Topic: Elliptic Curve Point Addition Question (Read 869 times)

It means that you take the result of x2 - x1 = xdiff, and then raise it to the (p-2)th power: xdiff^p-2 mod p. (xdiff^p-1 % p would be equal to 1, while xdiff^p % p is simply xdiff) where p is the curve characteristic.

It's just a shorthand way of writing the above expression as division doesn't really exist in elliptic curves but modular inverses do.

It means that you take the result of x2 - x1 = xdiff

then raise it to the (p-2)th power: xdiffp-2 mod p. (xdiffp-1 % p would be equal to 1

If L = (y2 - y1) / (x2 - x1) what does 1 / (x2 - x1) mean?

How did you get y2-y1 to equal that? When I did it it ends up being a negative number.

Also, where does modp come into it all?

Thanks so much for everyone's input so far.

Could I ask if someone would be able to provide a manual step by step example of the point addition process using actual numbers?

Here are 2 random EC points to use from secp256k1.

Privkey: DBD5EBF749EDF69369B251A9434E9B782534294066797AEF1D25ED9B9672E821

x - 109493922098989287353358202596299422915042473617120228714701225409342421241792
y - 109899546570013792669570062242083808994383794323190482590108937934309418520644

+

Privkey: 9A309407E5266673F677C583BF1068615810AF4C1B90D5A8DBB335CC15D05959

x - 69395938208587572292363152174054021882846778300880058382874375807278603471216
y - 88660534177150263324537226657815045924854945333470172921739521551593497336256

I just need the (public key) point addition. No need to do anything with the private keys, they are just there for reference if needed.

I haven't seen this done anywhere (and I've looked a lot). This would be amazing to include in my project and for me to learn what this process actually looks like on paper.

Thanks so much in advance.

Could I ask if someone would be able to provide a manual step by step example of the point addition process using actual numbers?

I am doing a school project about Bitcoin and more specifically point addition on the Elliptic Curve. I am very new to all this so please forgive my mistakes.

I have been reading that when adding points together the result can go "outside of the bounds before intersecting a third point" as in this image.



This is fascinating but also a little confusing and I would like to know more.

So my questions are:

1. Is it possible to know when the point addition process has gone outside of the field?

And

2. Is there a way (like a Python script or something) that I could use to add 2 points and it would tell me if the result went outside of the field?

I know that the result of the addition is still a valid point on the curve, but I would love to know if it passed out of bounds first.

This would be fantastic for my project to show others how this works.

I hope that made sense and thanks in advance for your help.

I also have a tool for you, which may be able to use it.
This allows you to carry out all possible bills on the SECP256K1 curve.

https://github.com/MrMaxweII/Secp256k1-Calculator

Does anyone know of a website or app where I can input the EC points and it will visually show the addition on a graph of the curve/field?

This would greatly help with my school presentation.

Thanks.

you can try to use this tool - https://www.desmos.com/calculator/ialhd71we3

Does anyone know of a website or app where I can input the EC points and it will visually show the addition on a graph of the curve/field?

This would greatly help with my school presentation.

Thanks.

Ok, lots of people telling you it can't be done, and saying that it would break ECDSA, but not a lot of explanation about why or how to think about that.

Let's look at it this way....

I assume when you say "around the clock" what you really mean is that you've come back through the base point G, or rather that the point you've generated is equal to G plus something greater than the order of the curve.

Here lies the problem.  If you can look at a point (a public key) and know that you had to add G more than a set number of times to get there, then you could calculate the private key from the point:
Was it greater than half the order? No? Ok, how about greater than a fourth of the order? Yes? Ok, how about greater than three-eighths of the order? Yes? Ok, how about greater than seven-sixteenths of the order...  and so on until you narrowed in on the exact value of the private key.

There is no way to look at 2 points, and determine which one has the greater private key.

Points are added by calculating the line that passes between both of them, and then calculating where else that line intersects the curve. If you knew the private keys for those two points to start with, then you could figure out if the sum of the two private keys was greater than the order of the curve, but if you don't know the private keys, then you don't have any way of finding out what all the points are for all the private keys that you skipped over when you added the points together. As such, there's no way to know if any of those points were G.  Again, if you could know that some given private key existed "in between" the private keys of 2 given points, then you could use that information to quickly and easily narrow in on the private key of any given point.

Does this help you understand why your question isn't going to have an answer?  You are thinking about private keys, and how if the private key exceeds the order of the curve then it "wraps around" giving the same results as the new private key minus the order of the curve, but you aren't asking about private keys.  You're asking about public keys.  Since there is no way to calculate the private key from the public key, there's no way to know what the relationship is between the private keys for 2 given public keys.  Which is greater?  How far apart are they?  You either need to know the private keys to start with, or you need to calculate every point in between to see if any of them are G.

Now, if you want to do your demonstration by picking 2 private keys, and then calculate the public keys from them... That's a different story.  In that case, you already KNOW both the private keys.  If the sum of those two integers is larger than the order of the curve, then you've wrapped around, if it isn't, then you haven't.  That's a simple calculation, and doesn't need a script.