, d = c

2. if d is zero return P

3. If d is odd let P = P + Q

4. Double Q: Q = 2*Q, halve d rounding towards zero: d = floor(d/2)

5. Go to step 2

[archyone]

Multiply by 57896044618658097711785492504343953926418782139537452191302581570759080747169


Let the point you want to multiply is G, and the multiplication constant is c. The result will be P=c*G

One way to do it is:

1. Start with the point at infinity P = (0,0) = 0*G, Q = G = 1*G, d = c

2. if d is zero return P

3. If d is odd let P = P + Q

4. Double Q: Q = 2*Q, halve d rounding towards zero: d = floor(d/2)

5. Go to step 2

I'm sorry but i don't understand, can you give me an example  
I do not have the necessary bases in mathematics and you lost me with "constant is c" & d
ideally a small python script would be welcome but I'm certainly asking too much

Signed: the noob ^^

[pooya87]

I'm sorry but i don't understand, can you give me an example 
I do not have the necessary bases in mathematics and you lost me with "constant is c" & d
ideally a small python script would be welcome but I'm certainly asking too much

Signed: the noob ^^

this topic is already filled with many examples!
i think you should start at the basics and read what Elliptic Curve Cryptography and Modular Arithmetic are before trying to come up with the code that computes half of a public key!
start here: https://en.wikipedia.org/wiki/Modular_arithmetic
then:
https://blog.cloudflare.com/a-relatively-easy-to-understand-primer-on-elliptic-curve-cryptography/
https://en.wikipedia.org/wiki/Elliptic-curve_cryptography
and finally
https://en.wikipedia.org/wiki/Elliptic_curve_point_multiplication
https://en.wikipedia.org/wiki/Modular_multiplicative_inverse

[archyone]

this topic is already filled with many examples!
i think you should start at the basics and read what Elliptic Curve Cryptography and Modular Arithmetic are before trying to come up with the code that computes half of a public key!
start here: https://en.wikipedia.org/wiki/Modular_arithmetic
then:
https://blog.cloudflare.com/a-relatively-easy-to-understand-primer-on-elliptic-curve-cryptography/
https://en.wikipedia.org/wiki/Elliptic-curve_cryptography
and finally
https://en.wikipedia.org/wiki/Elliptic_curve_point_multiplication
https://en.wikipedia.org/wiki/Modular_multiplicative_inverse

Thanks for the links, I have a bit of a headache but now I have the basics to understand.
Well, I now know how to divide a point by 2 as in my example (private key 10). On the other hand, I realize after several tests that if the point to be divided corresponds to an odd private key, the result no longer corresponds to what I expected. As long as the private key is divisible by 2, the calculations seem to respect a certain logic but since the division does not give a whole number (without comma), this "rule" is shattered ^^.
Can someone explain to me this part:
3. If d is odd let P = P + Q
4. Double Q: Q = 2 * Q, halve d rounding towards zero: d = floor (d / 2)

I don't quite understand the logic yet.
The floor () method returns the floor of x i.e. the largest integer not greater than x. With bitcoin is this the rule to apply, why not the other way around? (the smallest integer)?

Thanks in advance

[bigvito19]

Is there a code or script to do the math?

[pooya87]

Is there a code or script to do the math?

any cryptography library that supports elliptic curve cryptography should have the math, may not be a public member in some cases since these are internals of calculation. depending on the language you want there are a bunch of them for example python-ecdsa is a python library that has all of this.

[archyone]

Is there a code or script to do the math?

It's easier than you might think. In fact, you can use any library that allows you to calculate the public key from a private key and replace the parameters:

# Elliptic curve parameters (secp256k1)

P = 2**256 - 2**32 - 977
N = 115792089237316195423570985008687907852837564279074904382605163141518161494337 --> original parameter
#N = 57896044618658097711785492504343953926418782139537452191302581570759080747169 --> here to divide by 2 for example
A = 0
B = 7
Gx = 55066263022277343669578718895168534326250603453777594175500187360389116729240 --> here put the key you want to divide
Gy = 32670510020758816978083085130507043184471273380659243275938904335757337482424 --> same for y coordinate
G = (Gx, Gy)

[bigvito19]

Is there a code or script to do the math?

