<ol>
<li>Yes.</li>
<li>Imagine that all you can see is the point at G, and the point at 8G. You're trying to determine how many times the point was added. And the number isn't 8, it's somewhere between 1 and 2^256.</li>
</ol>

<blockquote>
  <p>Am I missing something or does it only become irreversible in the discrete logarithmic equivalent.</p>
</blockquote>

<p>I have no idea what that means; I'll leave that for someone else to answer.</p>

CC BY-SA 3.0
2014-10-27T23:47:33.683Z
Technically speaking, it's not irreversible. The blind brute force algorithm (pick private key = 1, test, if not the right pub key then increment private key and try again) would work, although the best known algorithm to solve the Elliptic Curve DLP takes roughly O(n^(1/2)) steps, where n is the order of the Elliptic Curve Group. For Secp256k1, that means about 2^128 steps, which is just completely infeasible (until quantum computers become a reality).
morsecoder
CC BY-SA 3.0
2014-10-28T00:41:44.330Z
Sure, it's actually just generic baby-step giant-step or Pollards Rho method, I think, which are collision algorithms. Pollard Rho is slightly slower but a lot less memory intensive. You can either look those up, or I can send you my honors thesis, which I did on ECC.
morsecoder
CC BY-SA 3.0
2014-10-28T00:44:04.120Z
Try http://www.royalforkblog.com
Wizard Of Ozzie
CC BY-SA 3.0
2014-10-28T00:53:56.403Z
@WizardOfOzzie A good read! I think you meant to link to http://www.royalforkblog.com/2014/09/04/ecc/
Nick ODell
CC BY-SA 3.0
2014-10-28T02:11:55.747Z
I'm on Android so can't edit but feel free to delete the wrong link or edit it if I don't do so first!
Wizard Of Ozzie
CC BY-SA 3.0
2014-10-27T23:07:17.187Z
2014-10-27T23:07:17.187Z
Nick ODell
<p>Actually, from what I understood about ECDSA, by reading this <a href="https://www.instructables.com/id/Understanding-how-ECDSA-protects-your-data/" rel="nofollow noreferrer">blog</a>,
in K= k*G, k is not the primary key, it's just a random number.
and the x coordinate of K is known as R and using R, k and the private key we determine S.</p>

<p>R = x coordinate(k*G)</p>

<p>S = k^-1 (z + dA * R) mod p</p>

<p>where dA is the private key</p>

<p>Please read that blog to get a good understanding of ECDSA.</p>

<p>Now to determine k from K and G, there's no point subtraction or point division, so we cannot get the random number k directly from K and G by K/G. But as @StephenM347 mentioned in the comment, a brute force attack is possible, but not possible with the current computational power</p>

CC BY-SA 4.0
2018-11-06T07:43:44.593Z
2018-11-06T07:43:44.593Z
Jerin A Mathews
<p>I'm trying to understand the graphical basis that underlies the discreet logarithmic Elliptic Curve Digital Signature Algorithm (ECDSA) introduced in Chapter 4 of "Mastering Bitcoin" by Andreas Antonopolous: <a href="https://github.com/aantonop/bitcoinbook/blob/develop/ch04.asciidoc" rel="noreferrer">https://github.com/aantonop/bitcoinbook/blob/develop/ch04.asciidoc</a></p>

<p>Andreas says a point in an elliptic curves can be added to itself by drawing a tangent, finding the intersection, then reflecting the new point on the x-axis. This makes no sense to me, but for now I'll just blindly believe. Then K = k * G, where k is the private key, G is a constant "Generator Point" and K is the public key. </p>

<p>Then he shows the attached figure which graphically shows how to get from G to 8G.</p>

<ol>
<li>Is "8" the private key in this example?</li>
<li>Given K and G, it doesn't seem like this function would be irreversible. Am I missing something or does it only become irreversible in the discrete logarithmic equivalent. 
<img src="https://i.sstatic.net/elA8D.png" alt="enter image description here"> </li>
</ol>

CC BY-SA 3.0
2014-10-27T23:18:46.970Z
How would you imagine going from 2G to G?
David Schwartz
<security><ecdsa>
How to generate a public key from a private key using Elliptic Curve Digital Signature Algorithm
Alex Millar
# How to generate a public key from a private key using Elliptic Curve Digital Signature Algorithm

(Asked by: username_0 on 2014-10-27)

I'm trying to understand the graphical basis that underlies the discreet logarithmic Elliptic Curve Digital Signature Algorithm (ECDSA) introduced in Chapter 4 of "Mastering Bitcoin" by Andreas Antonopolous: <https://github.com/aantonop/bitcoinbook/blob/develop/ch04.asciidoc>

Andreas says a point in an elliptic curves can be added to itself by drawing a tangent, finding the intersection, then reflecting the new point on the x-axis. This makes no sense to me, but for now I'll just blindly believe. Then K = k \* G, where k is the private key, G is a constant "Generator Point" and K is the public key.

Then he shows the attached figure which graphically shows how to get from G to 8G.

1. Is "8" the private key in this example?
2. Given K and G, it doesn't seem like this function would be irreversible. Am I missing something or does it only become irreversible in the discrete logarithmic equivalent.
   ![enter image description here](https://i.sstatic.net/elA8D.png)

**Tags:** security, ecdsa

> **Comments:**
> **username_1**: How would you imagine going from 2G to G?  

---

## 2 answers

### Answer by username_2 on 2014-10-27. Score: 3

1. Yes.
2. Imagine that all you can see is the point at G, and the point at 8G. You're trying to determine how many times the point was added. And the number isn't 8, it's somewhere between 1 and 2^256.

> Am I missing something or does it only become irreversible in the discrete logarithmic equivalent.

I have no idea what that means; I'll leave that for someone else to answer.

> **Comments:**
> **username_3**: Technically speaking, it's not irreversible. The blind brute force algorithm (pick private key = 1, test, if not the right pub key then increment private key and try again) would work, although the best known algorithm to solve the Elliptic Curve DLP takes roughly O(n^(1/2)) steps, where n is the order of the Elliptic Curve Group. For Secp256k1, that means about 2^128 steps, which is just completely infeasible (until quantum computers become a reality).  
> **username_3**: Sure, it's actually just generic baby-step giant-step or Pollards Rho method, I think, which are collision algorithms. Pollard Rho is slightly slower but a lot less memory intensive. You can either look those up, or I can send you my honors thesis, which I did on ECC.  
> **username_4**: Try http://www.royalforkblog.com  
> **username_2**: @username_4 A good read! I think you meant to link to http://www.royalforkblog.com/2014/09/04/ecc/  
> **username_4**: I'm on Android so can't edit but feel free to delete the wrong link or edit it if I don't do so first!  

---

### Answer by username_5 on 2018-11-06. Score: 0

Actually, from what I understood about ECDSA, by reading this [blog](https://www.instructables.com/id/Understanding-how-ECDSA-protects-your-data/),
in K= k\*G, k is not the primary key, it's just a random number.
and the x coordinate of K is known as R and using R, k and the private key we determine S.

R = x coordinate(k\*G)

S = k^-1 (z + dA \* R) mod p

where dA is the private key

Please read that blog to get a good understanding of ECDSA.

Now to determine k from K and G, there's no point subtraction or point division, so we cannot get the random number k directly from K and G by K/G. But as @StephenM347 mentioned in the comment, a brute force attack is possible, but not possible with the current computational power


---

