> [!faq] I can compute $x_{[a]B}$ for any $B$ on an elliptic curve using an ECDH implementation with secret scalar $a$, but how can I determine $[a]B$? Provide $B$ and $B+G$ for generator $G$. Take a candidate $y$, define $Z=(x_{[a]B},y)$ and compute $x_{Z+A}$ for $A=[a]G$. Verify if $x_{Z+A}=x_{[a](B+G)}$. Otherwise, repeat with a different candidate. Given the EC formula I can determine a small set of candidates $y$ for $y_{[a]B}$. If $y$ is the correct candidate, $Z+A=[a]B+[a]G=[a](B+G)$ so the $x$-coordinates will match. Source: https://mailarchive.ietf.org/arch/msg/cfrg/0BgHoebVKCNMXwtXdvyHbuNNKiA/