It's easier than you might think. In fact, you can use any library that allows you to calculate the public key from a private key and replace the parameters:

# Elliptic curve parameters (secp256k1)

P = 2**256 - 2**32 - 977
N = 115792089237316195423570985008687907852837564279074904382605163141518161494337 --> original parameter
#N = 57896044618658097711785492504343953926418782139537452191302581570759080747169 --> here to divide by 2 for example
A = 0
B = 7
Gx = 55066263022277343669578718895168534326250603453777594175500187360389116729240 --> here put the key you want to divide
Gy = 32670510020758816978083085130507043184471273380659243275938904335757337482424 --> same for y coordinate
G = (Gx, Gy)

So sorta like this:

_p = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2FL
_r = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141L
_b = 0x0000000000000000000000000000000000000000000000000000000000000007L
_a = 0x0000000000000000000000000000000000000000000000000000000000000000L
_Gx = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798L
_Gy = 0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8L


But you do have to have the private key though?

[pooya87]

But you do have to have the private key though?

you don't need the private key to make this computation and you can not compute the private key. this is just simple point multiplication as defined by elliptic curve algorithm but instead of the usual generator point you use another point on curve (ie. the public key) and instead of the private key you use another number (ie. 2^-1).
you can do this to any of the hundreds of thousands of public keys found on bitcoin blockchain without having private keys.

[indrahk]

The goal is to "half" the point. You want to find the point Q where 2Q = P, your original point.

So you compute 2^-1 (mod n) where n is the order of the group (see the secp256k1 parameters: https://en.bitcoin.it/wiki/Secp256k1)

2^1 is the multiplicative inverse of 2 (mod n). 2 x 2^1 = 1 (mod n). When you do the scalar multiplication it cancels out a factor of 2.

2Q = P

(2^-1)2Q = (2^-1)P

Q = (2^-1)P

Hope that makes sense.

here the another answer

https://crypto.stackexchange.com/questions/59972/half-of-any-bitcoin-crypto-public-key-public-key-half-is-possible


ECC is cryptography over an elliptic curve group.

Firstly you have an elliptic curve, e.g. Bitcoin uses a Koblitz curve secp256k1 y2=x3+7.

The group is defined over curve points over a finite field Fp (integer modular p). The group elements are points on the curve. A point in the affine form consists of two coordinates P=(x,y) where x,y∈Fp.

For group elements, you can do point addition P+Q, as well as scalar multiplication sP, where s is an integer in Zn where n is the order of the group (how many elements in the group).

A public key in bitcoin is a point P. To do P2, you multiply 12 to P where 12 is the multiplicative inverse of 2 in Zn. It is an integer that can be found using the extended Euclidean algorithm and is 57896044618658097711785492504343953926418782139537452191302581570759080747169 in the case of secp256k1.


but in crypt o ,

private key 3

x =  f9308a019258c31049344f85f89d5229b531c845836f99b08601f113bce036f9
y =  388f7b0f632de8140fe337e62a37f3566500a99934c2231b6cb9fd7584b8e672

half of the above public key is 1 given below

x =  79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798
y =  483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8

but the output is

x = c62c910e502cb615a27c58512b6cc2c94f5742f76cb3d12ec993400a3695d413
y = 17f3dadd767275ddd3b23f46723631778bf01dadaebb9a953cf068712457c010

what wrong in this how to correct this

3/2 = 1


  

"the output is

x = c62c910e502cb615a27c58512b6cc2c94f5742f76cb3d12ec993400a3695d413
y = 17f3dadd767275ddd3b23f46723631778bf01dadaebb9a953cf068712457c010 "

to get scalar_pkey the xy above:

modinv2 = modinv(2, N)
             =  57896044618658097711785492504343953926418782139537452191302581570759080747169 == ((N-1)/2)+1) or invers ((N-1)/2)

pkey xy = private key 3  * modinv2 % N
            = 3 * 57896044618658097711785492504343953926418782139537452191302581570759080747169 % N
            = 173688133855974293135356477513031861779256346418612356573907744712277242241507 % N
            = 57896044618658097711785492504343953926418782139537452191302581570759080747170

