Bitcoin Forum
September 07, 2025, 02:56:38 AM *
News: Latest Bitcoin Core release: 29.0 [Torrent]
 
   Home   Help Search Login Register More  
Pages: [1]
  Print  
Author Topic: P = A[X1, Y] - B[X2,Y]  (Read 171 times)
PROFIGROK (OP)
Newbie
*
Offline Offline

Activity: 5
Merit: 0


View Profile
August 27, 2025, 10:15:15 AM
 #1

Hi all.

Px = 80761252842007823267676923098838519533867178259061318285796836088556437370050
Py = 10738555717992617802285220494903845365923729217029449460443518382927240297340

Ax = 93560427823998350675410474831001446736200963751037120112392597322455167739793
Ay = 93848508593538492915520554344759249877309109996279289133143629759880647227979

Bx = 50213163450946219488224773860514757649033909603552708244598159315971281928720
By = 93848508593538492915520554344759249877309109996279289133143629759880647227979

A-B=P

Points A and B have a common Y coordinate. For each point P on the curve, there is a pair of points A and B such that A-B=P. Does this give us an advantage when computing the private key?

P.S. Sorry for my English Smiley
kTimesG
Full Member
***
Offline Offline

Activity: 588
Merit: 198


View Profile
August 27, 2025, 05:30:08 PM
 #2

Points A and B have a common Y coordinate. For each point P on the curve, there is a pair of points A and B such that A-B=P. Does this give us an advantage when computing the private key?

Yes. But just when the only information you have is that the private key is anywhere between 1 and n - 1.

In other words: good luck finding the specific pair of points that add up to P (or one of its equivalent endos).

Off the grid, training pigeons to broadcast signed messages.
PROFIGROK (OP)
Newbie
*
Offline Offline

Activity: 5
Merit: 0


View Profile
August 27, 2025, 05:43:19 PM
 #3

Yes. But just when the only information you have is that the private key is anywhere between 1 and n - 1.

In other words: good luck finding the specific pair of points that add up to P (or one of its equivalent endos).
How to calculate the private key for my example?
kTimesG
Full Member
***
Offline Offline

Activity: 588
Merit: 198


View Profile
August 27, 2025, 11:24:57 PM
 #4

Yes. But just when the only information you have is that the private key is anywhere between 1 and n - 1.

In other words: good luck finding the specific pair of points that add up to P (or one of its equivalent endos).
How to calculate the private key for my example?

A - B = P

A and B have same Y so are related by B = [lambda] * A (or maybe lambda**2, didn't bother to check which one, it can easily be done by comparing the X ratios)

So you have [1 - lambda] * A = P

To get P's key, you need to know either A's of B's key.

To get A's or B's key, you need to know P's key.

This is the only "advantage" in the equation you want to solve.

If you don't know either key, this property only reduces the discrete log problem complexity accordingly, by a factor of sqrt(6), but only when searching over the entire group order, which is in 256-bit key-space. Hence, only slightly reducing the secp256k1 security to around 125 bits or so.

If the key is known to exist inside a known interval, less than 253 bits in size, this property is useless, since the advantage is not useful for interval-DLP solving algorithms (and it just adds overhead).

Off the grid, training pigeons to broadcast signed messages.
PROFIGROK (OP)
Newbie
*
Offline Offline

Activity: 5
Merit: 0


View Profile
August 28, 2025, 12:50:03 AM
 #5

There are no keys to any point. I can only calculate suitable A and B for any point P
kTimesG
Full Member
***
Offline Offline

Activity: 588
Merit: 198


View Profile
August 28, 2025, 08:13:32 AM
 #6

There are no keys to any point. I can only calculate suitable A and B for any point P

Excuse me, but how do you expect to compute a private key of some point, when the only property you have is something that applies to all the points on the curve?

You have A, from which you compute -B. Obviously P is their addition. So zero useful information.

BTW all three points belong to the same endo class, so their field X Y values are directly derived one from another, without any need of point multiplication: So there's not something to "find" other than the key itself of one of the points, otherwise everything is just running in a circular logic. Nothing to compute.

A + B + C = 0 is satisfied for any possible private key and all three points have the same Y. The sum of their X's is also 0. This is basic number theory in action due to the curve equation and the roots of unity.

Off the grid, training pigeons to broadcast signed messages.
PROFIGROK (OP)
Newbie
*
Offline Offline

Activity: 5
Merit: 0


View Profile
August 28, 2025, 09:05:18 AM
 #7

Thank you for the detailed answer! Initially I have not A, but P, ​​for which I find A and B
AlexanderCurl
Jr. Member
*
Offline Offline

Activity: 43
Merit: 193


View Profile WWW
August 30, 2025, 07:45:01 PM
Last edit: September 03, 2025, 06:59:24 PM by AlexanderCurl
 #8

Some good property. If you go from start of keyspace the difference of P`s endos will be 3*private key value from secp256k1 keyspace.
Too bad this will not help in computing the private key. As almost any other computations with public keys.

example of 1 scalar from keys of secp256k1 (the same holds for point operations)
1
a =  78074008874160198520644763525212887401909906723592317393988542598630163514318 lambda2
b =  37718080363155996902926221483475020450927657555482586988616620542887997980018 lambda1
a-b mod N = 40355928511004201617718542041737866950982249168109730405371922055742165534300(diff of endos == 3*1)
b-a mod N = 75436160726311993805852442966950040901855315110965173977233241085775995960037(diff of endos == 3*1)
(a-b) / 3 mod N = 52049339249440132347096509016808591601273271149061544929325695065753442342879(diff of endos == 1)
(b-a) / 3 mod N = 63742749987876063076474475991879316251564293130013359453279468075764719151458(diff of endos == 1)
Pages: [1]
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!