1

In elliptic curve cryptography using the secp256k1 curve, how can I determine the number of times the base point $G$ has been multiplied to derive a new point? The formula is as follow:

$k * G = Q$

Where:

  • $k$ is an integer
  • $G$ is the base point on the curve
  • $Q$ is the resulting point after multiplying $G$ by $k$

How can I find the value of $k$ such that: $Q = k * G$ ?

fgrieu
  • 140,762
  • 12
  • 307
  • 587
Aviril Smith
  • 21
  • 2

1 Answers1

2

There is no known feasible method to find the private key $k$ for a random public key $Q$, or equivalently for $Q$ computed from a random secret $k$ in $[0,n)$, where $n$ is the known order of secp256k1. Otherwise, widely deployed elliptic curve cryptography would be unsafe.

This the Discrete Logarithm Problem, instantiated on an elliptic curve group, specifically a Koblitz elliptic curve of 256-bit prime order $n$, over a 256-bit prime field.

The least infeasible known methods using classical computing means are variations of Pollard's Rho or Pollard's Kangaroo/Lambda, with slight tuneups using the special structure of secp256k1, and distributed over many CPUs using techniques in Paul C. van Oorschot and Michael J. Wiener, Parallel Collision Search with Cryptanalytic Applications, in Journal of Cryptology, 1999. These methods themselves are probabilistic variants, using feasibly little memory and not much more computing power, of the simpler Baby Step/Giant Step, which is practically infeasible (for parameters as large as in secp256k1) not only because of computing power, but also because of memory requirements.

These least infeasible methods would require in the order of $\sqrt n\approx2^{128}$ points additions. With the best ASIC technology currently available, the electricity produced worldwide in 2022 (~30,000 TW⋅h) would not be enough for 0.00001% of that many point additions. By 2016, the public DLP record was for 118-bit $n$, rather than 256-bit $n$ for secp256k1. I'm not aware of later records.

Other methods might be feasible with Cryptographicaly Relevant Quantum Computers, but we do not have these, and they remain highly hypothetical.

If it's known that $Q$ was generated as $k*G$ with $k$ generated in some known way (e.g. from a memorable password by a known key derivation function), then it might be possible to guess $k$ (e.g. by guessing, obtaining or brute-forcing the password and applying the method that led to $k$), and verifying the guess. Other feasible ways of obtaining $k$ might exist, e.g. extraction from a device that holds it.

fgrieu
  • 140,762
  • 12
  • 307
  • 587
  • What is the special structure of secp256k1? – kelalaka Oct 30 '23 at 16:28
  • @kelalaka: I mean secp256k1 is a Koblitz curve on prime field $F_p$, rather than a more general curve in Weierstrass form on any field. It's equation can be written as $x^3=y^2-b\pmod p$. And $p$ has two non-trivial square roots of unity (including $r=$7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee). It follows that $(x,y)\mapsto(r,x,y)$ is a non-trivial and efficient endomorphism on secp256k1. That allows some speedups. – fgrieu Oct 30 '23 at 17:41
  • 1
    Okey, It is the non-trivial endomorphism that can speed up ~%50. I've expected much more improvement. – kelalaka Oct 30 '23 at 18:18