What does the curve used in Bitcoin, secp256k1, look like?

Question

I'm reading up on ECC curves and on many of them I see an illustration that looks like this

What does the comparable curve in Bitcoin look like, or are all curves generally the same?

Answer 1

I'm afraid you won't like the answer.

These curves - including the secp256k1 curve, y² = x³ + 7 - 'look' nice when evaluated in typical fields (like the real numbers), but secp256k1 is defined over the finite field Z_{2²⁵⁶-2³²-977}, which means the X and Y coordinates are 256-bit integers modulo a large number. Curves using such coordinates do not have any concept of continuous lines.

I've tried to plot this curve over a similar but much smaller field, Z_2⁸+1. Coordinates extend from -128 to 128.

Note that even though it may not make sense geometrically anymore, it still has all properties you need. A line (which means, a group of points with equation ay + bx + c = 0) that 'intersects' 2 points of the curve, will intersect a third. Tangent again has no geometric interpretation anymore, but you can still symbolically compute a derivative of the equation in a given point, which will have the property of intersecting the curve in a second point.

To show you what you'd get if this were over the real numbers, here is a plot of the same curve equation for that case. Once with coordinates -128 through 128, once with -8 through 8.

Answer 2

you can check the Bitcoin doc https://en.bitcoin.it/wiki/Secp256k1 , there you will find some technical details about the secp256k1 used in bitcoin.

Below an illustration of the secp256k1's elliptic curve y2 = x3 + 7 over the real numbers (plot using www.desmos.com/calculator/ialhd71we3)

in the context of a finite field Zp, which greatly changes the ECC appearance but not its underlying equation or special properties. the picture below represents the same equation in a finite field F17 (the x and y values are integers between 0 and 17).

and here over F59 :

You will find an online opensource tool here https://cdn.rawgit.com/andreacorbellini/ecc/920b29a/interactive/modk-add.html which will help you to plot the graphe and to make addition or scalar multiplication on a EC. E.g plot over F97 with P+Q.

another good article to read about ECDSA in Bitcoin is https://github.com/bellaj/Bitcoin_Ethereum_docs/blob/6bffb47afae6a2a70903a26d215484cf8ff03859/ecdsa_bitcoin.pdf

secp256k1 was almost never used before Bitcoin became popular, but it is now gaining in popularity due to its several nice properties. Most commonly-used curves have a random structure, but secp256k1 was constructed in a special non-random way which allows for especially efficient computation. As a result, it is often more than 30% faster than other curves if the implementation is sufficiently optimized. Also, unlike the popular NIST curves, secp256k1's constants were selected in a predictable way, which significantly reduces the possibility that the curve's creator inserted any sort of backdoor into the curve.

Answer 3

Since the underlying field for the elliptic curve for secp256k1 is F_p where p=2²⁵⁶-2³²-977, and since p is very close to a power of 2, it makes sense to try to graph the elliptic curve y²=x³+7 over the field of 2-adic numbers or related rings. Since we only have a finite amount of room to post here, let us simply graph the elliptic curve over a ring of the form Z_2ⁿ. The ring of 2-adic integers is the inverse limit of the rings of the form Z_2ⁿ. Therefore, the rings Z_2ⁿ can be thought of as finite approximations for the ring of 2-adic integers. Now, we want to graph the elliptic curve in such a way so that two points which are near each other with respect to the 2-adic metric are also near each other on the graphical representation of the elliptic curve.

Let f:Z_2ⁿ->{0,...,2ⁿ-1} be the function where f(a₀2⁰+...+a_n-12^n-1)= a_n-12⁰+...+a₀2^n-1 whenever a₀,...,a_n-1 are all elements of the set {0,1}. In other words, f simply reverses the bits in the binary representation of an element of Z_2ⁿ. Then the white pixels in the following graph are precisely at the points with coordinates (f(x),f(y)) where y²=x³+7 mod 2ⁿ where n=9. This picture is an approximation of the image of the elliptic curve over the ring of 2-adic integers.

Since the field of complex numbers is isomorphic to any ultraproduct of the algebraic closures of finite fields F_p by a non-principal ultrafilter on the set of all prime numbers, one should think of the finite fields as an approximation to the set of all complex numbers. Furthermore, the field of p-adic numbers embeds into the field of complex numbers, so one may think of the finite fields as objects that approximate a field that contains the field of p-adic numbers as a sub-field. Therefore, it is appropriate to use the graphs of the elliptic curve y²=x³+7 over the reals, complex numbers, or even the p-adic numbers as a visualization for the fields used in elliptic curve cryptography. One just needs to realize that one is working in a different field for visualization purposes.