Post
Topic
Board Development & Technical Discussion
Re: Pollard's kangaroo ECDLP solver
by
Black_Pawn
on 03/07/2021, 13:09:38 UTC
There is no such thing as 'division' on EC points. But your efforts are getting closer to an understanding.

Given a point P on an EC, with G as a generator on the curve, and k as the secret scalar so that k*G=P, we can try and find k using Modular Inversion (not division).

Choose a random number k2 so that P*(k2^-1%n) gives you a point P2 on the same curve.

We know that P2 can also be the result of some other unkown scalar, let's call it k3, where k3*G=P2.

IF AND ONLY IF k2 is a divisor with no remainder of k, THEN k2*k3=k

*Find k3 using something like Pollard's kangaroo on P2(x,y) to solve k - only possible if k3 is small of course.


Exemplification and proof


k=45487748454224151829376801203708731704859664260873605888712451703154788855856

P(x,y)=(10053685140205676278799957889590673151335008206090829831680224379203557168306, 4791849545765797566764759476528403966287896066924010656116759518571082174095)

k2=29067368096886031192247117546360432506854781537574226047992899174

P*(k2^-1%n)=P2(x,y)=(4091563663952832524301734215298365027000606967193056236423486827624564787617,13486322253259545937968834971886446900575284808236467273248905944659764682801)

k3=1564907710344

k3*G=P2

k3*k2=k



BP