**applies to all odd privatekey values

The private key      : 0x7fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a2L
Dec private key      : 57896044618658097711785492504343953926418782139537452191302581570759080747170
Biner private key   : 1111111111111111111111111111111111111111111111111111111111111111111111111111111 1111111111111111111111111111111111111111111111110101110101010111011011100111001 1010101111010010001010000000111011101111111101001001011110100011001101000000110 110010000010100010

the uncompressed DEC public key (not address):
(89636686429439908262420422079980100111093242688153882571369946125714247242771L, 10834049905482024808827094233028503931704324296739647619935835709590451240976L)

the uncompressed HEX public key (not address):
(0xc62c910e502cb615a27c58512b6cc2c94f5742f76cb3d12ec993400a3695d413L, 0x17f3dadd767275ddd3b23f46723631778bf01dadaebb9a953cf068712457c010L)

the uncompressed public key (HEX):
04c62c910e502cb615a27c58512b6cc2c94f5742f76cb3d12ec993400a3695d41317f3dadd76727 5ddd3b23f46723631778bf01dadaebb9a953cf068712457c010

the official Public Key - compressed:
02c62c910e502cb615a27c58512b6cc2c94f5742f76cb3d12ec993400a3695d413



Notice :
there is a doubling of scalar numbers either even or odd,
exm1 :
11 ECdouble => 22 ECdiv =>  11
13 ECdouble => 26 ECdiv =>  13
20 ECdouble => 40 ECdiv =>  20 ECdiv =>  10 ECdiv =>  5
21 ECdouble => 42 ECdiv =>  21

but actually there is no division of the odd scalar pkey divided by 2, there is only a 1xGpoint subtraction, then the result can be divided by 2

Exm: binary 1001

sequentially 1 2 4 9
the value of 9 is actually 8+1

for the last binary division result (right) or to get the decimal value 4 of 9, you can't divide 9 by 2,
but first subtract 9 by 1 and then divide by 2 (8 / 2 = 4)

if forced 9/2 and using the above operation, the calculation result will go to
57896044618658097711785492504343953926418782139537452191302581570759080747173 (HEX:0x7fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a5)

the uncompressed public key (not address):
(46399714550823657646711952010527975805134803763457644396793103212103067379801L, 109666243570543015459678453826250465783941922322291717279653226122816671713075L)

the official Public Key - compressed:
0366954eca0543426304036fc70fc0fe3381f5195e88433bc32c5a8a60341e2859


Exm2: binary 10010
sequentially 1 2 4 9 18

18 /2 = 9
(9-1)/2 = 4
4/2 = 2
2/2 = 1

[COBRAS]

The goal is to "half" the point. You want to find the point Q where 2Q = P, your original point.

So you compute 2^-1 (mod n) where n is the order of the group (see the secp256k1 parameters: https://en.bitcoin.it/wiki/Secp256k1)

2^1 is the multiplicative inverse of 2 (mod n). 2 x 2^1 = 1 (mod n). When you do the scalar multiplication it cancels out a factor of 2.

2Q = P

(2^-1)2Q = (2^-1)P

Q = (2^-1)P

Hope that makes sense.

here the another answer

https://crypto.stackexchange.com/questions/59972/half-of-any-bitcoin-crypto-public-key-public-key-half-is-possible


ECC is cryptography over an elliptic curve group.

Firstly you have an elliptic curve, e.g. Bitcoin uses a Koblitz curve secp256k1 y2=x3+7.

The group is defined over curve points over a finite field Fp (integer modular p). The group elements are points on the curve. A point in the affine form consists of two coordinates P=(x,y) where x,y∈Fp.

For group elements, you can do point addition P+Q, as well as scalar multiplication sP, where s is an integer in Zn where n is the order of the group (how many elements in the group).

A public key in bitcoin is a point P. To do P2, you multiply 12 to P where 12 is the multiplicative inverse of 2 in Zn. It is an integer that can be found using the extended Euclidean algorithm and is 57896044618658097711785492504343953926418782139537452191302581570759080747169 in the case of secp256k1.


but in crypt o ,

private key 3

x =  f9308a019258c31049344f85f89d5229b531c845836f99b08601f113bce036f9
y =  388f7b0f632de8140fe337e62a37f3566500a99934c2231b6cb9fd7584b8e672

half of the above public key is 1 given below

x =  79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798
y =  483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8

but the output is

x = c62c910e502cb615a27c58512b6cc2c94f5742f76cb3d12ec993400a3695d413
y = 17f3dadd767275ddd3b23f46723631778bf01dadaebb9a953cf068712457c010

what wrong in this how to correct this

3/2 = 1


  

