<p>Mathematicians like their analogies, sometimes those analogies can be helpful, but they can equally be confusing, particularly to those new to a field.</p>
<p>In mathematics a &quot;group&quot; consists of a set of elements and an operator that satisfies some requirements. The operator must be associative, there must exist an identity element, and for every element there must exist an inverse element under the operator.</p>
<p>Some groups are written by analogy to addition, that is the group operator is represented by a &quot;+&quot; sign, and the identity element is represented by &quot;0&quot;. Other groups are written by analogy to multiplication, that is the group operator is written as a multiplication operation (e.g. &quot;*&quot;,&quot;.&quot; or nothing at all) and the identity element is represented by &quot;1&quot;. Elliptic curves are traditionally written by analogy to addition.</p>
<p>We can conceive of applying the group operator repeatedly to k copies of G. If the group is written by analogy to addition then this is analogous to multiplication, if the group is written by analogy to multiplication then this is analogous to exponentiation.</p>
<p>So <code>k * G</code> refers not to regular multiplication but to an operation that is in a particular way analogous to multiplication.</p>
<p>You might naively think that this would take time proportional to k, but thanks to the associativity we can calculate it in time proportional to the logarithm of k. So we can quickly calculate <code>k * G</code> even for very large k.</p>
<p>Reversing the operation is not so easy though. The problem is known as the &quot;Elliptic curve discrete logarithm problem&quot; and the best known methods have a complexity proportional to roughly the square root of the number of elements in the group.</p>
<p>Why is it called the &quot;Elliptic curve discrete logarithm problem&quot; when it's more analogous to division than to a logarithm in the notation typically used for elliptic curves? because it's a variant of a similar problem studied for a group that is traditionally written by analogy to multiplication.</p>

CC BY-SA 4.0
2021-12-16T10:58:36.297Z
*"Other groups are written by analogy to multiplication, that is the . Elliptic curves are traditionally written by analogy to addition."* Probably a few words got eaten there. Also I suggest using the full name "discrete logarithm" rather than the abbreviated "discrete log" as it's not necessarily obvious to a profane what this "log" means.
Stef
CC BY-SA 4.0
2021-12-16T05:43:53.920Z
2021-12-16T18:45:03.937Z
2021-12-16T18:45:03.937Z
Peter Green
<p>k = K/G is somewhat misleading notation. In many ways, it's better to write k = K * G^-1. This emphasizes that there are <em>two</em> operations involved in &quot;division&quot;: multiplication, and taking the inverse (Also, it makes it easier to recognize that K * G^-1 and G^-1 * K are distinct concepts and that the existence of G^-1 need to be shown to exist. This isn't as important here because elliptic curve multiplication is abelian and always has an inverse, but those are considerations that you need to keep in mind when dealing with groups and rings in general.)</p>
<p>Elliptic curve math takes place in an abstract group, not within the real number system, and using real number notation encourages misleading intuition (and in abstract algebra, the slash is used for quotient groups, not for dividing elements of a group). The fact that taking the inverse in elliptic curve math is hard is what makes it a cryptographic system in the first place. Otherwise, anyone who had the public key could invert the encryption rather trivially. &quot;Cryptographic system&quot; almost by definition refers to a system with some operation such that finding a*b is significantly easier than finding a^-1.</p>
<p>(There are ways of calculating K * G^-1 without explicitly calculating G^-1, but they're still as hard or harder than finding G^-1.)</p>
<blockquote>
<p>And if it is not, how is it created out of the private key?</p>
</blockquote>
<p>Huh? You just gave the equation for the public key: K = k * G.</p>
<p>Also, I think that you should include that you're talking about secp256k1 in the body of your text, rather than just as a tag. It might be inferred from this being the Bitcoin SE, but it's good for it to be explicit.</p>

