Is it possible to shift/modify a ECDSA keypair by a scalar where the public key can be computed using only public information?

I am looking for a method which would allow a keypair to be modified in a manner which is unpredictable to the original creator.

So I was thinking a user creates a key and commits it by making a transaction which is written to the blockchain. The block hash could be used as a source of unpredictability to derive a new keypair. Can this be done in a manner than only the derived private key can be computed from the original private key and the derived public key can be computed without the original or new private key?

Let:

k = existing private key
K = existing public key
B = hash of block hash
k' = derived private key
K' = derived public key

Is there some pair of functions such that solves the following?

K' = FPub(K, B)
k' = FPriv(k, B)

Are there any security implications?

To be clear the new public key should be derived using only public information (existing public key and scalar).

DeathAndTaxes

Posted 2015-07-10T13:35:39.643

Reputation: 8 269

Maybe you are trying to create stealth addresses? – Jannes – 2015-07-12T22:56:52.777

I'm curious - what's the application for this? – Rich Apodaca – 2018-06-08T19:50:39.620

Answers

I believe simple Elliptic Curve addition should accomplish what you are looking for. The process is similar to how child private and public keys are derived from parent keys in BIP32 (HD) wallets.

def FPub(K, B):
    block_pub = hash(B)*G
    // Note that the below addition represents ECC addition
    return block_pub + K 

def FPriv(k, B):
    block_priv = hash(B)
    // Note that the below addition is addition mod curve order 'n'
    return block_priv + k

Note that hash(B) is used instead of B itself because B is not sufficiently random (it starts with a string of 0 bits).

With this scheme, any observer can very the chain of public keys, but only the owner of the original private key can derive the private key for any step in the chain.

morsecoder

Posted 2015-07-10T13:35:39.643

Reputation: 12 624

Simple multiplication should work. k' = B * k (normal multiplication in the modular field), K' = B * K (adding the point K to itself B times, using multiplication by doubling).

Meni Rosenfeld

Posted 2015-07-10T13:35:39.643

Reputation: 18 542

I think addition is a better candidate here, just like as is used in BIP32 child derivation. It's more tested and reviewed. – morsecoder – 2015-07-11T02:06:40.493