How to get the generator G point for any new curve?

I have this bitcoin curve:

y^2 = x^3 + 7

but the finite field Fp is modified to be:

n=115792089237316195423570985008687907853269984665640564039457584007908834675927

1-What is the G point?

2-how to get the Y coordinate for any X value?

I'm using this C# code to get Y from X but it works with original bitcoin curve only.

    public BigInteger mod(BigInteger num, BigInteger by) {
        BigInteger res = num % by;
        if (res < 0) { res += by; }
        return res;
    }

    public BigInteger EC_GetY(BigInteger x, bool modIt, BigInteger n) {
        BigInteger n_OVER_FOUR = (n + 1) / 4;
        BigInteger alpha = mod(BigInteger.Pow(x, 3) + 7, n);
        BigInteger beta = BigInteger.ModPow(alpha, n_OVER_FOUR, n);//SqRtN
        BigInteger Y = beta;

        if (!modIt) { return Y; }
        Y = n - beta;
        return Y;
    }

cryptography

remon78eg

Posted 2018-11-15T10:16:28.673

Reputation: 1

Answers

You can't just change N. N is the number of elements in the finite group. You can pick a new (prime) P close to 2^256 (or however many bits you want) and get a resulting N.

1) G is a point in the group that when added to itself produces another point in the group. Hence it can generate all other points with repeated additions (generator). If the number of elements in the group is prime then every point has this property and can be used as a generator (via Lagrange's Theorem).

2) Just use the curve equation. y^2 = x^3 + 7 => y = modsqrt(x^3 + 7) (everything is mod P)

Mike D

Posted 2018-11-15T10:16:28.673

Reputation: 1 571

you did not understand my question, because

N is already a prime number ,,

y^2 = x^3 + 7 => y = modsqrt(x^3 + 7) ,,

i said that i did this but not work with my new N – remon78eg – 2018-11-15T12:20:39.330

yes,any point can be a generator point, but when i choose any x and find its y to be G point,and then add this G point to itself, i get another x,y then when i test y by getting y from x, it not be the same. – remon78eg – 2018-11-15T12:49:12.390

Then your code is wrong. What algorithm are you trying to implement? Where does (n-1)/4 come from? – Mike D – 2018-11-15T20:36:05.703

@MikeD OP is using "N" to refer to the field size, not the curve order. – Pieter Wuille – 2018-11-16T01:41:11.847

@MikeD x^((n-1)/4) is a way to compute the modular square root, when the field size p satsifies (p mod 4) = 3, which is the case for OP's field. – Pieter Wuille – 2018-11-16T02:08:42.660

@Pieter Wuille, yes, true. – remon78eg – 2018-11-16T10:18:20.477

G is just an arbitrarily selected point from the largest sub-group (in the case of secp256k1, there is only one sub-group).

It is slightly preferable if G is selected in a rigid way that shows you it wasn't constructed so that you'd know the discrete log with respect to some other point.

E.g. x=1 is on your curve, so you could use {1, 2455109838632409200075678375825088630665501513214133143088640413693816705352929} as your generator.

G. Maxwell

Posted 2018-11-15T10:16:28.673

Reputation: 6 039

The constructed curve's order is 115792089237316195423570985008687907853269984665640564039457584007908834675928, whose largest subgroup only has size 2765277052581038646431687, which means you'd have about 28 bits of security if you were to use that curve for cryptographic purposes. – Pieter Wuille – 2018-11-16T01:27:48.817

For your curve (95921233372678902199381747756274233529074706244545367429090486988915946862623, 25263609221162202509967882001353913773424856517552408768133186103801749909992) is a point on the maximal subgroup (created by taking G. Maxwell's suggested point and multiplying it by (the curve order / its largest prime factor). – Pieter Wuille – 2018-11-16T01:33:21.963

@Maxwell , your point is working as (G) Generator point, but it is: {1,24551098386324092000756783758250886306655015132141331430886404136938167053529} , end with (3529) not (352929) – remon78eg – 2018-11-16T11:07:28.047

now, what is the (N) order number, (used in division, and creating signature)? , where:(((( G*(N+1)=G )))): – – remon78eg – 2018-11-16T11:22:23.383

Remon: you need computer algebra software to figure that out. In sage you can use F=GF(n); E=EllipticCurve(F,[0,7]); print(E.order());, but note that the security of your curve is only the square root of the largest prime factor of that order, which is very low for yours. – Pieter Wuille – 2018-11-24T08:10:58.570

@ Pieter Wuille , i will not use this curve for security, i will use it to do text compression (ZIP) , because i can know if any point on this curve is odd or even, even i multiply the G point with a very large number, this means i can know this very long number from a small point number, so i can store every long number in a small point number to compress it. – remon78eg – 2018-12-19T03:52:30.067

Re: compression. You might want to consult this article before announcing your IPO.

– G. Maxwell – 2018-12-19T04:25:40.910