TL;DR: you can to a limited extent define what point addition between two distinct curves is, by just reusing the formulas, but there will not be any relation between this and the corresponding private keys.
Let us consider elliptic curves of the form
Y2 = X3 + aX + b, modulo p
(these are called short Weierstrass curves)
For secp256k1, p = 2256 – 232 – 977, a = 0, b = 7.
The most impactful parameter is p. If you change p, you change what sort of numbers X and Y are. While they are written identically, “the integer 37“, “the integer 37 in the set of numbers modulo p“, and “the integer 37 in the set of numbers modulo q ≠ p” are all three very different beasts, with very different mathematical properties. Because of this, I’m going to stick to the same modulus p going forward. If you change the modulus, I don’t see how you’d define what operations on elliptic curve points look like. Which modulus do you use?
Instead, let’s restrict ourselves to modulus p. Now look at the elliptic curve point addition equation (which does not apply when adding a point to itself or its negation, but ignore these) for adding the point (X1,Y1) to (X2,Y2), resulting in (X3,Y3):
X3 = λ2 – X1 – X2, and Y3 = λ(X1 – X3) – Y1, where λ = (X2 – X1)-1(Y2 – Y1), all modulo p.
Note that ()-1 refers to the modular inverse here, not the regular inverse.
Now observe that neither the curve coefficients a or b appear in this equation. This means that in theory, there is no issue with appropriating the same formula to try to do a cross-chain point addition. We’ll get some numbers out; the question is just if these are meaningful numbers.
Since you’re asking about a relation between the private keys, we have an additional requirement. The private keys live in yet another kind of number space, the integers modulo n, where n is the order of the curve, and this order depends on the other parameters (p, a, and b). If we keep a=0 like in secp256k1, we find the following orders:
- b=1: n = p – 671331852483699643819086596696745227419
- b=2: n = p + 432420386565659656852420866390673177328
- b=3: n = p – 238911465918039986966665730306072050092
- b=4: n = p + 238911465918039986966665730306072050094
- b=5: n = p – 238911465918039986966665730306072050092 (same as b=3)
- b=6: n = p + 671331852483699643819086596696745227421
- b=7: n = p – 432420386565659656852420866390673177326 (
secp256k1) - b=8: n = p – 671331852483699643819086596696745227419 (same as b=1)
- …
- b=12: n = p – 671331852483699643819086596696745227419 (same as
secp256k1, b=7)
Private keys are not comparable when working with curves of distinct orders, so let’s pick two equal-order curves:
- E1 : Y2 = X3 + 7 (
secp256k1) - E2 : Y2 = X3 + 12 (same order as
secp256k1).
And let’s pick a point on each:
- P1 = (1, √8) ∊ E1 (note that √ here refers to the modular square root).
- P2 = (3, √39) ∊ E2
If we apply the addition formula to these points, we get (95199522409000127469965119215597403251155081608447464174576216444950477495870, 17817862784113219767619204370558314933049610986520000131582270812967486670101) which lies on yet another curve, Y2 = X3 + 113806959772543662429059682568787218964422045791894232716808486305727155222289, which has order n = p + 671331852483699643819086596696745227421. Since the order is different from secp256k1, this means its private key will be incomparable to secp256k1 private keys.
Let’s try again:
- Q1 = (4, √71) ∊ E1
- Q2 = (8, √524) ∊ E2
Adding these, we get (83860777440659491102688138897119789724824336349874362905090427965396639347581,94100849044437599780075883675011580302479606607256518328981974291822837065288), which lies on curve Y2 = X3 + 49979308264443915896639903731913831145103210634021312327468991256158292998092, which has order n = p + 432420386565659656852420866390673177328.
So, even when we pick maximally similar curves, and try to add points across them, we end up with points that land on various distinct unrelated curves, on which the private keys are meaningless to compare with secp256k1.
