5am23

Anyone up for discussing changing N order in secp256k1?

Got it. But still, I doubt it makes sense to define the cardinality this way, especially matching that of the original curve.

Are you sure about that? I keep hitting errors when I try.

What exactly do you mean by p^2?

For y^2=x^3+d (mod p) with d as a non-zero integer, you see different sets emerge based on group properties.

Got it now! I've managed to solve it for up to 210 bits! Thanks a lot for the help!

Hey, I tried using 3 signatures in my script, but it always gives wrong private keys. I switched to your script, and it works great! But when I changed this line from: nonces = [random.randrange(1, 2**kbits) +…

This script only finds nonces up to 125 bits. We really need to push it to at least 256 bits. If I try increasing it to 130 or more, it fails to find the right key. Looks like we need to rewrite it to handle 256 bits or…

Those two sets of r,s,z use different public keys, so the private keys have to be different too.

Why does this not work? Just swap the base point and "i" in kangaroo, and you get "i" where you find k. It’s just another way to use kangaroo and bsgs.