<p>Here is some python code you can reverse engineer</p>

<pre><code>def add(p, q):
    if p[0] % P == 0 and p[1] % P == 0:
        return q
    if q[0] % P == 0 and q[1] % P == 0:
        return p

    if p[0] == q[0] and p[1] == q[1]:
        if p[1] == 0:
            return [0, 0]
        l = (3 * p[0]**2) * modInv((2 * p[1]), P)
    elif p[0] == q[0]:
        return [0, 0]
    else:
        l = (p[1] - q[1]) * modInv((p[0] - q[0]), P)

    x = l**2 - (p[0] + q[0])
    y = l * (p[0] - x) - p[1]
    return [x % P, y % P]


def modInv(n, p):
    return pow(n, p - 2, p)


#some constants
P = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f
x = 0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798
y = 0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8


#example usage of the add function
g1 = [x, y]
print "g1 = " + hex(g1[0]) + " : " + hex(g1[1])

g2 = add([x, y], [x, y])
print "g2 = " + hex(g2[0]) + " : " + hex(g2[1])

g3 = add([x, y], g2)
print "g3 = " + hex(g3[0]) + " : " + hex(g3[1])

g4 = add(g2, g2)
print "g4 = " + hex(g4[0]) + " : " + hex(g4[1])
</code></pre>

CC BY-SA 3.0
2017-12-05T21:17:35.973Z
2017-12-05T21:17:35.973Z
Sean Bradley
<p>Most ecc libraries will have this function, but if you want to program it yourself, here's what you do:</p>

<p>First, compute the slope of the line containing the points A and B. Let A = (X_a, Y_a) and B = (X_b, Y_b). The equation for the slope is:</p>

<p>s = (Y_a - Y_b) / (X_a - X_b)</p>

<p>The resulting point, we'll call C = (X_c, Y_c) = A+B. Doing some math, you get:</p>

<p>X_c = s^2 - X_a - X_b<br>
Y_c = Y_a + s (X_c - X_a) = Y_b + s(X_c - X_b)</p>

<p>If X_a == X_b, then it depends on Y_a and Y_b. If Y_a == Y_b, then A and B are the same, so really, you're just computing a point doubling (2*A). If Y_a == -Y_b (the only other possibility) then A+B = the point at infinity, or the identity. Usually, that's not a very interesting point for cryptography. Computing 2*A is a little trickier, but can be done. You're already doing that when you compute the public key from the private key with G anyway, so I'll assume you have access to something that lets you double a point.</p>

<p>Note all the operations are all field operations, so you have to mod by P for secp256k1 (FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F in hex).</p>

CC BY-SA 3.0
2015-10-09T17:48:35.133Z
2015-10-24T04:21:32.407Z
2015-10-24T04:21:32.407Z
Jimmy Song
<p>I have two public/private keypairs, A and B. I want to add them together to get a new keypair AB.</p>

<p>I'd also like to be able to add the public keys of A and B to get the public key of AB.</p>

<p>How do I do this?</p>

CC BY-SA 3.0
2015-10-08T23:45:20.637Z
You can be more specific about what you mean by "add together"? You can literally add the two public keys and the two private keys to get a new keypair.
David Schwartz
CC BY-SA 3.0
2015-10-09T01:08:53.633Z
@DavidSchwartz `You can literally add the two public keys ` Yes, that's what I'm looking for.
Nick ODell
CC BY-SA 3.0
2015-10-09T03:30:21.513Z
If you're using OpenSSL, `EC_POINT_add`.
David Schwartz
CC BY-SA 4.0
2019-01-31T00:57:42.313Z
@DavidSchwartz Can I see an example ?
monkeyUser
<ecdsa><secp256k1>
How do I add two secp256k1 keys together?
Nick ODell
# How do I add two secp256k1 keys together?

(Asked by: username_0 on 2015-10-08)

I have two public/private keypairs, A and B. I want to add them together to get a new keypair AB.

I'd also like to be able to add the public keys of A and B to get the public key of AB.

How do I do this?

**Tags:** ecdsa, secp256k1

> **Comments:**
> **username_1**: You can be more specific about what you mean by "add together"? You can literally add the two public keys and the two private keys to get a new keypair.  
> **username_0**: @username_1 `You can literally add the two public keys ` Yes, that's what I'm looking for.  
> **username_1**: If you're using OpenSSL, `EC_POINT_add`.  
> **username_2**: @username_1 Can I see an example ?  

---

## 2 answers

### Answer by username_3 on 2017-12-05. Score: 1 | Accepted answer

Here is some python code you can reverse engineer

```
def add(p, q):
    if p[0] % P == 0 and p[1] % P == 0:
        return q
    if q[0] % P == 0 and q[1] % P == 0:
        return p

    if p[0] == q[0] and p[1] == q[1]:
        if p[1] == 0:
            return [0, 0]
        l = (3 * p[0]**2) * modInv((2 * p[1]), P)
    elif p[0] == q[0]:
        return [0, 0]
    else:
        l = (p[1] - q[1]) * modInv((p[0] - q[0]), P)

    x = l**2 - (p[0] + q[0])
    y = l * (p[0] - x) - p[1]
    return [x % P, y % P]

def modInv(n, p):
    return pow(n, p - 2, p)

#some constants
P = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f
x = 0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798
y = 0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8

#example usage of the add function
g1 = [x, y]
print "g1 = " + hex(g1[0]) + " : " + hex(g1[1])

g2 = add([x, y], [x, y])
print "g2 = " + hex(g2[0]) + " : " + hex(g2[1])

g3 = add([x, y], g2)
print "g3 = " + hex(g3[0]) + " : " + hex(g3[1])

g4 = add(g2, g2)
print "g4 = " + hex(g4[0]) + " : " + hex(g4[1])

```


---

### Answer by username_4 on 2015-10-09. Score: 2

Most ecc libraries will have this function, but if you want to program it yourself, here's what you do:

First, compute the slope of the line containing the points A and B. Let A = (X\_a, Y\_a) and B = (X\_b, Y\_b). The equation for the slope is:

s = (Y\_a - Y\_b) / (X\_a - X\_b)

The resulting point, we'll call C = (X\_c, Y\_c) = A+B. Doing some math, you get:

X\_c = s^2 - X\_a - X\_b  
Y\_c = Y\_a + s (X\_c - X\_a) = Y\_b + s(X\_c - X\_b)

If X\_a == X\_b, then it depends on Y\_a and Y\_b. If Y\_a == Y\_b, then A and B are the same, so really, you're just computing a point doubling (2\*A). If Y\_a == -Y\_b (the only other possibility) then A+B = the point at infinity, or the identity. Usually, that's not a very interesting point for cryptography. Computing 2\*A is a little trickier, but can be done. You're already doing that when you compute the public key from the private key with G anyway, so I'll assume you have access to something that lets you double a point.

Note all the operations are all field operations, so you have to mod by P for secp256k1 (FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F in hex).


---