"the output is

x = c62c910e502cb615a27c58512b6cc2c94f5742f76cb3d12ec993400a3695d413
y = 17f3dadd767275ddd3b23f46723631778bf01dadaebb9a953cf068712457c010 "

to get scalar_pkey the xy above:

modinv2 = modinv(2, N)
             =  57896044618658097711785492504343953926418782139537452191302581570759080747169 == ((N-1)/2)+1) or invers ((N-1)/2)

pkey xy = private key 3  * modinv2 % N
            = 3 * 57896044618658097711785492504343953926418782139537452191302581570759080747169 % N
            = 173688133855974293135356477513031861779256346418612356573907744712277242241507 % N
            = 57896044618658097711785492504343953926418782139537452191302581570759080747170

**applies to all odd privatekey values

The private key      : 0x7fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a2L
Dec private key      : 57896044618658097711785492504343953926418782139537452191302581570759080747170
Biner private key   : 1111111111111111111111111111111111111111111111111111111111111111111111111111111 1111111111111111111111111111111111111111111111110101110101010111011011100111001 1010101111010010001010000000111011101111111101001001011110100011001101000000110 110010000010100010

the uncompressed DEC public key (not address):
(89636686429439908262420422079980100111093242688153882571369946125714247242771L, 10834049905482024808827094233028503931704324296739647619935835709590451240976L)

the uncompressed HEX public key (not address):
(0xc62c910e502cb615a27c58512b6cc2c94f5742f76cb3d12ec993400a3695d413L, 0x17f3dadd767275ddd3b23f46723631778bf01dadaebb9a953cf068712457c010L)

the uncompressed public key (HEX):
04c62c910e502cb615a27c58512b6cc2c94f5742f76cb3d12ec993400a3695d41317f3dadd76727 5ddd3b23f46723631778bf01dadaebb9a953cf068712457c010

the official Public Key - compressed:
02c62c910e502cb615a27c58512b6cc2c94f5742f76cb3d12ec993400a3695d413



Notice :
there is a doubling of scalar numbers either even or odd,
exm1 :
11 ECdouble => 22 ECdiv =>  11
13 ECdouble => 26 ECdiv =>  13
20 ECdouble => 40 ECdiv =>  20 ECdiv =>  10 ECdiv =>  5
21 ECdouble => 42 ECdiv =>  21

but actually there is no division of the odd scalar pkey divided by 2, there is only a 1xGpoint subtraction, then the result can be divided by 2

Exm: binary 1001

sequentially 1 2 4 9
the value of 9 is actually 8+1

for the last binary division result (right) or to get the decimal value 4 of 9, you can't divide 9 by 2,
but first subtract 9 by 1 and then divide by 2 (8 / 2 = 4)

if forced 9/2 and using the above operation, the calculation result will go to
57896044618658097711785492504343953926418782139537452191302581570759080747173 (HEX:0x7fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a5)

the uncompressed public key (not address):
(46399714550823657646711952010527975805134803763457644396793103212103067379801L, 109666243570543015459678453826250465783941922322291717279653226122816671713075L)

the official Public Key - compressed:
0366954eca0543426304036fc70fc0fe3381f5195e88433bc32c5a8a60341e2859


Exm2: binary 10010
sequentially 1 2 4 9 18

18 /2 = 9
(9-1)/2 = 4
4/2 = 2
2/2 = 1

try halving and substract, ie reverse of double and add

13 priv

022B4EA0A797A443D293EF5CFF444F4979F06ACFEBD7E86D277475656138385B6C  - pub

priv even pub odd, shit

[indrahk]

The goal is to "half" the point. You want to find the point Q where 2Q = P, your original point.

So you compute 2^-1 (mod n) where n is the order of the group (see the secp256k1 parameters: https://en.bitcoin.it/wiki/Secp256k1)

2^1 is the multiplicative inverse of 2 (mod n). 2 x 2^1 = 1 (mod n). When you do the scalar multiplication it cancels out a factor of 2.

2Q = P

(2^-1)2Q = (2^-1)P

Q = (2^-1)P

Hope that makes sense.

here the another answer

https://crypto.stackexchange.com/questions/59972/half-of-any-bitcoin-crypto-public-key-public-key-half-is-possible


ECC is cryptography over an elliptic curve group.

Firstly you have an elliptic curve, e.g. Bitcoin uses a Koblitz curve secp256k1 y2=x3+7.

The group is defined over curve points over a finite field Fp (integer modular p). The group elements are points on the curve. A point in the affine form consists of two coordinates P=(x,y) where x,y∈Fp.

For group elements, you can do point addition P+Q, as well as scalar multiplication sP, where s is an integer in Zn where n is the order of the group (how many elements in the group).

