Mini-puzzle #4

[RetiredCoder]

Guys, let's have some fun again, I have one more mini-puzzle for you
There is 0.01 BTC on that address, so hurry up!

03C8F139DAD58B4786D3649992849733C2A7626F011089E87508CCDF8B0758C493
Hint: It's a strong point so you cannot solve it by kangaroos. But it's a special point, you can solve it easily if you use some feature of secp256k1.

PS. No BS here please, I will remove it.
PPS. For history, previous mini-puzzle is here: https://bitcointalk.org/index.php?topic=5522785

[llenn1227]

Guys, let's have some fun again, I have one more mini-puzzle for you
There is 0.01 BTC on that address, so hurry up!

03C8F139DAD58B4786D3649992849733C2A7626F011089E87508CCDF8B0758C493
Hint: It's a strong point so you cannot solve it by kangaroos. But it's a special point, you can solve it easily if you use some feature of secp256k1.

PS. No BS here please, I will remove it.
PPS. For history, previous mini-puzzle is here: https://bitcointalk.org/index.php?topic=5522785

That's Sad, a hard one QAQ

But i'll try my best

Here's the address - > https://www.blockchain.com/explorer/addresses/btc/1AH5pRZW4ZofEJhdb3muNZ1q88YNu3Rez7

[RetiredCoder]

That's Sad, a hard one QAQ
But i'll try my best

It's not difficult, really  
And you don't even need GPUs or fast PC.

[llenn1227]

That's Sad, a hard one QAQ
But i'll try my best

It's not difficult, really  
And you don't even need GPUs or fast PC.

I think i need a better brain.
For a pool guy who failed 4 subject in this semester.
Maybe I need to study whole ECDSA for the next puzzle?

[RetiredCoder]

Maybe I need to study whole ECDSA for the next puzzle?

ECDSA already was in previous puzzle, so probably I won't use it again 

[llenn1227]

Maybe I need to study whole ECDSA for the next puzzle?

ECDSA already was in previous puzzle, so probably I won't use it again 

That a good news!
But first i need to figure this puzzle out.
I guess this might have something to do with the mirrored curve?
Or maybe the constant of secp256k1?
Still learning how this work Orz

[iceland2k14]

It's not difficult, really  
And you don't even need GPUs or fast PC.

• None of the Endo/Sym points are below 53 bits
• None of the Endo/Sym points are within 30 bits of the bit boundary from 1 to 256
• None of the Endo/Sym points are a hash of "Mini-puzzle #4" or "RetiredCoder Mini-puzzle #4"
• None of the Endo/Sym points are a close to the privatekey or K or previous #3 Puzzle
• C'mon Guys. do it fast. What else...

[RetiredCoder]

No worries, I will give a new hint after 24 hours.
But I still think that you will solve it earlier

[hskun]

not the p n endo lambda beta...
it was solved...so sad...

[ukn9977]

Thank you @RetiredCoder for the puzzle.

Because: k = k*LAMBDA+1
Solve    : k = 89767419612596129250022730500283612052200928704544131917942315608641440322898

Code:

# sagemath
N = 115792089237316195423570985008687907852837564279074904382605163141518161494337
LAMBDA = 37718080363155996902926221483475020450927657555482586988616620542887997980018

R.<k> = PolynomialRing(GF(N))

# k = k*LAMBDA+1
r = (k -  (k*LAMBDA+1)).roots()
for x in r:
    print("k = ", x[0])
#k =  89767419612596129250022730500283612052200928704544131917942315608641440322898

[RetiredCoder]

Another explanation:
It's a special point, if you apply endomorphism for it, you will get previous point (Point - G).
It's funny to have two points next to each other with same Y, isn't it? 
And since you know the distance between these two points, you can calculate the private key easily.
Congrats to the winner!

[JDScreesh]

Hello there 

Congratulations to the winner 

I think I'm lost with this red part of the explanation:

Another explanation:
It's a special point, if you apply endomorphism for it, you will get previous point (Point - G).
It's funny to have two points next to each other with same Y, isn't it? 
And since you know the distance between these two points, you can calculate the private key easily.
Congrats to the winner!

I'm trying to get the privkey with this information, but I think I'm missing something 

Thanks for all the learning 

Greetings.

[Major Azul]

hello, where can I learn how to decode this?

and what is the address?

[RetiredCoder]

I'm trying to get the privkey with this information, but I think I'm missing something 
Thanks for all the learning 
Greetings.

