# Difference between Bitcoin private key space and secp256k1 modulo

I've read online that the group order for the Bitcoin secp256k1 curve is:

``````0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
``````

Its decimal is:

``````115792089237316195423570985008687907852837564279074904382605163141518161494337
``````

However, the modulo for the secp256k1 curve is the prime number:

``````0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
``````

Its decimal is:

``````115792089237316195423570985008687907853269984665640564039457584007908834671663
``````

These numbers are almost identical. Since the secp256k1 curve has no subgroups, its cofactor is 1. Does that mean that by accident there are almost as many points on the curve as the modulo to compute it?

Or are these the same numbers and one is wrong?

Does that mean that by accident there are almost as many points on the curve as the modulo to compute it?

It is not an accident.

The number of points on an elliptic curve over a finite field is always close to the size of that field, by Hasse's theorem. Specifically it says that the difference between the number of points on the curve (excluding the point at infinity) and the size of the field is at most twice the square root of the field size.

Or are these the same numbers and one is wrong?

No, they are distinct.

The numbers can be computed using the following Sage code:

``````>>> F = GF(2**256 - 2**32 - 977) # secp256k1 field
>>> E = EllipticCurve(F, [0,7])  # secp256k1 curve
>>> F.order() + 1 - E.order()
432420386565659656852420866390673177327
>>> int(sqrt(F.order())
340282366920938463463374607431768211455
``````
• Amazing thank you! Do you have any resource for the math and the formulas you used in your sage code? Commented Oct 11, 2021 at 20:32
• No; I know the field size (2^256-2^32-977) and the curve equal parameters ([a,b]=[0,7]) for secp256k1 by heart. Commented Oct 11, 2021 at 20:37