A public key in bitcoin is a point P. To do P2, you multiply 12 to P where 12 is the multiplicative inverse of 2 in Zn. It is an integer that can be found using the extended Euclidean algorithm and is 57896044618658097711785492504343953926418782139537452191302581570759080747169 in the case of secp256k1.


but in crypt o ,

private key 3

x =  f9308a019258c31049344f85f89d5229b531c845836f99b08601f113bce036f9
y =  388f7b0f632de8140fe337e62a37f3566500a99934c2231b6cb9fd7584b8e672

half of the above public key is 1 given below

x =  79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798
y =  483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8

but the output is

x = c62c910e502cb615a27c58512b6cc2c94f5742f76cb3d12ec993400a3695d413
y = 17f3dadd767275ddd3b23f46723631778bf01dadaebb9a953cf068712457c010

what wrong in this how to correct this

3/2 = 1


  

"the output is

x = c62c910e502cb615a27c58512b6cc2c94f5742f76cb3d12ec993400a3695d413
y = 17f3dadd767275ddd3b23f46723631778bf01dadaebb9a953cf068712457c010 "

to get scalar_pkey the xy above:

modinv2 = modinv(2, N)
             =  57896044618658097711785492504343953926418782139537452191302581570759080747169 == ((N-1)/2)+1) or invers ((N-1)/2)

pkey xy = private key 3  * modinv2 % N
            = 3 * 57896044618658097711785492504343953926418782139537452191302581570759080747169 % N
            = 173688133855974293135356477513031861779256346418612356573907744712277242241507 % N
            = 57896044618658097711785492504343953926418782139537452191302581570759080747170

**applies to all odd privatekey values

The private key      : 0x7fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a2L
Dec private key      : 57896044618658097711785492504343953926418782139537452191302581570759080747170
Biner private key   : 1111111111111111111111111111111111111111111111111111111111111111111111111111111 1111111111111111111111111111111111111111111111110101110101010111011011100111001 1010101111010010001010000000111011101111111101001001011110100011001101000000110 110010000010100010

the uncompressed DEC public key (not address):
(89636686429439908262420422079980100111093242688153882571369946125714247242771L, 10834049905482024808827094233028503931704324296739647619935835709590451240976L)

the uncompressed HEX public key (not address):
(0xc62c910e502cb615a27c58512b6cc2c94f5742f76cb3d12ec993400a3695d413L, 0x17f3dadd767275ddd3b23f46723631778bf01dadaebb9a953cf068712457c010L)

the uncompressed public key (HEX):
04c62c910e502cb615a27c58512b6cc2c94f5742f76cb3d12ec993400a3695d41317f3dadd76727 5ddd3b23f46723631778bf01dadaebb9a953cf068712457c010

the official Public Key - compressed:
02c62c910e502cb615a27c58512b6cc2c94f5742f76cb3d12ec993400a3695d413



Notice :
there is a doubling of scalar numbers either even or odd,
exm1 :
11 ECdouble => 22 ECdiv =>  11
13 ECdouble => 26 ECdiv =>  13
20 ECdouble => 40 ECdiv =>  20 ECdiv =>  10 ECdiv =>  5
21 ECdouble => 42 ECdiv =>  21

but actually there is no division of the odd scalar pkey divided by 2, there is only a 1xGpoint subtraction, then the result can be divided by 2

Exm: binary 1001

sequentially 1 2 4 9
the value of 9 is actually 8+1

for the last binary division result (right) or to get the decimal value 4 of 9, you can't divide 9 by 2,
but first subtract 9 by 1 and then divide by 2 (8 / 2 = 4)

if forced 9/2 and using the above operation, the calculation result will go to
57896044618658097711785492504343953926418782139537452191302581570759080747173 (HEX:0x7fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a5)

the uncompressed public key (not address):
(46399714550823657646711952010527975805134803763457644396793103212103067379801L, 109666243570543015459678453826250465783941922322291717279653226122816671713075L)

the official Public Key - compressed:
0366954eca0543426304036fc70fc0fe3381f5195e88433bc32c5a8a60341e2859