CC BY-SA 4.0
2021-12-15T03:13:52.480Z
I find this explanation more confusion to be honest. G^-1 isn't a thing you can compute. What would its type be? Not a point, because then K*G^-1 would be point^2, which doesn't exist. And not a scalar because then K*G^-1 would be a point. You'd need to introduce a concept of "points inverted", which AFAIK doesn't exist, and also is unrelated to how K/G is actually computed in algorithms like Pollard's rho... which actually take in K and G as inputs - not just G - and output k.
Pieter Wuille
CC BY-SA 4.0
2021-12-15T19:49:32.793Z
@PieterWuille: You're erroneously applying real arithmetic to abstract algebra, just as Accumulation warned against.  The "type" of a product over an abstract group has units which are the product of the units of the two inputs, but the dimension is not so simple.  For example, a 3-D vector cross product has 3-D just like both inputs, and a vector dot product yields a scalar no matter what the dimension of the inputs was.  Another example: a square matrix has an inverse with the same dimension as itself, and that poses no problems when multiplying the inverted matrix by column vectors.
Ben Voigt
CC BY-SA 4.0
2021-12-15T20:21:12.090Z
The answer literally states "... but they're still as hard or harder than finding G^-1". This is, to the best of my knowledge, a false statement, as there is no known way of computing G^-1 (even ignoring the question of what its type would be). Algorithms for computing a discrete logarithm (= division of two group elements) take two group elements as input. They do not compute the inverse of one and then multiply it with the other. You could certainly define "inverse of a group element w.r.t. scalar multiplication" as some abstract object, but that isn't how you'd compute it.
Pieter Wuille
CC BY-SA 4.0
2021-12-15T20:40:55.817Z
There is more wrong here. The inverse we're talking about is the inverse w.r.t. scalar multiplication (number times group element), not the inverse w.r.t. the group operation itself (group element plus group element). The latter exists for every element in every group (including non-abelian groups). The former however, if you'd want to define it, certainly does _not_ exist for every element of an abelian group; it does for every non-zero element in secp because it's cyclic with prime order, but in general it won't exist for elements with non-maximal order in the group.
Pieter Wuille
CC BY-SA 4.0
2021-12-15T01:00:56.303Z
2021-12-15T01:00:56.303Z
Acccumulation
<blockquote>
<p>How I understood it, the equation for the public key is defined as so <code>K = k * G</code>
With K being the public key, k the private key and G the generator point.</p>
</blockquote>
<p>That's correct.</p>
<blockquote>
<p>Now my first question, is G a constant? (as far as I read, it is a constant)</p>
</blockquote>
<p>It is. It is the point with coordinates <code>(55066263022277343669578718895168534326250603453777594175500187360389116729240,  32670510020758816978083085130507043184471273380659243275938904335757337482424)</code>. You can verify that these coordinates satisfy the <a href="https://en.wikipedia.org/wiki/Elliptic_curve" rel="noreferrer">curve</a> equation: <code>Y^2 = X^3 + 7 (mod 115792089237316195423570985008687907853269984665640564039457584007908834671663)</code>.</p>
<blockquote>
<p>And if it is, how is it not possible to simply do K/G = k?</p>
</blockquote>
<p>The answer is simply that we don't know of an efficient way to do &quot;division&quot; for elliptic curves (which is called the <a href="https://en.wikipedia.org/wiki/Discrete_logarithm_records#Elliptic_curves" rel="noreferrer">discrete logarithm</a> problem), and it is assumed no such way can be found. The best known <a href="https://en.wikipedia.org/wiki/Pollard%27s_rho_algorithm_for_logarithms" rel="noreferrer">algorithm</a> for doing this for this specific curve takes around 2<sup>128</sup> iterations, an impossibly large amount.</p>
<p>You have to be aware that the <code>*</code> in <code>k * G</code> as you write it is no ordinary multiplication (what would that even mean for points?). It is a rather <a href="https://en.wikipedia.org/wiki/Elliptic_curve_point_multiplication" rel="noreferrer">complicated operation</a>, and people have figured out useful properties of it which are somewhat similar to multiplication (it forms a <a href="https://en.wikipedia.org/wiki/Cyclic_group" rel="noreferrer">cyclic group</a>, so the same symbol is used). But nobody ever found a way to perform the reverse operation, and this became the basis for <a href="https://en.wikipedia.org/wiki/Elliptic-curve_cryptography" rel="noreferrer">elliptic curve cryptography</a>.</p>

