What exactly is the generator G in elliptical curve math? It is typically described as a point on the curve. Is this a tuple of values? What properties does it have?


For a curve with for instance the equation: y^2 = x^3 + a * x + b

The generator point G, or a ECDSA public key, is a pair of coordinates x and y, for which the above equation holds.

To reduce the storage size for a curve point, one can also store a sign and the x coordinate, this is what is known as point-compression.

You can then reconstruct the y by calculating sign * sqrt(x^3+a*x+b).

Note that for calculations in modular fields the square root can only be calculated efficiently when the p != 1 (mod 8)

| improve this answer | |
  • 3
    Note that in the specific case of Bitcoin's secp256k1 curve, a = 0 and b = 7, so the formula is y^2 = x^3 + 7. – Pieter Wuille Jan 13 '15 at 20:41

You can think of the generator G as the first point after infinity on the curve. Begin with infinity and add G; the result is G. Add G to this and you get 2G. Add G to this and you get 3G. And so on. If you add G a total of n times (where n is the order of the curve) you will be back at infinity, where you started; the whole curve is a never-ending loop. The order n is how many distinct points are on the curve, or in Bitcoin terms, how many possible private keys there are (plus 1 for the point at infinity).

| improve this answer | |

The value of

G(compressed) = 02 79BE667E F9DCBBAC 55A06295 CE870B07 029BFCDB 2DCE28D9 59F2815B 16F81798


G(uncompressed) = 04 79BE667E F9DCBBAC 55A06295 CE870B07 029BFCDB 2DCE28D9 59F2815B 16F81798 483ADA77 26A3C465 5DA4FBFC 0E1108A8 FD17B448 A6855419 9C47D08F FB10D4B8

source: https://en.bitcoin.it/wiki/Secp256k1

| improve this answer | |
  • This is a potentially useful answer, but it could be improved by adding a little more explanation. – Murch Jul 7 '17 at 16:18
  • Yes.. Uncompressed G has 2 co-ordinates X and Y since it is point on the curve and its size is 520 bits(65 Bytes) i.e 256 bits for each co-ordinate And it has a prefix 04 , While Compressed G has only one co-ordinate i.e.X And a prefix either 02 when Y co-ordinate is positive or 03 when Y co-ordinate is Negative. – DOLLY PATWA Jul 13 '17 at 11:06

Starting with a private key in the form of a randomly generated number k, we multiply it by a predetermined point on the curve called the generator point G to produce another point somewhere else on the curve, which is the corresponding public key K. The generator point is specified as part of the secp256k1 standard and is always the same for all keys in bitcoin: K = k *G where k is the private key, G is the generator point, and K is the resulting public key, a point on the curve. Because the generator point is always the same for all bitcoin users,a private key k multiplied with G will always result in the same public key K. The rela‐ tionship between k and K is fixed, but can only be calculated in one direction, from k to K. That’s why a bitcoin address (derived from K) can be shared with anyone and does not reveal the user’s private key (k).

from the Book "Mastering Bitcoin" by Andreas Antonopoulos http://uplib.fr/w/images/8/83/Mastering_Bitcoin-Antonopoulos.pdf

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.