Why does the all 0 public key have a known private key in SR25519 and ED25519?
substrate.stackexchange.com
Why does the all 0 public key have a known private key in SR25519 and ED25519?
1–10 of 64 posts
Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?
#2[flagged]
Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?
#3[flagged]
[deleted]
Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?
#4Well that made zero sense to me. Can someone ELI16?
Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?
#5Well that made zero sense to me. Can someone ELI16?
As someone quite familiar with cryptography, or so I thought, may I humbly ask for the ELI5?
Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?
#6Well that made zero sense to me. Can someone ELI16?
You can ask questions about crypto to real cryptographers on https://crypto.stackexchange.com. My layperson, 30 second understanding is:
- If you remember RSA, ECC replaces RSA because it has better performance.
- In ECC, public keys are points on a curve. There's two main types of EC curves:
- A Weierstrass curve looks like a pimple (classical ECC) - you'll see this in older crypto systems.
- An Edwards curve looks like a butthole - more popular these days, as it has less 'exceptional cases' on the curve which don't confirm to normal 'add two points together to get a third point' maths.
- 'Ristretto' turns out to be the ECC-based key derivation algorithm used by Polkadot cryptocurrency: https://wiki.polkadot.network/docs/learn-cryptography or https://ristretto.group/ and is based on Edwards curves.
The second answer (typical for Stack Exchange sites) summarizes it well):
> In the Ristretto group, 0 is a member of the group, while in Secp256k1 it is not.
Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?
#7Well that made zero sense to me. Can someone ELI16?
The question asks why the all 0 public key in SR25519 and ED25519 has a known private key and what users should be aware of when using these curves. The answer explains that this is due to the mathematical properties of the Edwards curve models used in these curves and suggests using hash-to-curve to generate unspendable funds instead of the all zero public key.
Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?
#8Wow. I'm not a cryptographer by any means, but have come into contact with asymmetric cryptography often enough to not do totally stupid things... But this response is really just complete and utter gibberish to me.
Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?
#9Well that made zero sense to me. Can someone ELI16?
Very generally speaking: with ECC using Weierstrasser curves the secret key is a x-bit integer (say x=128 for example) that is usually generated randomly and the public key is a point on the curve that you get by multiplying a "generator point" with that secret key using elliptic curve point multiplication. Actually, it is only the x-coordinate of that point but that doesn't really matter. This all has to satisfy certain mathematical properties. Most importanly given a public key (remember, this is a point on the curve) it should not be possible to undo the multiplication to retrieve the secret key.
If you understand this it becomes obvious why it is strange that people seem to be able to know the private key of the all 0 public key. Getting to that point on the curve would either require undoing the multiplication or brute force, both of which are not feasible assuming that ECC is not broken.
Without going to deep: the explanation of this penomenon is that ed25519 uses a different curve model (not Weierstrasser curves) where this logic does not completely apply due to special cases.
Re: Why does the all 0 public key have a known private key in SR25519 and ED25519?
#10Wow. I'm not a cryptographer by any means, but have come into contact with asymmetric cryptography often enough to not do totally stupid things... But this response is really just complete and utter gibberish to me.
The gibberishness comes from the math needed to understand it and not from the knowledge of asymmetric cryptographic patterns. I highly recommend that all CS students take some abstract algebra courses for an introduction to the ideas behind this!