Exploring n-values and b-values in secp256k1

I just found out there are six distinct n-values that match various b-values in secp256k1. It's crazy how they repeat as the b-value goes up. But then I thought, is there a connection between equations like y^2=x^3+7 and y^2=x^3+2? Like, can points on curves with the same p-value and n-value be mapped to each other?

If there are any points on different curves mapping to each other, we're in trouble. Imagine figuring out one point on a curve and using it on another due to different n-values. You'll be able to crack any key. To see this in action, take a scalar mod n on two curves and compare them.

This could be tied to modular arithmetic in elliptic curve cryptography. All the operations are done modulo a prime number p, right?

Not sure about a direct 1:1 mapping. But I noticed when b=0x0, it creates a simple loop that maps from public key to private key. I haven't found a way to map points from b=0x7 to b=0x0 yet.

Totally! You can map points on curves with the same number of points. Like b-values 7, 12, 20... they're all isomorphic. But I don't think there's any known connection between curves with different numbers of points.

Look into Jacobian coordinates. It's clearer there. You can get the same point using the same X and Y but with a different Z coordinate. By "same point," I mean the points that can project onto an isomorphic plane.

For y^2=x^3+d (mod p) with d as a non-zero integer, you see different sets emerge based on group properties.

In this example, yeah, you can map to another secp256k1 curve. But don't think you can do an invalid curve attack with those mapped points because it leads to the infinity point.

What exactly do you mean by p^2?

Sure, you can crank up the p parameter for an invalid or twist attack, but you still hit the infinity point. If you factor that prime, you'll spot the prime components.

Are you sure about that? I keep hitting errors when I try.

Sorry, I typed that out on my phone. Check this code. It'll help clarify.

Got it. But still, I doubt it makes sense to define the cardinality this way, especially matching that of the original curve.

Yeah, it looks correct. But trying to change the order number in sagemath seems useless since attacks won’t work, we just get a factor.

Anyone up for discussing changing N order in secp256k1?

I think it’s all about mapping coordinates between the original curve and its twist. The private key orders should match.

Tried that with p=0xffff...^2, but I just get P combined with regular curves. Everything looks the same structure-wise.

Your code checks out. But I still don't think we can launch curve attacks under these settings. Only mapping should work.

According to Hasse's Theorem, the number of points N on an elliptic curve over a prime field p is bound to be close to p+1, with some leeway. Just having the same number of points doesn't mean there's a direct mapping between all of them.

Fun fact: libsecp256k1 has optimizations that use isomorphic groups to skip calculations. The results may look invalid but they shift onto these isomorphic curves predictably, eventually getting projected back.