7

There function in libsecp256k1 that allows you to directly set the field element to 32 bytes of your choice. Does secp256k1 always return a valid group element for any 32 byte value?

secp256k1_fe_set_b32(&xpoint, bytes)

secp256k1_ge_set_xo_var(ge, &xpoint, 0)

1 Answer 1

9

The size of secp256k1's coordinate field is 2256 - 232 - 977.

That means there are only 232 + 977 (about 4 billion) possible 32-byte combinations that are not a valid coordinate.

Only slightly less than half (around 2255 - 1.17 * 2127) of those are the X coordinate of a point on the curve (in fact, for every valid X coordinate, there are either exactly 0 or exactly 2 points on the curve).

3
  • Could you elaborate how you arrived at "around 2^255 - 1.17 * 2^127"?
    – drogos86
    May 6, 2022 at 10:19
  • I divided the curve order by two. You can find the curve order in the secp256k1 specification, or you can compute it using mathematical software like Sage. May 6, 2022 at 13:00
  • FWIW, that order (=equal to the number of points on the curve, including infinity) is 115792089237316195423570985008687907852837564279074904382605163141518161494337. May 6, 2022 at 13:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.