We have seen evidence that users can sign messages using the SR25519 and ED25519 public key with all zeros.
Why or how is the private key to this public key known?
Are there any other things users should be aware of when using SR25519 or ED25519?
Substrate and Polkadot Stack Exchange is a question and answer site for developers building blockchains with the Substrate SDK. It only takes a minute to sign up.Sign up to join this community
Yes, it's a consequence of the Edwards curve models used, but secp256k1 is a short Weierstrass curve.
Ed25519 has the identity
(0,1) in Affine coordinates, meaning
(0,1) + (0,1) = (0,1) in Ed25519. It little endian encodes as
[1u8, 0u8, ..., 0u8], not all zeros.
[0u8; 32] decodes as
(1,0) because -1 is a square in F_q with q = 2^255-19, since q is divisible by 4. It follows
(1,0) lies on the curve. It's not in the distinguished prime order subgroup, but
(1,0) + (1,0) = (0,1) in Ed25519, so
(1,0) still acts like the identity in sane Ed25519 protocols. See page 6 of Ed25519 paper.
[0u8; 32] as the identity. It's arguably somewhat by chance, except Mike Hamberg avoided crazy constants in the Jacobi quartic encoding, so zero stuck around from Ed25519.
If you want unspendable funds then choose a point via hash-to-curve, which also lets you encode an undependable reason, and control who knows they're unspendable.
let mut hash = sha2::Shake256::default(); hash.input(input); let unspendable_address = RistrettoPoint::from_hash(hash).compress()
Appears dalek never released a hash-to-curve for ed25519, but they've one in master that's usable for this: https://github.com/dalek-cryptography/curve25519-dalek/blob/main/src/edwards.rs#L532
SR25519 is a Schnorr Signature protocol on top of the Ristretto compressed point format of the Ed25519 curve.
Bitcoin and Ethereum both use the Secp256k1 elliptic curve.
In elliptic-curve cryptography, public keys are points. In the Ristretto group, 0 is a member of the group, while in Secp256k1 it is not.
The secret key (a scalar value) corresponding to this member of the Ristretto group is, itself, 0.