How do you invert an ECDSA multiplication to get the generator?

Question

Pieter Wuille said:

[...](people often assume that no inverse for EC multiplication exists, which is true, but only to solve for k in k*P = Q; solving for P is possible).

When you multiply a scalar value by an EC point, you get an EC point. According to the above comment, it is possible to take the output point and derive the input point. How is this done? Does it require knowing k?

Note that I'm specifically not asking about extracting the scalar value (k) from the output point.

Also note that this wouldn't be useful to breaking Bitcoin signature algorithm - the generator that private keys are multiplied by is publicly known.

score 7 · Accepted Answer · answered Mar 09 '15 at 18:27

7

k is just a scalar, modulo the order of the elliptic curve group.

Q = k*P

thus:

(1/k)*Q = (1/k)*k*P

thus:

(1/k)*Q = P

You find P by multiplying Q with the multiplication inverse of k modulo the curve order.

answered Mar 09 '15 at 18:27

Pieter Wuille

105,497
9
194
308

1

... where the inverse of k can be computed using the extended Euclidean algorithm. – Nate Eldredge Mar 09 '15 at 20:24
2

... or by raising it to the (order-2)'th power modulo order (which is only allowed because order is prime in this case). – Pieter Wuille Mar 10 '15 at 12:47

How do you invert an ECDSA multiplication to get the generator?

1 Answers1

Linked