CC BY-SA 4.0
2021-12-14T16:18:32.187Z
This cleared up a lot for me. Thank you for the explanation and links!
Purple Gang
CC BY-SA 4.0
2021-12-14T15:52:25.783Z
2021-12-14T15:52:25.783Z
Pieter Wuille
<p>From how I understand it, the equation for the public key is defined as so:</p>
<blockquote>
<p><code>K = k * G</code></p>
</blockquote>
<p>With K being the public key, k the private key and G the generator point.</p>
<ul>
<li>Is G a constant? (as far as I read, it is a constant.)</li>
<li>If it is, how is it not possible to simply do K/G = k?</li>
<li>If it is not, how is it created out of the private key?</li>
</ul>

<public-key><secp256k1>
Why is it not possible to get the private key out of the public key?
Purple Gang
# Why is it not possible to get the private key out of the public key?

(Asked by: username_0 on 2021-12-14)

From how I understand it, the equation for the public key is defined as so:

> `K = k * G`

With K being the public key, k the private key and G the generator point.

* Is G a constant? (as far as I read, it is a constant.)
* If it is, how is it not possible to simply do K/G = k?
* If it is not, how is it created out of the private key?

**Tags:** public-key, secp256k1


---

## 3 answers

### Answer by username_4 on 2021-12-14. Score: 38 | Accepted answer

> How I understood it, the equation for the public key is defined as so `K = k * G`
> With K being the public key, k the private key and G the generator point.

That's correct.

> Now my first question, is G a constant? (as far as I read, it is a constant)

It is. It is the point with coordinates `(55066263022277343669578718895168534326250603453777594175500187360389116729240, 32670510020758816978083085130507043184471273380659243275938904335757337482424)`. You can verify that these coordinates satisfy the [curve](https://en.wikipedia.org/wiki/Elliptic_curve) equation: `Y^2 = X^3 + 7 (mod 115792089237316195423570985008687907853269984665640564039457584007908834671663)`.

> And if it is, how is it not possible to simply do K/G = k?

The answer is simply that we don't know of an efficient way to do "division" for elliptic curves (which is called the [discrete logarithm](https://en.wikipedia.org/wiki/Discrete_logarithm_records#Elliptic_curves) problem), and it is assumed no such way can be found. The best known [algorithm](https://en.wikipedia.org/wiki/Pollard%27s_rho_algorithm_for_logarithms) for doing this for this specific curve takes around 2128 iterations, an impossibly large amount.

You have to be aware that the `*` in `k * G` as you write it is no ordinary multiplication (what would that even mean for points?). It is a rather [complicated operation](https://en.wikipedia.org/wiki/Elliptic_curve_point_multiplication), and people have figured out useful properties of it which are somewhat similar to multiplication (it forms a [cyclic group](https://en.wikipedia.org/wiki/Cyclic_group), so the same symbol is used). But nobody ever found a way to perform the reverse operation, and this became the basis for [elliptic curve cryptography](https://en.wikipedia.org/wiki/Elliptic-curve_cryptography).

> **Comments:**
> **username_0**: This cleared up a lot for me. Thank you for the explanation and links!  

---

### Answer by username_1 on 2021-12-16. Score: 7

Mathematicians like their analogies, sometimes those analogies can be helpful, but they can equally be confusing, particularly to those new to a field.

In mathematics a "group" consists of a set of elements and an operator that satisfies some requirements. The operator must be associative, there must exist an identity element, and for every element there must exist an inverse element under the operator.

Some groups are written by analogy to addition, that is the group operator is represented by a "+" sign, and the identity element is represented by "0". Other groups are written by analogy to multiplication, that is the group operator is written as a multiplication operation (e.g. "\*","." or nothing at all) and the identity element is represented by "1". Elliptic curves are traditionally written by analogy to addition.

We can conceive of applying the group operator repeatedly to k copies of G. If the group is written by analogy to addition then this is analogous to multiplication, if the group is written by analogy to multiplication then this is analogous to exponentiation.

So `k * G` refers not to regular multiplication but to an operation that is in a particular way analogous to multiplication.

