[flagged]
"It's never Aliens" applies.
Why does the all 0 public key have a known private key in SR25519 and ED25519?
21–30 of 64 posts
Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?
#22Earlier quoted context omitted.
Very generally speaking: with ECC using Weierstrasser curves the secret key is a x-bit integer (say x=128 for example) that is usually generated randomly and the public key is a point on the curve that you get by multiplying a "generator point" with that secret key using elliptic curve point multiplication. Actually, it is only the x-coordinate of that point but that doesn't really matter. This all has to satisfy cer…
An extra titbit for anybody who is interested in this: The Weierstrasser curve used by Bitcoin (secp256k1) has an interesting public key where the secret key is 1/2. What's so special about this (apart from the fact that the key is a nothing-up-my-sleeve number) is the x-coordinate of that public key has 162 leading 0-bits (out of 256). This can be used for saving Bitcoin transaction fees as they use the DER encoding…
Would that be a way to leverage fees in trades?
Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?
#23Earlier quoted context omitted.
Very generally speaking: with ECC using Weierstrasser curves the secret key is a x-bit integer (say x=128 for example) that is usually generated randomly and the public key is a point on the curve that you get by multiplying a "generator point" with that secret key using elliptic curve point multiplication. Actually, it is only the x-coordinate of that point but that doesn't really matter. This all has to satisfy cer…
It’s not strange at all. The “all zero public key” is the encoding of the zero element (identity element) of the group. Finding the private key corresponding to a public key A is finding the number a so that A = a*B. When A = 0, this is really easy: a = 0.
It's strange if you come from Weierstrasser curves and think of public keys as points on the curve, which I think is what most people start with. I was obviously oversimplifying heavily.
Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?
#24I’m a coauthor of Ristretto.
There is a much more concise explanation than in the linked post: in Ristretto, the encoding of group elements was constructed so that the encoding of the identity (zero) element of the group is the all-zero byte string. So it’s not surprising that the all-zero byte string has a known private key: it’s the all-zero secret key.
This aspect of the encoding makes it very easy to check whether a provided group element is the identity element, because “zero means zero”.
What the questioner seems to be looking for is a way to generate “burn addresses”, public keys with the property that everyone can be sure that no one else knows the secret key to. This is actually kind of hard: if I just give you a public key, how do you know I didn’t generate it from a secret key I know?
The correct answer to this “nothing-up-my-sleeve” problem is to have a group-valued hash function, which Ristretto provides. Then public keys can be specified as the outputs of the hash function.
Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?
#25Earlier quoted context omitted.
The gibberishness comes from the math needed to understand it and not from the knowledge of asymmetric cryptographic patterns. I highly recommend that all CS students take some abstract algebra courses for an introduction to the ideas behind this!
1. I have negligible chance of understanding your abstract algebra and 2. I'll never, ever, get to use it in the real world.
Might as well take an Introduction to Semiconductor Devices engineering course while you're at it. Just as relevant when it comes to software development.
Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?
#26Earlier quoted context omitted.
Very generally speaking: with ECC using Weierstrasser curves the secret key is a x-bit integer (say x=128 for example) that is usually generated randomly and the public key is a point on the curve that you get by multiplying a "generator point" with that secret key using elliptic curve point multiplication. Actually, it is only the x-coordinate of that point but that doesn't really matter. This all has to satisfy cer…
Thanks for putting in the effort to compose this explanation (assuming U did, and not simply asked GPT). But FYI, I did not find it helpful at all. Even after re-reading it twice. Bawolff's concise ELI5 comment helped though.
Thanks for the feedback. It's certainly interesting to see that you did not find it helpful at all. I was oversimplifying so much that I felt uncomfortable about it because I feel like some aspects of my answer are just borderline wrong. I don't think I can make it even simpler. Explaining highly technical issues to people without any background in that field really is a tough skill that I apparently don't possess.
Also: I did not use ChatGPT. Proof: Any native english speaker can tell you that my answers do not come from a native speaker. I don't think ChatGPT can mimic that (yet). English not being your first language can have its virtues.
Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?
#27Earlier quoted context omitted.
Why is it weak?
https://en.wikipedia.org/wiki/Weak_key#Weak_keys_in_DES
Ah, I had looked for zero, null, and 000 in the DES Wikipedia article but it wasn't mentioned. Didn't think to search for a dedicated article. Thanks!
Saving others a click:
> DES has a few specific keys termed "weak keys" and "semi-weak keys". These are keys that cause the encryption mode of DES to act identically to the decryption mode of DES
Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?
#28Earlier quoted context omitted.
It’s not strange at all. The “all zero public key” is the encoding of the zero element (identity element) of the group. Finding the private key corresponding to a public key A is finding the number a so that A = a*B. When A = 0, this is really easy: a = 0.
It's strange if you come from Weierstrasser curves and think of public keys as points on the curve, which I think is what most people start with. I was obviously oversimplifying heavily.
It's "Weierstrass". I don't believe they're describing a different model of public keys. The private key in all of these schemes is a scalar.
Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?
#29Wow. I'm not a cryptographer by any means, but have come into contact with asymmetric cryptography often enough to not do totally stupid things... But this response is really just complete and utter gibberish to me.
The gibberishness comes from the math needed to understand it and not from the knowledge of asymmetric cryptographic patterns. I highly recommend that all CS students take some abstract algebra courses for an introduction to the ideas behind this!
It also comes from silly names of libraries and tools used in the example as well.
Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?
#30I’m a coauthor of Ristretto. There is a much more concise explanation than in the linked post: in Ristretto, the encoding of group elements was constructed so that the encoding of the identity (zero) element of the group is the all-zero byte string. So it’s not surprising that the all-zero byte string has a known private key: it’s the all-zero secret key. This aspect of the encoding makes it very easy to check whethe…
Just out of curiosity: is a similar problem (generate a valid public key that surely nobody including myself can know the private key of) solvable for RSA?