How to calculate Lambda and Beta for n and p?

digaran

copper member

Activity: 1330

Merit: 899

🖤😏

I thought there is only 1 Lambda that if we multiply our point with it we would get same y coordinates, but there are 4 special keys.

Code:

1 = 37718080363155996902926221483475020450927657555482586988616620542887997980020
2 = 37718080363155996902926221483475020450927657555482586988616620542887997980019
3 = 37718080363155996902926221483475020450927657555482586988616620542887997980018
4 = 37718080363155996902926221483475020450927657555482586988616620542887997980017

Multiplying by 4 and 1 results in 2 identical y coordinates, and ~~multiplying by 3 and 2 again results in 2 identical y's.~~

A couple of month ago I discovered similar behaviour but not related to y, for example multiplying by n/2+1 gives us 1/5 of our key, p*n/2+2 = p2/5, p*n/2+3 = p3/5 etc.

I haven't tested the 4 lambdas yet to see what the result of division is, I hope it's something interesting.

Edit, multiplying by 3, gives us +n y, multiplying by 2 results in -n y.

j2002ba2

full member

Activity: 206

Merit: 447

lambda and beta are non-trivial cube roots of 1 modulo n and p.
λ³ = 1 (mod n)
β³ = 1 (mod p)
[λ](x,y) = (βx,y)

Since there are 3 of each you'd have to match them (2 are non-trivial, so there is just one equality check).

You could find how to get such root of 1 here.

So, let your curve is modulo q, and has order m, both prime numbers.
Compute a primitive root of 1 modulo q:
a≠1
a^q-1 = 1 (mod q)
Then the cube root of 1 would be:
k = a^(q-1)/3 = 1^1/3 (mod q)

Instead of finding a primitive root of 1, one could directly find a cube root of 1, this is faster:
k = (-1-sqrt(-3))/2 (mod q)

Do the same modulo the order of the curve m:
b≠1
b^m-1 = 1 (mod m)
λ = b^(m-1)/3 = 1^1/3 (mod m)

Then check which one matches:
[λ](x,y) = (kx,y)
β = k
or
[λ](x,y) = (k²x,y)
β = k² (mod q)

digaran

copper member

Activity: 1330

Merit: 899

🖤😏

I know Hal (rip) talked about them here but since I'm not that good with math, I can't find a way to calculate them for other curves, if I'm not mistaken Lambda is derived from n while Beta is derived from p, correct? Is there a formula preferably in python to derive these 2 values for different curves?

I'd appreciate the help, I'm just trying to test different curves, using Lambda and Beta as n and p, then if I have a way to calculate the lambda value for secp256k1's Lambda I could use them for my studies.

Topic: How to calculate Lambda and Beta for n and p? (Read 147 times)