Exm2: binary 10010
sequentially 1 2 4 9 18

18 /2 = 9
(9-1)/2 = 4
4/2 = 2
2/2 = 1

try halving and substract, ie reverse of double and add

13 priv

022B4EA0A797A443D293EF5CFF444F4979F06ACFEBD7E86D277475656138385B6C  - pub

priv even pub odd, shit

DES PKEY = 19
HEX PKEY = 0x13
Pubkey   = 022b4ea0a797a443d293ef5cff444f4979f06acfebd7e86d277475656138385b6c


x= 0x2b4ea0a797a443d293ef5cff444f4979f06acfebd7e86d277475656138385b6c
y= 0x85e89bc037945d93b343083b5a1c86131a01f60c50269763b570c854e5c09b7a

div xy :
0x1c2bd878b94169da722a9de0c4e317cea8802aa96045830111a89d1d9de4270cL 0xf6a4826643c20ce10f240e855f610eb78e5193a278f1418ae0ad55515b71ff6aL

(div xy) - 1 :
0x41f7fa0a9a59513ae221e3b84b91995fc9d40eb5d120a6d8e663452ad92099c8L 0xf7ec24416d13b49dda2e33a1a7df14482423d69b2a22e54c21543145a186befdL

(div xy) - xy :
0x1c2bd878b94169da722a9de0c4e317cea8802aa96045830111a89d1d9de4270cL 0x95b7d99bc3df31ef0dbf17aa09ef14871ae6c5d870ebe751f52aaada48dfcc5L




double xy :
0xb699a30e6e184cdfa88ac16c7d80bffd38e2e1fc705821ea69cd5fdf1691fff7L 0xd505700c51d860ce5a096ee637ebed3bd9d7268126c76a16b745bc318a51ab04L

(double xy)+1 :
0x80c60ad0040f27dade5b4b06c408e56b2c50e9f56b9b8b425e555c2f86308b6fL 0x1c38303f1cc5c30f26e66bad7fe72f70a65eed4cbe7024eb1aa01f56430bd57aL

(double xy)+xy :
0x2600ca4b282cb986f85d0f1709979d8b44a09c07cb86d7c124497bc86f082120L 0x4119b88753c15bd6a693b03fcddbb45d5ac6be74ab5f0ef44b0be9475a7e4b40L

"priv even pub odd, shit"...  am i missing something??

[COBRAS]

The goal is to "half" the point. You want to find the point Q where 2Q = P, your original point.

So you compute 2^-1 (mod n) where n is the order of the group (see the secp256k1 parameters: https://en.bitcoin.it/wiki/Secp256k1)

2^1 is the multiplicative inverse of 2 (mod n). 2 x 2^1 = 1 (mod n). When you do the scalar multiplication it cancels out a factor of 2.

2Q = P

(2^-1)2Q = (2^-1)P

Q = (2^-1)P

Hope that makes sense.

here the another answer

https://crypto.stackexchange.com/questions/59972/half-of-any-bitcoin-crypto-public-key-public-key-half-is-possible


ECC is cryptography over an elliptic curve group.

Firstly you have an elliptic curve, e.g. Bitcoin uses a Koblitz curve secp256k1 y2=x3+7.

The group is defined over curve points over a finite field Fp (integer modular p). The group elements are points on the curve. A point in the affine form consists of two coordinates P=(x,y) where x,y∈Fp.

For group elements, you can do point addition P+Q, as well as scalar multiplication sP, where s is an integer in Zn where n is the order of the group (how many elements in the group).

A public key in bitcoin is a point P. To do P2, you multiply 12 to P where 12 is the multiplicative inverse of 2 in Zn. It is an integer that can be found using the extended Euclidean algorithm and is 57896044618658097711785492504343953926418782139537452191302581570759080747169 in the case of secp256k1.


but in crypt o ,

private key 3

x =  f9308a019258c31049344f85f89d5229b531c845836f99b08601f113bce036f9
y =  388f7b0f632de8140fe337e62a37f3566500a99934c2231b6cb9fd7584b8e672

half of the above public key is 1 given below

x =  79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798
y =  483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8

but the output is

x = c62c910e502cb615a27c58512b6cc2c94f5742f76cb3d12ec993400a3695d413
y = 17f3dadd767275ddd3b23f46723631778bf01dadaebb9a953cf068712457c010

what wrong in this how to correct this

3/2 = 1


  

"the output is

x = c62c910e502cb615a27c58512b6cc2c94f5742f76cb3d12ec993400a3695d413
y = 17f3dadd767275ddd3b23f46723631778bf01dadaebb9a953cf068712457c010 "

to get scalar_pkey the xy above:

modinv2 = modinv(2, N)
             =  57896044618658097711785492504343953926418782139537452191302581570759080747169 == ((N-1)/2)+1) or invers ((N-1)/2)

pkey xy = private key 3  * modinv2 % N
            = 3 * 57896044618658097711785492504343953926418782139537452191302581570759080747169 % N
            = 173688133855974293135356477513031861779256346418612356573907744712277242241507 % N
            = 57896044618658097711785492504343953926418782139537452191302581570759080747170

