<p>I believe simple Elliptic Curve addition should accomplish what you are looking for. The process is similar to how child private and public keys are derived from parent keys in BIP32 (HD) wallets.</p>

<pre><code>def FPub(K, B):
    block_pub = hash(B)*G
    // Note that the below addition represents ECC addition
    return block_pub + K 

def FPriv(k, B):
    block_priv = hash(B)
    // Note that the below addition is addition mod curve order 'n'
    return block_priv + k
</code></pre>

<p>Note that hash(B) is used instead of B itself because B is not sufficiently random (it starts with a string of 0 bits).</p>

<p>With this scheme, any observer can very the chain of public keys, but only the owner of the original private key can derive the private key for any step in the chain.</p>

CC BY-SA 3.0
2015-07-10T13:59:14.200Z
2015-07-10T13:59:14.200Z
morsecoder
<p>Simple multiplication should work. k' = B * k (normal multiplication in the modular field), K' = B * K (adding the point K to itself B times, using multiplication by doubling).</p>

CC BY-SA 3.0
2015-07-11T02:06:40.493Z
I think addition is a better candidate here, just like as is used in BIP32 child derivation. It's more tested and reviewed.
morsecoder
CC BY-SA 3.0
2015-07-10T13:59:13.690Z
2015-07-10T13:59:13.690Z
Meni Rosenfeld
<p>I am looking for a method which would allow a keypair to be modified in a manner which is unpredictable to the original creator.  </p>

<p>So I was thinking a user creates a key and commits it by making a transaction which is written to the blockchain.  The block hash could be used as a source of unpredictability to derive a new keypair.  Can this be done in a manner than only the derived private key can be computed from the original private key and the derived public key can be computed without the original or new private key?</p>

<p>Let:</p>

<pre><code>k = existing private key
K = existing public key
B = hash of block hash
k' = derived private key
K' = derived public key
</code></pre>

<p>Is there some pair of functions such that solves the following?</p>

<pre><code>K' = FPub(K, B)
k' = FPriv(k, B)
</code></pre>

<p>Are there any security implications?</p>

<p>To be clear the new public key should be derived using only public information (existing public key and scalar).</p>

CC BY-SA 3.0
2015-07-12T22:56:52.777Z
Maybe you are trying to create stealth addresses?
Jannes
CC BY-SA 4.0
2018-06-08T19:50:39.620Z
I'm curious - what's the application for this?
Rich Apodaca
<private-key><public-key>
Is it possible to shift/modify a ECDSA keypair by a scalar where the public key can be computed using only public information?
DeathAndTaxes
# Is it possible to shift/modify a ECDSA keypair by a scalar where the public key can be computed using only public information?

(Asked by: username_0 on 2015-07-10)

I am looking for a method which would allow a keypair to be modified in a manner which is unpredictable to the original creator.  
So I was thinking a user creates a key and commits it by making a transaction which is written to the blockchain.  The block hash could be used as a source of unpredictability to derive a new keypair.  Can this be done in a manner than only the derived private key can be computed from the original private key and the derived public key can be computed without the original or new private key?
Let:
k = existing private key
K = existing public key
B = hash of block hash
k' = derived private key
K' = derived public key

Is there some pair of functions such that solves the following?
K' = FPub(K, B)
k' = FPriv(k, B)

Are there any security implications?
To be clear the new public key should be derived using only public information (existing public key and scalar).

**Tags:** private-key, public-key

> **Comments:**
> **username_1**: Maybe you are trying to create stealth addresses?  
> **username_2**: I'm curious - what's the application for this?  

---

## 2 answers

### Answer by username_3 on 2015-07-10. Score: 2

I believe simple Elliptic Curve addition should accomplish what you are looking for. The process is similar to how child private and public keys are derived from parent keys in BIP32 (HD) wallets.
def FPub(K, B):
    block_pub = hash(B)*G
    // Note that the below addition represents ECC addition
    return block_pub + K 

def FPriv(k, B):
    block_priv = hash(B)
    // Note that the below addition is addition mod curve order 'n'
    return block_priv + k

Note that hash(B) is used instead of B itself because B is not sufficiently random (it starts with a string of 0 bits).
With this scheme, any observer can very the chain of public keys, but only the owner of the original private key can derive the private key for any step in the chain.


---

### Answer by username_4 on 2015-07-10. Score: 1

Simple multiplication should work. k' = B \* k (normal multiplication in the modular field), K' = B \* K (adding the point K to itself B times, using multiplication by doubling).

> **Comments:**
> **username_3**: I think addition is a better candidate here, just like as is used in BIP32 child derivation. It's more tested and reviewed.  

---