Sure! 
We know:
lambda * x = a [mod N]
x = a + 1 [mod N]

So:
lambda * (a + 1) = a [mod N]
lambda * a + lambda = a [mod N]
(lambda - 1) * a + lambda = 0 [mod N]
a = -lambda / (lambda - 1) [mod N]

[JDScreesh]

Sure! 
We know:
lambda * x = a [mod N]
x = a + 1 [mod N]

So:
lambda * (a + 1) = a [mod N]
lambda * a + lambda = a [mod N]
(lambda - 1) * a + lambda = 0 [mod N]
a = -lambda / (lambda - 1) [mod N]

Cool! now I can see it 

Thanks a lot for the explanation 

[mjojo]

Code:

DBL 0:
a0                               : 28656494787849788178846280232722535366602610135464471548693628842033875030774 Y
a1                               : 64085527874626556120582535604906191133993776464141088401876389432686378436844 N
Lam Numerator                    : 24451327812764160469375732394646891906403158240170826054096020762142281864872 Y
Lam Denominator                  : 12378966511936916817594086201124474414717568262641612764295194857463922202025 Y
Result Lam                       : 90164811066602240685525910245268168444406468821116643963079939878016814643363 N
Modular Inverse                  : 73354833296120792775670026364214776218043641652330273932372744839188764773793 Y
Result X                         : 90888779158563823146755473862282102363969308959424961308149641532476281635987 Y
Result Y                         : 46201727910540285190454324890558278619756708117972953873730558795650959119923 N



DBL 1:
a0                               : 104403551840626474953376424551165765467561720381305370579875450682007898015831 Y
a1                               : 64085527874626556120582535604906191133993776464141088401876389432686378436844 N
Lam Numerator                    : 87957283359521357687061983675423052553526169065692381021112082220578186202170 N
Lam Denominator                  : 12378966511936916817594086201124474414717568262641612764295194857463922202025 Y
Result Lam                       : 94165601948352868544180331085494877662307814315103203626908763534409097566489 N
Modular Inverse                  : 73354833296120792775670026364214776218043641652330273932372744839188764773793 Y
Result X                         : 23620854997921501804136411791104769986833072451863613446092941013256551136065 Y
Result Y                         : 46201727910540285190454324890558278619756708117972953873730558795650959119923 N

same Y coordinate from two point, but still don't know how to calculate Lam 37718080363155996902926221483475020450927657555482586988616620542887997980018

[JDScreesh]

same Y coordinate from two point, but still don't know how to calculate Lam 37718080363155996902926221483475020450927657555482586988616620542887997980018

I got lambda value searching... and found it in Hal Finney's post "Speeding up signature verification" ( https://bitcointalk.org/index.php?topic=3238.0 )

The lambda and beta values in that post are in hexadecimal.

lambda = 0x5363ad4cc05c30e0a5261c028812645a122e22ea20816678df02967c1b23bd72
beta = 0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee

 

[mjojo]

same Y coordinate from two point, but still don't know how to calculate Lam 37718080363155996902926221483475020450927657555482586988616620542887997980018

I got lambda value searching... and found it in Hal Finney's post "Speeding up signature verification" ( https://bitcointalk.org/index.php?topic=3238.0 )

The lambda and beta values in that post are in hexadecimal.

lambda = 0x5363ad4cc05c30e0a5261c028812645a122e22ea20816678df02967c1b23bd72
beta = 0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee

 

thank you

[iceland2k14]

Code:

import secp256k1 as ice
pub = '03C8F139DAD58B4786D3649992849733C2A7626F011089E87508CCDF8B0758C493'
lmda = 0x5363ad4cc05c30e0a5261c028812645a122e22ea20816678df02967c1b23bd72
N = ice.N

G = ice.scalar_multiplication(1)
Q = ice.pub2upub(pub)   # pvk
QE = ice.pub_endo1(Q)   # pvk * lmda % N
QG = ice.point_subtraction( Q, G )  # pvk -1 
if QG == QE:    # pvk -1 = (pvk * lmda % N)
    # pvk -1 = (pvk * lmda % N)
    # pvk - pvk * lmda = 1 %N
    # pvk (1 - lmda) = 1  %N
    # pvk = 1 / (1 - lmda)  %N
    print(f'[+] PrivateKey: {hex(pow((1-lmda), N-2, N))}')

Code:

[+] PrivateKey: 0xc6768f199574104ae1b75eab82b0cc1d2d2e9ee7d50637a574e27131e9301552

I missed it indeed.

[RetiredCoder]

Code:

[+] PrivateKey: 0xc6768f199574104ae1b75eab82b0cc1d2d2e9ee7d50637a574e27131e9301552

I missed it indeed. Sad

Correct!
You are already the winner of another mini-puzzle so don't be sad