You might naively think that this would take time proportional to k, but thanks to the associativity we can calculate it in time proportional to the logarithm of k. So we can quickly calculate `k * G` even for very large k.

Reversing the operation is not so easy though. The problem is known as the "Elliptic curve discrete logarithm problem" and the best known methods have a complexity proportional to roughly the square root of the number of elements in the group.

Why is it called the "Elliptic curve discrete logarithm problem" when it's more analogous to division than to a logarithm in the notation typically used for elliptic curves? because it's a variant of a similar problem studied for a group that is traditionally written by analogy to multiplication.

> **Comments:**
> **username_2**: *"Other groups are written by analogy to multiplication, that is the . Elliptic curves are traditionally written by analogy to addition."* Probably a few words got eaten there. Also I suggest using the full name "discrete logarithm" rather than the abbreviated "discrete log" as it's not necessarily obvious to a profane what this "log" means.  

---

### Answer by username_3 on 2021-12-15. Score: -1

k = K/G is somewhat misleading notation. In many ways, it's better to write k = K \* G^-1. This emphasizes that there are *two* operations involved in "division": multiplication, and taking the inverse (Also, it makes it easier to recognize that K \* G^-1 and G^-1 \* K are distinct concepts and that the existence of G^-1 need to be shown to exist. This isn't as important here because elliptic curve multiplication is abelian and always has an inverse, but those are considerations that you need to keep in mind when dealing with groups and rings in general.)

Elliptic curve math takes place in an abstract group, not within the real number system, and using real number notation encourages misleading intuition (and in abstract algebra, the slash is used for quotient groups, not for dividing elements of a group). The fact that taking the inverse in elliptic curve math is hard is what makes it a cryptographic system in the first place. Otherwise, anyone who had the public key could invert the encryption rather trivially. "Cryptographic system" almost by definition refers to a system with some operation such that finding a\*b is significantly easier than finding a^-1.

(There are ways of calculating K \* G^-1 without explicitly calculating G^-1, but they're still as hard or harder than finding G^-1.)

> And if it is not, how is it created out of the private key?

Huh? You just gave the equation for the public key: K = k \* G.

Also, I think that you should include that you're talking about secp256k1 in the body of your text, rather than just as a tag. It might be inferred from this being the Bitcoin SE, but it's good for it to be explicit.

> **Comments:**
> **username_4**: I find this explanation more confusion to be honest. G^-1 isn't a thing you can compute. What would its type be? Not a point, because then K*G^-1 would be point^2, which doesn't exist. And not a scalar because then K*G^-1 would be a point. You'd need to introduce a concept of "points inverted", which AFAIK doesn't exist, and also is unrelated to how K/G is actually computed in algorithms like Pollard's rho... which actually take in K and G as inputs - not just G - and output k.  
> **username_5**: @username_4: You're erroneously applying real arithmetic to abstract algebra, just as Accumulation warned against.  The "type" of a product over an abstract group has units which are the product of the units of the two inputs, but the dimension is not so simple.  For example, a 3-D vector cross product has 3-D just like both inputs, and a vector dot product yields a scalar no matter what the dimension of the inputs was.  Another example: a square matrix has an inverse with the same dimension as itself, and that poses no problems when multiplying the inverted matrix by column vectors.  
> **username_4**: The answer literally states "... but they're still as hard or harder than finding G^-1". This is, to the best of my knowledge, a false statement, as there is no known way of computing G^-1 (even ignoring the question of what its type would be). Algorithms for computing a discrete logarithm (= division of two group elements) take two group elements as input. They do not compute the inverse of one and then multiply it with the other. You could certainly define "inverse of a group element w.r.t. scalar multiplication" as some abstract object, but that isn't how you'd compute it.  
> **username_4**: There is more wrong here. The inverse we're talking about is the inverse w.r.t. scalar multiplication (number times group element), not the inverse w.r.t. the group operation itself (group element plus group element). The latter exists for every element in every group (including non-abelian groups). The former however, if you'd want to define it, certainly does _not_ exist for every element of an abelian group; it does for every non-zero element in secp because it's cyclic with prime order, but in general it won't exist for elements with non-maximal order in the group.  

---

