Skip to main content
3 of 5
added 12 characters in body
user2284570
  • 283
  • 4
  • 19

Why exactly finding the same result by changing a scalar in such a case is equivalent to solving the discrete logarithm between one or more points?

Let’s say I have 3 randomly sampled points on a curve in the twisted Edwards form (sampled only the first time and not at each computation) $P1$ $P2$ $P3$ and 3 scalars $S1$ $S2$ $S3$ such as :

  • Both $S1$ $S2$ $S3$ are <targetcurve.Suborder (the largest prime factor of the composite curve’s order or the curve order if the curve is a prime)
  • The curve pass the Safecurve criterias

Given $packed(S1×P1 + S2×P2 + S3×P3)$ (where packed means keeping only $x$ and dropping the $y$ coordinate but remember this is an edward’s curve where the negation of a coordinate is $(−x,y)$) then why if 1 scalar is modified, finding other scalars to still keep the same previous $x$ is best achieved through solving the discrete logarithm between $P1$ and $P2$ or $P2$ and $P3$ ?

user2284570
  • 283
  • 4
  • 19