**applies to all odd privatekey values

The private key      : 0x7fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a2L
Dec private key      : 57896044618658097711785492504343953926418782139537452191302581570759080747170
Biner private key   : 1111111111111111111111111111111111111111111111111111111111111111111111111111111 1111111111111111111111111111111111111111111111110101110101010111011011100111001 1010101111010010001010000000111011101111111101001001011110100011001101000000110 110010000010100010

the uncompressed DEC public key (not address):
(89636686429439908262420422079980100111093242688153882571369946125714247242771L, 10834049905482024808827094233028503931704324296739647619935835709590451240976L)

the uncompressed HEX public key (not address):
(0xc62c910e502cb615a27c58512b6cc2c94f5742f76cb3d12ec993400a3695d413L, 0x17f3dadd767275ddd3b23f46723631778bf01dadaebb9a953cf068712457c010L)

the uncompressed public key (HEX):
04c62c910e502cb615a27c58512b6cc2c94f5742f76cb3d12ec993400a3695d41317f3dadd76727 5ddd3b23f46723631778bf01dadaebb9a953cf068712457c010

the official Public Key - compressed:
02c62c910e502cb615a27c58512b6cc2c94f5742f76cb3d12ec993400a3695d413



Notice :
there is a doubling of scalar numbers either even or odd,
exm1 :
11 ECdouble => 22 ECdiv =>  11
13 ECdouble => 26 ECdiv =>  13
20 ECdouble => 40 ECdiv =>  20 ECdiv =>  10 ECdiv =>  5
21 ECdouble => 42 ECdiv =>  21

but actually there is no division of the odd scalar pkey divided by 2, there is only a 1xGpoint subtraction, then the result can be divided by 2

Exm: binary 1001

sequentially 1 2 4 9
the value of 9 is actually 8+1

for the last binary division result (right) or to get the decimal value 4 of 9, you can't divide 9 by 2,
but first subtract 9 by 1 and then divide by 2 (8 / 2 = 4)

if forced 9/2 and using the above operation, the calculation result will go to
57896044618658097711785492504343953926418782139537452191302581570759080747173 (HEX:0x7fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a5)

the uncompressed public key (not address):
(46399714550823657646711952010527975805134803763457644396793103212103067379801L, 109666243570543015459678453826250465783941922322291717279653226122816671713075L)

the official Public Key - compressed:
0366954eca0543426304036fc70fc0fe3381f5195e88433bc32c5a8a60341e2859


Exm2: binary 10010
sequentially 1 2 4 9 18

18 /2 = 9
(9-1)/2 = 4
4/2 = 2
2/2 = 1

try halving and substract, ie reverse of double and add

13 priv

022B4EA0A797A443D293EF5CFF444F4979F06ACFEBD7E86D277475656138385B6C  - pub

priv even pub odd, shit

DES PKEY = 19
HEX PKEY = 0x13
Pubkey   = 022b4ea0a797a443d293ef5cff444f4979f06acfebd7e86d277475656138385b6c


x= 0x2b4ea0a797a443d293ef5cff444f4979f06acfebd7e86d277475656138385b6c
y= 0x85e89bc037945d93b343083b5a1c86131a01f60c50269763b570c854e5c09b7a

div xy :
0x1c2bd878b94169da722a9de0c4e317cea8802aa96045830111a89d1d9de4270cL 0xf6a4826643c20ce10f240e855f610eb78e5193a278f1418ae0ad55515b71ff6aL

(div xy) - 1 :
0x41f7fa0a9a59513ae221e3b84b91995fc9d40eb5d120a6d8e663452ad92099c8L 0xf7ec24416d13b49dda2e33a1a7df14482423d69b2a22e54c21543145a186befdL

(div xy) - xy :
0x1c2bd878b94169da722a9de0c4e317cea8802aa96045830111a89d1d9de4270cL 0x95b7d99bc3df31ef0dbf17aa09ef14871ae6c5d870ebe751f52aaada48dfcc5L




double xy :
0xb699a30e6e184cdfa88ac16c7d80bffd38e2e1fc705821ea69cd5fdf1691fff7L 0xd505700c51d860ce5a096ee637ebed3bd9d7268126c76a16b745bc318a51ab04L

