6

points on curve secp256k1 form a group E(Fp) over field Fp.

p = 2^256 - 2^32 - 2^9 - 2^8 - 2^7 - 2^6 - 2^4 - 1 is prime.

n is the order of group E, n=115792089237316195423570985008687907852837564279074904382605163141518161494337

Is n prime too?

Is E(Fp) a cyclic group?

Theorem. Working over a finite field, the group of points E(Fp) is always either a cyclic group or the product of two cyclic groups.

Improve this question
1
  • n has to be a prime such that (Gx, Gy) * n = slope is infinity. Hopefully someone can answer the other part
    – Wizard Of Ozzie
    Jun 21, 2015 at 0:34

2 Answers 2

Reset to default
5

The comment stating n “has to be prime” is a bit confusing.

The order of base point “has” to be prime in the sense that this is a requirement in the particular documents defining standard curves—for example, in SECG, which includes secp256k1. Bitcoin's base point order r is prime.

In SECG, it is also stated that cofactor of secp256k1 curve is 1, which makes n = r × 1, again prime. A group of prime order is obviously cyclic.

Improve this answer
4
  • Thank you for your answer! So E(K) is a cyclic group, r = n is prime and then each element of E(K)* has order n --> each element could have been the base point. Is there a reason SEC chose G = 02 79BE667E F9DCBBAC 55A06295 CE870B07 029BFCDB 2DCE28D9 59F2815B 16F81798 as base point?
    – arulbero
    Jun 21, 2015 at 6:37
  • @arulbero re SEC defined G: great question. Anyone know why? Why not start at x=0?
    – Wizard Of Ozzie
    Jun 21, 2015 at 14:17
  • @Wizard Of Ozzie The point "O" is the only one that cannot be chosen, because order of O is 1. To generate safely a public key starting from G, G's order must be a prime number, as large as possible; in our case each element except O has the same order, n.
    – arulbero
    Jun 21, 2015 at 17:42
  • 1
    @WizardOfOzzie@arulbero It's likely the base points in SECG were chosen randomly. It's also likely that this had led to some controversy since then. References are not very easy to locate, sorry.
    – akater
    Jun 22, 2015 at 18:22
0

xG ( x of Generator point G) is a carefully selected 256 bit number that is divisible by the elements 0001, 0010, 0011, 0100, 0101, 0110, 0111 (1 to 7) i.e

0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798 =

55066263022277343669578718895168534326250603453777594175500187360389116729240 mod 1, mod 2, mod 3, up to mod 7 will all have the same result = 0

This means that for the elements 1 to 7 that make up the smallest sub-group of order n there exists no residuals that may leak information as a result of operating G under addition or multiplication ( which is successive addition) since all points on the curve must satisfy the same equation y^2=x^3+7 used to construct the smallest subgroup.

A pleasure to have my first interaction with a Bitcoin community on Bitcoin.Stackexchange

Improve this answer
9
  • 1
    This all sounds very confused. The order of the generator is n, the same as the order of the curve (by definition, as it is a generator). It's an interesting observation that its X coordinate is a multiple of so many small numbers, but I'm not convinced that's intentional or coincidence. It's not true for Y, and I don't see what advantage there could be to this.
    – Pieter Wuille
    Jul 7, 2022 at 21:22
  • The order "n" (a prime integer) is the max number of times a single element G ( an X,Y coordinate where both x and y are integers too) can be added to itself geometrically. Since x & y are essentially integers as well, then the geometric structure is nothing but the relation between those integers x and y that satisfies the equation "y^2=x^3+7" which is the shape of the EC. If the equation is satisfied then they become "points" (x,y) on the EC. Also only x matters, as we are not solving for Y it is there to define the geometric relation thats why we can use compressed pub keys
    – Moussa Al-Basheer
    Jul 7, 2022 at 23:24
  • 1
    x and y are integers modulo p, but the order of G is with respect to the elliptic curve point addition operations, and this has as far as I know nothing to do with the integer value factorization of the coordinates.
    – Pieter Wuille
    Jul 7, 2022 at 23:25
  • the doubling and adding operations are over the x &y coordinates of G, where x at G defined by SEC is already a 256 bit number, if you just perform G+G+G by the 3rd addition, the x-value is already bigger than the 256 bits prime modulus when you have only performed 3*G. that why we have the 2 mods, one, is to keep the integer coordinates within range, and the other simply denoting how many operations we can do
    – Moussa Al-Basheer
    Jul 7, 2022 at 23:37
  • 1
    The addition operation on elliptic curve groups is not just adding the coordinates together, but a much more involved operation: see "Point Addition" on en.m.wikipedia.org/wiki/Elliptic_curve_point_multiplication for example.
    – Pieter Wuille
    Jul 7, 2022 at 23:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.