0

I've read online that the group order for the Bitcoin secp256k1 curve is:

0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141

Its decimal is:

115792089237316195423570985008687907852837564279074904382605163141518161494337

However, the modulo for the secp256k1 curve is the prime number:

0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F

Its decimal is:

115792089237316195423570985008687907853269984665640564039457584007908834671663

These numbers are almost identical. Since the secp256k1 curve has no subgroups, its cofactor is 1. Does that mean that by accident there are almost as many points on the curve as the modulo to compute it?

Or are these the same numbers and one is wrong?

1

Does that mean that by accident there are almost as many points on the curve as the modulo to compute it?

It is not an accident.

The number of points on an elliptic curve over a finite field is always close to the size of that field, by Hasse's theorem. Specifically it says that the difference between the number of points on the curve (excluding the point at infinity) and the size of the field is at most twice the square root of the field size.

Or are these the same numbers and one is wrong?

No, they are distinct.

The numbers can be computed using the following Sage code:

>>> F = GF(2**256 - 2**32 - 977) # secp256k1 field
>>> E = EllipticCurve(F, [0,7])  # secp256k1 curve
>>> F.order() + 1 - E.order()
432420386565659656852420866390673177327
>>> int(sqrt(F.order())
340282366920938463463374607431768211455
2
  • Amazing thank you! Do you have any resource for the math and the formulas you used in your sage code?
    – J. Hesters
    Oct 11 at 20:32
  • 1
    No; I know the field size (2^256-2^32-977) and the curve equal parameters ([a,b]=[0,7]) for secp256k1 by heart. Oct 11 at 20:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.