<p>k is just a scalar, modulo the order of the elliptic curve group.</p>

<pre><code>Q = k*P
</code></pre>

<p>thus:</p>

<pre><code>(1/k)*Q = (1/k)*k*P
</code></pre>

<p>thus:</p>

<pre><code>(1/k)*Q = P
</code></pre>

<p>You find P by multiplying Q with the multiplication inverse of k modulo the curve order.</p>

CC BY-SA 3.0
2015-03-09T20:24:29.513Z
... where the inverse of k can be computed using the [extended Euclidean algorithm](http://en.wikipedia.org/wiki/Extended_Euclidean_algorithm).
Nate Eldredge
CC BY-SA 3.0
2015-03-10T12:47:36.190Z
... or by raising it to the (order-2)'th power modulo order (which is only allowed because order is prime in this case).
Pieter Wuille
CC BY-SA 3.0
2015-03-09T18:27:34.453Z
2015-03-09T18:27:34.453Z
Pieter Wuille
<p>Pieter Wuille <a href="https://bitcoin.stackexchange.com/questions/36368/address-generator-for-bitcoin-wallet/36371#comment42452_36371">said:</a></p>

<blockquote>
  <p>[...](people often assume that no inverse for EC multiplication exists, which is true, but only to solve for k in k*P = Q; solving for P is possible).</p>
</blockquote>

<p>When you multiply a scalar value by an EC point, you get an EC point. According to the above comment, it is possible to take the output point and derive the input point. How is this done? Does it require knowing k?</p>

<p>Note that I'm specifically <em>not</em> asking about extracting the scalar value (k) from the output point.</p>

<p>Also note that this wouldn't be useful to breaking Bitcoin signature algorithm - the generator that private keys are multiplied by is publicly known.</p>

<ecdsa>
How do you invert an ECDSA multiplication to get the generator?
Nick ODell
# How do you invert an ECDSA multiplication to get the generator?

(Asked by: username_0 on 2015-03-09)

username_1 username_1 [said:](https://bitcoin.stackexchange.com/questions/36368/address-generator-for-bitcoin-wallet/36371#comment42452_36371)

> [...](people often assume that no inverse for EC multiplication exists, which is true, but only to solve for k in k\*P = Q; solving for P is possible).

When you multiply a scalar value by an EC point, you get an EC point. According to the above comment, it is possible to take the output point and derive the input point. How is this done? Does it require knowing k?

Note that I'm specifically *not* asking about extracting the scalar value (k) from the output point.

Also note that this wouldn't be useful to breaking Bitcoin signature algorithm - the generator that private keys are multiplied by is publicly known.

**Tags:** ecdsa


---

## 1 answers

### Answer by username_1 on 2015-03-09. Score: 7 | Accepted answer

k is just a scalar, modulo the order of the elliptic curve group.

```
Q = k*P

```

thus:

```
(1/k)*Q = (1/k)*k*P

```

thus:

```
(1/k)*Q = P

```

You find P by multiplying Q with the multiplication inverse of k modulo the curve order.

> **Comments:**
> **username_2**: ... where the inverse of k can be computed using the [extended Euclidean algorithm](http://en.wikipedia.org/wiki/Extended_Euclidean_algorithm).  
> **username_1**: ... or by raising it to the (order-2)'th power modulo order (which is only allowed because order is prime in this case).  

---

