0

I must perform calculate of substract two points:

Let $G$ be the generator point and;

$P_1 =[1]G = (x_1,y_1)$

$P_2 = [2]G = (x_2,y_2)$,

When I will subtract $P_1 - P_2$ -> I will move Point to N-1 with negative $y_1$ of $P_1$

second: Let $G$ be the generator point and;

$P_5 =[5]G = (x_1,y_1)$

$P_2 = [2]G = (x_2,y_2)$,

$P_3 = [3]G = (x_3,y_3)$,

When I will subtract $P_2 - P_5$ -> I will take result $P_3$ with negative $y_3$ of $P_3$

it looks like $P_2 - P_5$ it "similiar" to integer 2 minus integer 5 = we get minus 3 - and in this example -3 it is N-3 .

How to check that substract points cross the order of curve n? without checking y is negative?
how to check that substract point is crossed by Point of Infinity and order of the curve?

Ps. N = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141 order of curve -> maximum points.

Ironic
  • 11
  • 3
  • Welcome to Cryptography.SE. do you mean $P_1 = [1]G$ and $P_2=[2]G$? We have $\LaTeX$/MathJax enabled our site. Currently, you question is not clear. Note that, the point doesn't have floating points. $1/5$ probably means that $5^{-1}$ on the defined field. – kelalaka Apr 27 '21 at 14:58
  • P1=[1]G and P2=[2]G? Yes but 1/5 = 0.2 of P it is halfing_point by 5 it is like 0.2 of P. and we have P_1.2[G] it is equals P + halfing P by 5 . and how to check that substract is moved N-1 curve order? – Ironic Apr 27 '21 at 15:00
  • "0.2 of P it is halfing_point by 5"; I am not familiar with that terminology (and I suspect others may be in the same boat); what operation are you performing on $P$? Is it 'find the point $Q$ with $5Q = P$, and return $Q$?' – poncho Apr 27 '21 at 18:43
  • @poncho point halving possible, however, the Q is not clear to me. – kelalaka Apr 27 '21 at 19:07
  • 1
    @kelalaka: I know there is a well defined operation "point halving", however I'm not certain what he means by "point halving by 5" – poncho Apr 27 '21 at 19:09
  • fthe calculate looks like : – Ironic Apr 27 '21 at 19:23
  • the calculate looks like : divide_mode_n_by_2 = 1 / GF(n)(2) * P[1]G = 1/2P , and divide_mode_n_by_5 = 1 / GF(n)(5) * P[1] = P[0.2] = 1/5 P . And P1_2 = P + 0.2P. is now clear? – Ironic Apr 27 '21 at 19:30
  • I've edited some, and you can do the rest, as far as I can see. – kelalaka Apr 27 '21 at 19:57
  • edited to better understand. Thanks Kelalaka – Ironic Apr 27 '21 at 20:15

1 Answers1

1

How to check that substract points cross the order of curve n?

You cant'; or at least, we hope you can't.

If you could, you could use that method to compute discrete logs.

Here is one approach; suppose you had a method that, given the points $[a]G$ and $[b]G$, would return you $[a-b]G$ and also informed you whether it "crossed the order of curve n", that is, if $a < b$. Then, what you could do, given the point $[x]G$, you could use this method on the points $[x]G$ and $[\lfloor n/2 \rfloor]G$; that method would tell you if $x < \lfloor n/2 \rfloor$. If it turned out (for example) if $x$ happened to be larger, you could repeat this with $[x]G$ and $[\lfloor 3n/5 \rfloor]G$; and continue to do binary searching until you have recovered the value of $x$.

That means that you've just recovered the discrete log of $xG$ with only circa $\log_2(n)$ calls to your method; we certainly hope that we can't do that.

BTW: why do you care if "the points cross the order of curve n"?

poncho
  • 147,019
  • 11
  • 229
  • 360
  • If I know that point of substracted -> crossed the order , then I can make "application" for curve. If its not possible, maybe "how to check" that substract point moved by Point Infinity is possibility? – Ironic Apr 27 '21 at 20:39
  • @Ironic: 'then I can make "application" for curve' - I have no idea what that means – poncho Apr 27 '21 at 20:51
  • imagine calculator like in Windows system. you can add, substract, multiply, and divide. but designed for curves. – Ironic Apr 27 '21 at 20:57
  • @Ironic: if your EC calculator has things entered as $(x, y)$ coordinates, you can compute point subtraction using the standard algorithm without knowing/caring whether the result "crossed the order" (which, btw, makes sense only in terms of a specific generator). And, if it has things entered as discrete logs (e.g. 3 for [3]G), then its even easier... – poncho Apr 27 '21 at 21:29