(double xy)+1 :
0x80c60ad0040f27dade5b4b06c408e56b2c50e9f56b9b8b425e555c2f86308b6fL 0x1c38303f1cc5c30f26e66bad7fe72f70a65eed4cbe7024eb1aa01f56430bd57aL

(double xy)+xy :
0x2600ca4b282cb986f85d0f1709979d8b44a09c07cb86d7c124497bc86f082120L 0x4119b88753c15bd6a693b03fcddbb45d5ac6be74ab5f0ef44b0be9475a7e4b40L

"priv even pub odd, shit"...  am i missing something??

this pubkey is odd 022b4ea0a797a443d293ef5cff444f4979f06acfebd7e86d277475656138385b6c but privkey is even  19 in des, so imposible start with even privkey then use 02... pubkeys,.  02...,03...., nit always correlate with odd even parametr unfortunately

[fxsniper]

What meaning is Half of any bitcoin?
Do you mean half of the public key right?
or
Did you mean half of the scalar to the private key right? or what?

[COBRAS]

What meaning is Half of any bitcoin?
Do you mean half of the public key right?
or
Did you mean half of the scalar to the private key right? or what?

half of base point, pubkey, privkey,  /2, * 7fffffffffffffffffffffffffffffff5d576e7357a4501ddfe92f46681b20a1

this is a all half

[COBRAS]

What meaning is Half of any bitcoin?
Do you mean half of the public key right?
or
Did you mean half of the scalar to the private key right? or what?

halvig has a int and float part, veryvery hard divide pubkey without flot part, but posible use combination  x / d = result1, result 1- 1(uno) =  result 2, result2 x d = downgraded pubkey = pubkey without int part.

divide 120 pub to 119, substract 1, multiply to 119 you get result 118 etc...
....

[fxsniper]

How can we can fine half like this?


2**120
1329227995784915872903807060280344576

private key = 1329227995784915872903807060280344576

1329227995784915872903807060280344576 hex = 1000000000000000000000000000000

binary = 1000000000000000000000000000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000

Half binary first (60) = 100000000000000000000000000000000000000000000000000000000000

(hex) 800000000000000  = (dec) 576460752303423488

half of 1329227995784915872903807060280344576 is 576460752303423488

[NotATether]

halvig has a int and float part, veryvery hard divide pubkey without flot part, but posible use combination  x / d = result1, result 1- 1(uno) =  result 2, result2 x d = downgraded pubkey = pubkey without int part.

divide 120 pub to 119, substract 1, multiply to 119 you get result 118 etc...
....

Obviously your divisor (d) must be 2 if you are trying to downgrade a PK by 1 bit. Then the remainder will only be 1 or 0.

But subtraction does not really eliminate the float part by subtracting 1, you will either get the same pubkey when you multiply it again or a different one, so if the (quotient-1) subtraction gives you a different public key when its multiplied, you know that the quotient is an even private key.

Not that private key parities correspond to public key parities (they do *not* correlate), so the parity of the private key is still unknown. You are basically throwing away 1 bit of privte key during each division without further information about the private key composition.

[COBRAS]

halvig has a int and float part, veryvery hard divide pubkey without flot part, but posible use combination  x / d = result1, result 1- 1(uno) =  result 2, result2 x d = downgraded pubkey = pubkey without int part.

divide 120 pub to 119, substract 1, multiply to 119 you get result 118 etc...
....

Obviously your divisor (d) must be 2 if you are trying to downgrade a PK by 1 bit. Then the remainder will only be 1 or 0.

But subtraction does not really eliminate the float part by subtracting 1, you will either get the same pubkey when you multiply it again or a different one, so if the (quotient-1) subtraction gives you a different public key when its multiplied, you know that the quotient is an even private key.

Not that private key parities correspond to public key parities (they do *not* correlate), so the parity of the private key is still unknown. You are basically throwing away 1 bit of privte key during each division without further information about the private key composition.

i know about substracting is more good, but, if you thant get 80vbit from 120 is very hard too do it this because needs about  1 099 511 627 776 -1 substraction.

dividing with float part sovs with fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0342ec8 with not 02 03  pubkey but with pubkey *-1, this transform priv/pubkey in for from 12345 to fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0361108 form and you not  get negative number then substract because 12345 - 12346 = -1, and you range will jamp dramnaticaly from 5 chars to fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364140chard

, but if substract 123456 from fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0361108 - 123456 =  0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0342ec8 and range not jump.