1
$\begingroup$

Is the elliptic curve scalar multiplication $[n]G$ defined if $n=0$?

I saw multiple software implementations with multiple results such that, $[0]G=0$ or $[0]G=G$.

This made me wonder, how can i compute $[0]G$ on 25519 curve, where G is the base point. $G=(9,14781619447589544791020593568409986887264606134616475288964881837755586237401).$

Also, is [n]$\mathcal{O}$ defined?

Improve this question
$\endgroup$
8
  • $\begingroup$ I think this covers your answers ; Can you tell me why doing scalar multiplication of a point on a Elliptic curve over a finite field gets to a point at infinity? $\endgroup$ Commented Apr 17, 2021 at 12:25
  • 3
    $\begingroup$ Also, where you see that $[0]G=0$ or $[0]G=G$, the later one is not correct. $\endgroup$ Commented Apr 17, 2021 at 12:28
  • 1
    $\begingroup$ $[n]\mathcal O$ is $\mathcal O$ for all $n$. $\endgroup$ Commented Apr 17, 2021 at 12:34
  • $\begingroup$ Use $[0]P = \mathcal{O}$ and multipl by $n$, $[0*n]P = [0]P = \mathcal{O}= [n]\mathcal{O}$ $\endgroup$ Commented Apr 17, 2021 at 12:36
  • 1
    $\begingroup$ File a bug on their site. $\endgroup$ Commented Apr 17, 2021 at 14:20

1 Answer 1

Reset to default
3
$\begingroup$

I saw multiple software implementations with multiple results such that, $[0]G=0$ or $[0]G=G$.

As stated in the comments, we define $[0]G = 0$, anything else is incorrect

I thought I'd outline why we define things we did.

What we want is to have $[a+b]G = [a]G + [b]G$ be true for all integers $a, b$, and all points $G$.

If it is true for all integers $b$, it must be true for $b=0$, hence we must have:

$$[a+0]G = [a]G + [0]G$$

This obviously simplifies to $[a]G = [a]G + [0]G$, and this is true only if $[0]G$ is the group identity, that is, only if $[0]G = 0$

Improve this answer
$\endgroup$
4
  • 2
    $\begingroup$ Addition: in $[0]G = 0$, the left $0$ is an integer (or integer modulo $n$), But the right $0$ is not, and sometime is noted $\mathcal O$ to make the distinction. It's the neutral for point multiplication. It's called the point at infinity, and thus sometime is noted $\infty$. On Curve25519 [update: sorry Ed25519, which is not the question's curve], the point at infinity has coordinates $(x,y)=(0,1)$. $\endgroup$ Commented Apr 17, 2021 at 13:40
  • $\begingroup$ @fgrieu why does the point at infinity has coordinates (𝑥,𝑦)=(0,1)? $\endgroup$ Commented Apr 17, 2021 at 13:56
  • 3
    $\begingroup$ @AshrafYassin: it doesn't; the point at infinity doesn't have any coordinates at all. Now, some representations (that is, ways of writing down elliptic curve points as sequences of bits) may decide to denote the point-at-infinity as $(0, 1)$, however that's just a design decision (and is certainly is not universal) $\endgroup$ Commented Apr 17, 2021 at 14:01
  • 1
    $\begingroup$ There's some confusion here between Curve25519 which is a curve in Weierstrass form and Ed25519 which is a curve in Edwards form. On Ed25519 the identity point is $(0,1)$, but the base point is different from the one quoted in the question. On Curve22519 the point at infinity does not have an $(x,y)$ representation. It is important not to denote it with an actual $(x,y)$ value as some Weierstrass implementations will take these numbers and start doing computations on a related, but different curve. $\endgroup$ Commented Apr 17, 2021 at 15:08

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.