4 ms·

Well that made zero sense to me. Can someone ELI16?

by Jabrov 4y ago

reportgunner 4y ago
It uses math and it uses 0. When you use 0 in math everything becomes 0 after you multiply it. The more you multiply the more 0 it becomes. I bet you have to multiply a lot in cryptography.
- oleganza 4y ago
  Math is about precision, so it's generally not a good idea to have something become "more 0" than actually needed. Especially in cryptography. So here's my advice. If you multiplied too much by zero, you can make it less 0 by dividing a few times by zero. Then maths would be closer to the precise 0 that you were looking for in the first place.
detrites 4y ago
As someone quite familiar with cryptography, or so I thought, may I humbly ask for the ELI5?
- bawolff 4y ago
  I think the ELI5 version is - if you are doing complex things with math, 0 and 1 probably have weird properties so you should avoid those numbers. If you're picking a key you should generally do it randomly as certain numbers may have special properties that are exploitable, but the chance of getting such a number by chance is basically zero.
nailer 4y ago
You can ask questions about crypto to real cryptographers on https://crypto.stackexchange.com https://crypto.stackexchange.com. My layperson, 30 second understanding is: - If you remember RSA, ECC replaces RSA because it has better performance. - In ECC, public keys are points on a curve. There's two main types of EC curves: - A Weierstrass curve looks like a pimple (classical ECC) - you'll see this in older crypto systems. - An Edwards curve looks like a butthole - more popular these days, as it has less 'exceptional cases' on the curve which don't confirm to normal 'add two points together to get a third point' maths. - 'Ristretto' turns out to be the ECC-based key derivation algorithm used by Polkadot cryptocurrency: https://wiki.polkadot.network/docs/learn-cryptography https://wiki.polkadot.network/docs/learn-cryptography or https://ristretto.group/ https://ristretto.group/ and is based on Edwards curves. The second answer (typical for Stack Exchange sites) summarizes it well): > In the Ristretto group, 0 is a member of the group, while in Secp256k1 it is not.
KennyFromIT 4y ago
The question asks why the all 0 public key in SR25519 and ED25519 has a known private key and what users should be aware of when using these curves. The answer explains that this is due to the mathematical properties of the Edwards curve models used in these curves and suggests using hash-to-curve to generate unspendable funds instead of the all zero public key.
xurukefi 4y ago
Very generally speaking: with ECC using Weierstrasser curves the secret key is a x-bit integer (say x=128 for example) that is usually generated randomly and the public key is a point on the curve that you get by multiplying a "generator point" with that secret key using elliptic curve point multiplication. Actually, it is only the x-coordinate of that point but that doesn't really matter. This all has to satisfy certain mathematical properties. Most importanly given a public key (remember, this is a point on the curve) it should not be possible to undo the multiplication to retrieve the secret key. If you understand this it becomes obvious why it is strange that people seem to be able to know the private key of the all 0 public key. Getting to that point on the curve would either require undoing the multiplication or brute force, both of which are not feasible assuming that ECC is not broken. Without going to deep: the explanation of this penomenon is that ed25519 uses a different curve model (not Weierstrasser curves) where this logic does not completely apply due to special cases.
- xurukefi 4y ago
  An extra titbit for anybody who is interested in this: The Weierstrasser curve used by Bitcoin (secp256k1) has an interesting public key where the secret key is 1/2. What's so special about this (apart from the fact that the key is a nothing-up-my-sleeve number) is the x-coordinate of that public key has 162 leading 0-bits (out of 256). This can be used for saving Bitcoin transaction fees as they use the DER encoding to compress these leading 0 bits.* Considering that it is highly unlikely that this is a coincidence it is believed that the designers of the secp256k1 curve chose the generator point based on that value. They looked at that point (1/2, P) and then they defined the generator point G as 2*P. * NOTE: don't try this at home. If you're not clever about this you will lose all your Bitcoins.
  - kebman 4y ago
    Would that be a way to leverage fees in trades?
- hdevalence 4y ago
  It’s not strange at all. The “all zero public key” is the encoding of the zero element (identity element) of the group. Finding the private key corresponding to a public key A is finding the number a so that A = a*B. When A = 0, this is really easy: a = 0.

