From a private key to a public key

Elliptic-curve scalar multiplication as a cryptographic one-way function, played out on a toy curve small enough to see every point.

The idea

Ethereum keys live on the elliptic curve secp256k1. A private key is just an integer k. The public key is the point Q = kG, where G is a fixed base point and the multiplication means adding the point to itself k times (scalar multiplication). Going from k to Q is fast; going from Q back to k is the Elliptic Curve Discrete Logarithm Problem (ECDLP), believed to be infeasible. That asymmetry is what makes scalar multiplication a one-way function: deterministic and cheap forwards, hard backwards.

To see the mechanism we use a toy curve: the very same equation y² = x³ + 7, but over the small field 𝔽₁₇ (mod 17) instead of a 256-bit prime. It has 17 affine points plus the point at infinity — 18 in total. The base point G = (1, 5) has order 9, so its multiples cycle through 9 points. With the homework's private key k = 6 the toy public key is 6G = (5, 8).

Explore the curve

Setup

Base point

order — subgroup —

Walking the subgroup

The whole finite field is a 17×17 lattice. The dots are the points that actually satisfy the curve equation; the accent points are the subgroup generated by the base point. Drag the slider to multiply and watch kG jump around the cycle.

Private key k = 6

curve points (18 total) multiples of the base point current kG

The algorithm: double-and-add

Adding the point k times is slow for large k. Double-and-add instead reads the binary expansion of k: double the accumulator once per bit, and add the base point for every 1-bit. That is O(log k) operations instead of O(k) — the same trick that makes real 256-bit keys practical.

Statistical exploration

The task asks us to repeat the experiment over many values of k (and different valid base points) and look at the statistics of the resulting points. Run the sampler below and then read the commentary — the honest interpretation matters more than the pictures.

Sampler

Random trials (random k)

x-coordinate frequency (values 0–16)

y-coordinate frequency (values 0–16)

Bit frequency: fraction of 1-bits in the five bits of x (left) and y (right); dashed line = the 0.5 you would want from a hash.

k versus x(kG): the map is a permutation of the subgroup, so every subgroup x-value appears exactly once.

Hamming distance between x(kG) and x((k+1)G) over 1..order−1: how much changing k by 1 scrambles the 5-bit coordinate.

What the statistics mean — and what they don't

Uniformity here is trivial, not evidence of strength. The subgroup has only 9 points, so the map k → kG is a bijection: every k ∈ {1..8} lands on a distinct point and every subgroup coordinate is hit exactly once. Perfectly flat histograms follow from the subgroup being a cyclic group, not from any cryptographic virtue. A permutation of a tiny set always looks uniform.

The real property is computational. What makes this a one-way function is that the permutation is hard to invert — that is the ECDLP — not anything about the output distribution. On a toy curve you can brute-force the answer in microseconds; on secp256k1 the same map is secure because the search space is ~2²⁵⁶.

"Avalanche-like" is an analogy, not an equivalence. Scalar multiplication is algebraic, not chaotic. A cryptographic hash flips about 50% of the output bits when a single input bit changes; the coordinate change here follows the group law and the subgroup size, and need not be near 50%. The scatter of k–vs–x looks like noise, but the dependence exists by construction.

Correlations exist but are useless. Q determines k uniquely, so in principle the input and output are perfectly correlated. The point of the one-way property is that exploiting that correlation requires solving the discrete logarithm. Statistical independence of bit patterns is a property associated with cryptographic hash functions; hardness of inversion is what matters for public-key primitives like this one.