4 points with same doubling slope

[jovica888]

I found on secp256k1 that if 4 points have same doubling slope their private keys always gives 0
k1+k2+k3+k4=0

On smaller curve
P=967 N=907
β (cube root of 1): 142
λ (eigenvalue at P): 522
1G   (418, 442)


If I have 1st private key I can calculate 1st column.... and I can  calculate all slopes in 1 set of 24 points but I did not find the way to if I have k1 to calculate k2 k3 k4

Also on the big curve I found those sets

f(x) = 9x^4 - 4slope^2x^3 - 28slope^2 = 0

On this way I generated sets of 4 points 48 sets on this curve p=967
I tried other curves with Sagemath
p=1000003 - Number of points: 999006 Number of sets: 41886
p=1001023 - Points: 999066 - Sets:41466
p=1001527 - Points: 1000158 - Sets:41580
p=20000077 - Points: 19992876 - Sets:833040

Finally I tried to search those sets on the big curve. I started with slope 1 and I was searching if current slope will give 4 solutions for that
This is the SageMath code I was using https://justpaste.it/k055b
and I got these Slopes and X values

Slope 5:
e5493c5e5ab1e25795a4f01f362ebc855d3c2611100bb0c24b401d5846f28f93
95b49d5352c6d6893771e5524aced66e9c163010d1cf0dcad80a77d786fc4681
91bfb02411f3bbb0e380f649f876e8692acbb596452df00277c846b1191017f5
817b59b8797719a732f66d2814c4683114c58280bc858a53f32607aac3abb2ec
--------------------
Slope 16:
ff405d7729ed52aa591f7be3f59048c4d506fc28ff83f1b78c84f34c9ec19e50
a1f7ff943ae98653ce8e8b90ea104f1f9a669548bf0208a595810c0d526cb547
2fe5f2ec5aed03af8aae566b6a792fdf5ae94630ba878d2a0206ec505e7cd908
126fe8ebce7506e0868730589974711fc3e20bebbfd606b1bf814d375aff7748
--------------------
Slope 47:
d8a0a502488cf53fe88a7b53b3b86021c151e59ef8df9f0f6fe54b821cef7ac6
6ced29459069a670d859aec16c1e85d426d1eaf84a1a14f8beab86e85934b74b
5b260613d299e1e19673ccf072afac0b94e843b73f24fe1f425f1e2ca885df5b
42da6487e2a865fbe18b97335107a6e2112ccf3fb6c4dc11729e484a8c0095df
--------------------
Slope 54:
f9c2e48f573115eddcbc132f9cf5979ac292e3918ecdec4458589501788f5b90
caeb00411e5011e845e8063c58749613f6e51a083896b935cab902a50815f9c2
217212301587cca0fb1387de3db81428cb7b5e95567786fee35fc43327ea2046
19e008ff74f70b88e2485eb5ccddbe287b0ca3d0e223d386f98ea424577087d6
--------------------
Slope 110:
f494b668f9c24a74dcced225e670cd6d9b343b9d8175354123281ab73564f74a
a3c5694b0a6cce2d90e5cfdc9f3bd9a5bad9fab3a0685ece8a5bd958802b979c
35fbd7fee43dafc765aeb3abe77c60fcaba79fbebd7d5b5ffddd70c9acc27109
15384130a5cc1b246580388a766530d38c830d7e59889ec9382cd4084857b888
--------------------
About 16% of all points on the curve have this property
Of course if you know 1 slope then you know p-slope so in the case of any kind of scanning we can just save the slope and we have info for 8 points
Do you think that those points can be used for solving secp256k1? What do you think about all of this?

[kTimesG]

Interesting!

I verified that indeed, for doubling slope = 5, adding the four points cancel out (second point has an odd parity, but it was easy to fix so s = 5). And all four points do exist on the curve.

So this means we have k1 + k2 = -(k3 + k4), so there are three distinct pairing sets that add up to opposite points (same x).

Now, geometrically, if we look at the curve "bending" it's easy to see that some tangents might show up four times each, given the inflections. The only problem is whether the scalars of the points with identical tangents are related somehow. So, given some k1, find k2 or k3 or k4.

But having the sums is nice, I can imagine some scenario where this pairs sum property might help. But (just an intuition) it might only help if you know all four scalars, instead of just one, and are looking for a fast sum equality lookup.

[jovica888]

But having the sums is nice, I can imagine some scenario where this pairs sum property might help.

Well, maybe Igor Semaev's summation polynomials or index calculus or something like that
I mean this is an easier way to find 4 X to gives 0
Also, I am 100% sure that about 16% off all points have the other 3 with the same doubling slope, and together they give 0

I could not calculate scalars if I know 1 scalar. I even tried measuring the distances between those tangents

Also, the problem is if you have 1 set of 4 points, those points will not show in any other set (naturally). So there is no like colisions between sets

But if you have 1 point you can calculate 23 other points... For 1 slope, you get another 3
Then you move doubling slope with beta 2 more times and then 3 more times for p-slope, (p-slope)*beta mod p, (p-slope)*beta^2 mod p

[rdenkye]

but I did not find the way to if I have k1 to calculate k2 k3 k4

Code:

# @title Slope

#!pip install ecdsa

from ecdsa.ellipticcurve import CurveFp, Point

p = 967
a = 0
b = 7
n = 907
curve = CurveFp(p, a, b)
G = Point(curve, 418, 442, n)

print(f"{'Slope':<8}{'K1':<8}{'K2':<8}{'K3':<8}{'K4':<8}")
print("-" * 40)

def FindKs(k1):
    P = k1 * G
    x, y = P.x(), P.y()
    slope = (3 * x * x * pow(2 * y, p-2, p)) % p
    k2 = 182 * k1 % n
    k3 = 680 * k1 % n
    k4 = 44 * k1 % n

    print(f"{slope:<8}{k1:<8}{k2:<8}{k3:<8}{k4:<8}","Check:",(k1+k2+k3+k4) % n)

FindKs(497)
FindKs(32)
FindKs(378)
FindKs(529)
FindKs(875)
FindKs(410)

Code:

Slope   K1      K2      K3      K4      
----------------------------------------
194     497     661     556     100      Check: 0
301     32      382     899     501      Check: 0
472     378     771     359     306      Check: 0
495     529     136     548     601      Check: 0
666     875     525     8       406      Check: 0
773     410     246     351     807      Check: 0

[jovica888]

This code seems to be working but I added 1G

Code:

Slope   K1      K2      K3      K4
----------------------------------------
943     1       182     680     44       Check: 0
So I got this

And this are real K1 K2 K3 K4
943	1P (418, 442)	315P (85, 455)	503P (313, 102)	88P (407, 707)

How did you get these numbers  182 680 44 in the code?

Also for

Code:

47P (619, 24)
800	489P (288, 581)	695P (818, 701)	583P (248, 154)	47P (619, 24)

And in python I get

Code:

Slope   K1      K2      K3      K4
----------------------------------------
800     47      391     215     254      Check: 0

[kTimesG]

I checked the first 3000 points (G multiples) and got these stats:

1 root: 988
2 roots: 1521
3 roots: 0
4 roots: 491

So a half / third / sixth proportion between 2 / 1 / 4 quadratic roots.

Another observation: if we know (or find) three scalars, and hit same slope 4th time, we can derive k = -(k1 + k2 + k3).

So, I *think* this can weaken ECDLP security, but by a very small margin (full field only, and in exchange for the field square + multiplication, for doing the "same slope" check with a reference point).