Yes. But just when the only information you have is that the private key is anywhere between 1 and n - 1. In other words: good luck finding the specific pair of points that add up to P (or one of its equivalent endos). How to calculate the private key for my example? A - B = P A and B have same Y so are related by B = [lambda] * A (or maybe lambda**2, didn't bother to check which one, it can easily be done by comparing the X ratios) So you have [1 - lambda] * A = P To get P's key, you need to know either A's of B's key. To get A's or B's key, you need to know P's key. This is the only "advantage" in the equation you want to solve. If you don't know either key, this property only reduces the discrete log problem complexity accordingly, by a factor of sqrt(6), but only when searching over the entire group order, which is in 256-bit key-space. Hence, only slightly reducing the secp256k1 security to around 125 bits or so. If the key is known to exist inside a known interval, less than 253 bits in size, this property is useless, since the advantage is not useful for interval-DLP solving algorithms (and it just adds overhead).
Yes. But just when the only information you have is that the private key is anywhere between 1 and n - 1. In other words: good luck finding the specific pair of points that add up to P (or one of its equivalent endos). How to calculate the private key for my example? A - B = P A and B have same Y so are related by B = [lambda] * A (or maybe lambda**2, didn't bother to check which one, it can easily be done by comparing the X ratios) So you have [1 - lambda] * A = P To get P's key, you need to know either A's of B's key. To get A's or B's key, you need to know P's key. This is the only "advantage" in the equation you want to solve. If you don't know either key, this property only reduces the discrete log problem complexity accordingly, by a factor of sqrt(6), but only when searching over the entire group order, which is in 256-bit key-space. Hence, only slightly reducing the secp256k1 security to around 125 bits or so. If the key is known to exist inside a known interval, less than 253 bits in size, this property is useless, since the advantage is not useful for interval-DLP solving algorithms (and it just adds overhead).

Yes. But just when the only information you have is that the private key is anywhere between 1 and n - 1. In other words: good luck finding the specific pair of points that add up to P (or one of its equivalent endos). How to calculate the private key for my example? A - B = P A and B have same Y so are related by B = [lambda] * A (or maybe lambda**2, didn't bother to check which one, it can easily be done by comparing the X ratios) So you have [1 - lambda] * A = P To get P's key, you need to know either A's of B's key. To get A's or B's key, you need to know P's key. This is the only "advantage" in the equation you want to solve. If you don't know either key, this property only reduces the discrete log problem complexity accordingly, by a factor of sqrt(6), but only when searching over the entire group order, which is in 256-bit key-space. Hence, only slightly reducing the secp256k1 security to around 125 bits or so. If the key is known to exist inside a known interval, less than 253 bits in size, this property is useless, since the advantage is not useful for interval-DLP solving algorithms (and it just adds overhead).

Yes. But just when the only information you have is that the private key is anywhere between 1 and n - 1. In other words: good luck finding the specific pair of points that add up to P (or one of its equivalent endos). How to calculate the private key for my example? A - B = P A and B have same Y so are related by B = [lambda] * A (or maybe lambda**2, didn't bother to check which one, it can easily be done by comparing the X ratios) So you have [1 - lambda] * A = P To get P's key, you need to know either A's of B's key. To get A's or B's key, you need to know P's key. This is the only "advantage" in the equation you want to solve. If you don't know either key, this property only reduces the discrete log problem complexity accordingly, by a factor of sqrt(6), but only when searching over the entire group order, which is in 256-bit key-space. Hence, only slightly reducing the secp256k1 security to around 125 bits or so. If the key is known to exist inside a known interval, less than 253 bits in size, this property is useless, since the advantage is not useful for interval-DLP solving algorithms (and it just adds overhead).