Well that made zero sense to me. Can someone ELI16?

by Jabrov 4y ago

Well that made zero sense to me. Can someone ELI16?

It uses math and it uses 0. When you use 0 in math everything becomes 0 after you multiply it. The more you multiply the more 0 it becomes. I bet you have to multiply a lot in cryptography.

oleganza 4y ago
Math is about precision, so it's generally not a good idea to have something become "more 0" than actually needed. Especially in cryptography. So here's my advice. If you multiplied too much by zero, you can make it less 0 by dividing a few times by zero. Then maths would be closer to the precise 0 that you were looking for in the first place.

detrites 4y ago

As someone quite familiar with cryptography, or so I thought, may I humbly ask for the ELI5?

bawolff 4y ago
I think the ELI5 version is - if you are doing complex things with math, 0 and 1 probably have weird properties so you should avoid those numbers. If you're picking a key you should generally do it randomly as certain numbers may have special properties that are exploitable, but the chance of getting such a number by chance is basically zero.

nailer 4y ago

You can ask questions about crypto to real cryptographers on https://crypto.stackexchange.com https://crypto.stackexchange.com. My layperson, 30 second understanding is: - If you remember RSA, ECC replaces RSA because it has better performance. - In ECC, public keys are points on a curve. There's two main types of EC curves: - A Weierstrass curve looks like a pimple (classical ECC) - you'll see this in older crypto systems. - An Edwards curve looks like a butthole - more popular these days, as it has less 'exceptional cases' on the curve which don't confirm to normal 'add two points together to get a third point' maths. - 'Ristretto' turns out to be the ECC-based key derivation algorithm used by Polkadot cryptocurrency: https://wiki.polkadot.network/docs/learn-cryptography https://wiki.polkadot.network/docs/learn-cryptography or https://ristretto.group/ https://ristretto.group/ and is based on Edwards curves. The second answer (typical for Stack Exchange sites) summarizes it well): > In the Ristretto group, 0 is a member of the group, while in Secp256k1 it is not.

KennyFromIT 4y ago

The question asks why the all 0 public key in SR25519 and ED25519 has a known private key and what users should be aware of when using these curves. The answer explains that this is due to the mathematical properties of the Edwards curve models used in these curves and suggests using hash-to-curve to generate unspendable funds instead of the all zero public key.

xurukefi 4y ago

Very generally speaking: with ECC using Weierstrasser curves the secret key is a x-bit integer (say x=128 for example) that is usually generated randomly and the public key is a point on the curve that you get by multiplying a "generator point" with that secret key using elliptic curve point multiplication. Actually, it is only the x-coordinate of that point but that doesn't really matter. This all has to satisfy certain mathematical properties. Most importanly given a public key (remember, this is a point on the curve) it should not be possible to undo the multiplication to retrieve the secret key. If you understand this it becomes obvious why it is strange that people seem to be able to know the private key of the all 0 public key. Getting to that point on the curve would either require undoing the multiplication or brute force, both of which are not feasible assuming that ECC is not broken. Without going to deep: the explanation of this penomenon is that ed25519 uses a different curve model (not Weierstrasser curves) where this logic does not completely apply due to special cases.

xurukefi 4y ago
An extra titbit for anybody who is interested in this: The Weierstrasser curve used by Bitcoin (secp256k1) has an interesting public key where the secret key is 1/2. What's so special about this (apart from the fact that the key is a nothing-up-my-sleeve number) is the x-coordinate of that public key has 162 leading 0-bits (out of 256). This can be used for saving Bitcoin transaction fees as they use the DER encoding to compress these leading 0 bits.* Considering that it is highly unlikely that this is a coincidence it is believed that the designers of the secp256k1 curve chose the generator point based on that value. They looked at that point (1/2, P) and then they defined the generator point G as 2*P. * NOTE: don't try this at home. If you're not clever about this you will lose all your Bitcoins.
- kebman 4y ago
  Would that be a way to leverage fees in trades?
hdevalence 4y ago
It’s not strange at all. The “all zero public key” is the encoding of the zero element (identity element) of the group. Finding the private key corresponding to a public key A is finding the number a so that A = a*B. When A = 0, this is really easy: a = 0.