Topic: Points where x=y on secp256k1 (Read 402 times)

These are the values for endomorphism on secp256k1. You can read the original post from Hal Finney deriving these values here: https://bitcointalksearch.org/topic/m.45565

Lambda is such that Lambda^3 (mod N) = 1.
Beta is such that Beta^3 (mod P) = 1.

Can anyone explain the following?


What is the use of the keys above?

Edit, so far I figured if we multiply a point by lambda, it will add our key to it and there won't be any multiplication and it also steals our y coordinate. So what is the use of that? About beta, I can't find anything meaningful in my results, is there any?

If you could find one "weak" generator, the security of the whole bitcoin would be broken

That is why it's assumed there are no weak generators, as none has been found. And to be honest, I cant imagine why one would be weaker than all the others
 

Absolutely nothing because one Generator in not different from another in term of security

the equation of the secp256k1 curve is
x³+7=y² mod(P)
or

x³+7-y²=0 mod(P)
 
if x=y
then
x³-x²+7=0

this equation is a polynomial of degree 3 in Finite Field and have no roots (solutions)


instead of looking for x=y we can find if roots exists replacing x=y+c  in the polynomial equation
where c in a constant varying between the range [-10;10] e.g
This is my Sage script:

We test G and -G to see if one corresponding to x==y+c


see above...

So. if we are talking abouy the curve and we have Fp and N :

field Fp is defined by :
Fp = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F

order:
Fn = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141

your point x,y where
x==103219894018170979103981239500535823206309202530631329673674059809050911020508
y==103219894018170979103981239500535823206309202530631329673674059809050911020507

it is real point as half_mod Fp/Fn , I got problem to explain my english is not so good to technical explain.

How do you know that? Is there any simple way to check, if for a given p-value, there is such point or not?

Nice result! But how it was calculated?

Because it should be a point on curve, exactly as specified in the first post:
Now I only wonder, what algorithm is needed to get there?

Sorry i don't understand your post...and why I'm wrong
I speak about coordinate in affine plan
as Q->(x,y)

Q : (103219894018170979103981239500535823206309202530631329673674059809050911020508,103219894018170979103981239500535823206309202530631329673674059809050911020507)
or 04e43463c1a7b06b6e49f555d75238bd140690ee0f689fda75d87623e10acf95dce43463c1a7b06 b6e49f555d75238bd140690ee0f689fda75d87623e10acf95db (uncompresed pubkey)
or 03e43463c1a7b06b6e49f555d75238bd140690ee0f689fda75d87623e10acf95dc
is a perfect valid bitcoin pubkey

No there is no point in secp256k1 where x==y
but there is one where x==y+1

x=103219894018170979103981239500535823206309202530631329673674059809050911020508
y=103219894018170979103981239500535823206309202530631329673674059809050911020507

(x**3+7)%P==(y**2)%P => True

I see what you're getting at! In the equation


If we assume that x and y are equal, we can substitute that into the equation to simplify it to.

  This simplification gives us a cubic equation, which could potentially have three solutions.

When we're working with elliptic curve cryptography it's important to understand that we're dealing with points on the curve that satisfy both the x and y coordinates.
Not every combination of x and y will be a valid point on the curve.  For the secp256k1 curve which is the one used in Bitcoin.

defines the curve itself. But not all x and y values will give us valid points on the curve.
This is because the curve is defined over a finite field, and the coordinates (x, y) must satisfy the equation modulo a large prime number.

So, while it's true that there may exist y-values corresponding to certain x-values that satisfy the equation, we need to check if both x and y fall within the valid range of values for the finite field defined by the curve's prime modulus.

In your example of :

which satisfies
It is important to note that it may not correspond to a valid point on the secp256k1 curve.
To determine if a point (x, y) is on the curve, we must ensure that both x and y are valid values within the finite field defined by the curve's prime modulus.

For starters, the real solution to y² = x³+7 when x = y is -1.63109... I know that doesn't help, but I had fun looking it up.

How exactly x^2 is = x^3+7? Is that a typo? Also have you ever seen x=y in secp256k1?
A few months ago as I was playing around with xs and ys, I remember to see something like x=y, but since I had no  clue what that could really mean, I just ignored it.

Main question, what would be the result of finding such points on secp256k1?

Are there any such points? For some elliptic curves with less bits they can be found. I wonder if there are any such points for secp256k1, and if so, how to calculate those public keys? Even without private keys (that could be hard to find in such huge space), calculating those public keys alone could be interesting.

For example, if we use "p=14071, n=13933, base=(1,3660)", then we can find those values:
As far as I understand, if we have y^2=x^3+7, then in this case we would have x=y, so x^2=x^3+7. That means, if we look at complex numbers, then we would have three solutions for such equation. Of course, not every real point can be always represented, so when we have (1,sqrt(8)) as a solution, where x=1, and y=sqrt(8), then it is on some elliptic curve only if "sqrt(8)" can be represented modulo "p" (so if there is any value between 1 and p-1, that would give us 8, when it is multiplied by itself).