[flagged]
Why does the all 0 public key have a known private key in SR25519 and ED25519?
11–20 of 64 posts
Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?
#12Another footgun is that Curve25519 has a cofactor of 8, which may reveal some information about your private key if some high-order points are used [1].
Some curves (eg: Ristretto) were designed to alleviate this problem.
[1] https://neilmadden.blog/2020/05/28/whats-the-curve25519-clam...
Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?
#13DES also has a weak all 0 key (ignoring parity bits)
Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?
#14DES also has a weak all 0 key (ignoring parity bits)
Why is it weak?
Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?
#15Well that made zero sense to me. Can someone ELI16?
As someone quite familiar with cryptography, or so I thought, may I humbly ask for the ELI5?
I think the ELI5 version is - if you are doing complex things with math, 0 and 1 probably have weird properties so you should avoid those numbers. If you're picking a key you should generally do it randomly as certain numbers may have special properties that are exploitable, but the chance of getting such a number by chance is basically zero.
Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?
#16DES also has a weak all 0 key (ignoring parity bits)
Why is it weak?
Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?
#17Wow. I'm not a cryptographer by any means, but have come into contact with asymmetric cryptography often enough to not do totally stupid things... But this response is really just complete and utter gibberish to me.
The gibberishness comes from the math needed to understand it and not from the knowledge of asymmetric cryptographic patterns. I highly recommend that all CS students take some abstract algebra courses for an introduction to the ideas behind this!
1. I have negligible chance of understanding your abstract algebra and 2. I'll never, ever, get to use it in the real world.
Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?
#18Well that made zero sense to me. Can someone ELI16?
Very generally speaking: with ECC using Weierstrasser curves the secret key is a x-bit integer (say x=128 for example) that is usually generated randomly and the public key is a point on the curve that you get by multiplying a "generator point" with that secret key using elliptic curve point multiplication. Actually, it is only the x-coordinate of that point but that doesn't really matter. This all has to satisfy cer…
An extra titbit for anybody who is interested in this: The Weierstrasser curve used by Bitcoin (secp256k1) has an interesting public key where the secret key is 1/2. What's so special about this (apart from the fact that the key is a nothing-up-my-sleeve number) is the x-coordinate of that public key has 162 leading 0-bits (out of 256). This can be used for saving Bitcoin transaction fees as they use the DER encoding to compress these leading 0 bits.*
Considering that it is highly unlikely that this is a coincidence it is believed that the designers of the secp256k1 curve chose the generator point based on that value. They looked at that point (1/2, P) and then they defined the generator point G as 2*P.
* NOTE: don't try this at home. If you're not clever about this you will lose all your Bitcoins.
Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?
#19Well that made zero sense to me. Can someone ELI16?
Very generally speaking: with ECC using Weierstrasser curves the secret key is a x-bit integer (say x=128 for example) that is usually generated randomly and the public key is a point on the curve that you get by multiplying a "generator point" with that secret key using elliptic curve point multiplication. Actually, it is only the x-coordinate of that point but that doesn't really matter. This all has to satisfy cer…
It’s not strange at all. The “all zero public key” is the encoding of the zero element (identity element) of the group. Finding the private key corresponding to a public key A is finding the number a so that A = a*B. When A = 0, this is really easy: a = 0.
Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?
#20Well that made zero sense to me. Can someone ELI16?
Very generally speaking: with ECC using Weierstrasser curves the secret key is a x-bit integer (say x=128 for example) that is usually generated randomly and the public key is a point on the curve that you get by multiplying a "generator point" with that secret key using elliptic curve point multiplication. Actually, it is only the x-coordinate of that point but that doesn't really matter. This all has to satisfy cer…
Thanks for putting in the effort to compose this explanation (assuming U did, and not simply asked GPT). But FYI, I did not find it helpful at all. Even after re-reading it twice.
Bawolff's concise ELI5 comment helped though.