Assuming secp256k1 curve and given fixed (but random) $h$ and $d$ values, is it possible to calculate a $k$ such that $h\equiv(k\,G)_X\,(k-d)\pmod n$?

100 Views Asked by At

For generator point $G$ in the secp256k1 curve, I want to find a value $k$ such that: $$h\equiv(k\,G)_X\,(k-d)\pmod n$$ where $n$ is the group order, and $(k\,G)_X$ indicates the x-coordinate (mod n) of the resulting point after the multiplication by $k$. Assume $h$ and $d$ are fixed scalar values that I've been given.

Is it possible to calculate $k$?

Without the multiplication by $(k - d)$, this would just be the ECC discrete log problem. Does having that extra multiplication make it easier to calculate some $k$, or is there a way to show that it still reduces to the discrete log problem?

In my experiments with smaller fields, it appears that no such $k$ value exists about 35% of the time.