5am23

Can this really help in computing a private key from a public one? Like, could this break ECDSA?

Anyone up for discussing changing N order in secp256k1?

Got it. But still, I doubt it makes sense to define the cardinality this way, especially matching that of the original curve.

Are you sure about that? I keep hitting errors when I try.

What exactly do you mean by p^2?

For y^2=x^3+d (mod p) with d as a non-zero integer, you see different sets emerge based on group properties.

What if I just reduce the bits? Like 8. Should be clearer, right?

Right, try generating public keys up to 2^130 to see how it works.

Looks like you’re just guessing. You have to generate enough keys to compare.

I get that, but I just don’t know the divisor or any specifics about the process!

If it reduces the range, it must work somehow. Show us what you did exactly.

Yeah, exactly! Using the cube root of unity, each Y indeed has 3 X values (those are endomorphism points), and each X has 2 Y values (symmetry points). It's all interlinked and used in various tools for faster scanning,…

Got it now! I've managed to solve it for up to 210 bits! Thanks a lot for the help!

Hey, I tried using 3 signatures in my script, but it always gives wrong private keys. I switched to your script, and it works great! But when I changed this line from: nonces = [random.randrange(1, 2**kbits) +…

This script only finds nonces up to 125 bits. We really need to push it to at least 256 bits. If I try increasing it to 130 or more, it fails to find the right key. Looks like we need to rewrite it to handle 256 bits or…

Those two sets of r,s,z use different public keys, so the private keys have to be different too.

Why does this not work? Just swap the base point and "i" in kangaroo, and you get "i" where you find k. It’s just another way to use kangaroo and bsgs.