Does the 256-bit integer secret exponent define the X, Y pair?

I'm trying to understand better how bitcoin works and I'm stuck. I've read a blog showing how to construct the WIF from the 256-bit secret integer and up to that point, I think I follow.

However I'm "lost" when it comes to the (X,Y) point.

In the following facetious example (where the 256-bit secret exponent as been set to '1' on purpose), what defines the value of X and Y?

A related question: for the same secret exponent ('1' in this case), could we have ended up with a different (X,Y)?

secret exponent: 1
  hex:           1
WIF:             KwDiBf89QgGbjEhKnhXJuH7LrciVrZi3qYjgd9M7rFU73sVHnoWn
  uncompressed:  5HpHagT65TZzG1PH3CSu63k8DbpvD8s5ip4nEB3kEsreAnchuDf
public pair x:   55066263022277343669578718895168534326250603453777594175500187360389116729240
public pair y:   32670510020758816978083085130507043184471273380659243275938904335757337482424
  x as hex:      79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798
  y as hex:      483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8
y parity:        even
key pair as sec: 0279be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798
  uncompressed:  0479be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798\
                   483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8
hash160:         751e76e8199196d454941c45d1b3a323f1433bd6
  uncompressed:  91b24bf9f5288532960ac687abb035127b1d28a5
Bitcoin address: 1BgGZ9tcN4rm9KBzDn7KprQz87SZ26SAMH
  uncompressed:  1EHNa6Q4Jz2uvNExL497mE43ikXhwF6kZm

That example has been generated with an utility you can find here:

http://blog.richardkiss.com/?p=371

bitcoinNeverSleeps

Posted 2014-01-23T20:12:34.667

Reputation: 99

What is your question? I only see a "related question". – Pieter Wuille – 2014-01-23T20:18:35.770

@PieterWuille: "what defines the value of X and Y?"... It's in the paragraph above the one with the related question. I want to know, once you have the secret exponent (the 256-bit integer, which is '1' in that example), how do you compute X and Y? – bitcoinNeverSleeps – 2014-01-23T20:23:46.277

1You want an explanation of the elliptic curve cryptography that is used to compute (X,Y)? – Pieter Wuille – 2014-01-23T21:55:02.803

@Pieter Wuille: I want to know whether, for a given secret exponent, there is only one (X,Y) pair or an infinity of (X,Y) pairs. So in the example I gave I want to know if the secret exponent '1' shall always give X = 55066263... or not. In other words: does secret_exponent = 1 imply *X = 55066263..." or not!? – bitcoinNeverSleeps – 2014-01-23T23:44:08.670

1The answer is yes. – Pieter Wuille – 2014-01-24T07:50:48.440

Unbelievable. Why do people downvote this? It's a very real technical question which has a definitve answer and most people don't know what the answer is. – bitcoinNeverSleeps – 2014-01-26T22:49:47.053

Answers

I usually use the following analogy to oversimplify things: The secret key is how far you walk along a known curve starting from a known point and the public point is where on the curve you wind up when you finish. If you repeat the same walk, you will always wind up at the same place. The operation is irreversible because the curve is complex, you can only figure out where you wind up by taking steps. Given a destination, you cannot figure out how to get there because you must walk in integer steps.

David Schwartz

Posted 2014-01-23T20:12:34.667

Reputation: 46 931

For being so simple, that analogy is surprisingly accurate! – Pieter Wuille – 2014-01-27T01:06:44.057

This answer is probably too late for the OP, but it might clear things up for whoever ends up with the same question later. So here it goes:

I'm assuming you (as I did until a moment ago) have the misconception that the private key is also a pair of (x, y) coordinates in the elliptic curve, just as the public key. Well simple answer, it is not. The private key is actually just a number which here is called the "secret exponent". This number is multiplied by the Generator Point and that's how you get your public key.

So we have:

K = k * G

Where K is the public key, k is the private key and G is the generator point. So this generator point G; a constant given by the specification is the actual point here. Your private key is just a number. The number of times the generator point as to be added with itself to give you the public key.

This can be confusing because people keep calling that the "exponent" making it look like there are repeated multiplications here, when in fact what we have is repeated sums. So it should probably be called the "secret factor". But keep in mind that this is elliptic curve multiplication, not regular every day multiplication, so I assume you can name it however you want.

Is just that calling it "exponent" is somewhat misleading.

Bilthon

Posted 2014-01-23T20:12:34.667

Reputation: 191