79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798,483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8 seems very random to me. I see how this point is on the curve, but how exactly was this specific point chosen to be the base point? Could other base points have worked?


1 Answer 1


Since the secp256k1 curve order is prime, every point on the curve except the point at infinity is a generator.

Nothing is known about how the designers of the curve chose this specific generator.

However, there is one tell-tale sign that hints about its construction. When the chosen generator G is multiplied by 1/2 (i.e. multiplied by the multiplicative inverse of 2 modulo the curve order), the resulting X coordinate is an exceptionally low number. This very likely means that G was created by picking that X, finding a corresponding Y on the curve, and then doubling the resulting point.

  • Can you share this low number X?
    – k06a
    Commented Jan 23, 2018 at 9:12
  • 1
    G/2 = (0x3b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63, 0xc0c686408d517dfd67c2367651380d00d126e4229631fd03f8ff35eef1a61e3c). Commented Jan 23, 2018 at 15:01
  • 1
    @lurfjurv To the best of my knowledge, the choice of the generator is not relevant to the security of ECDSA. Commented Jan 28, 2019 at 19:55
  • 3
    I see, so the choice is irrelevant. Is this not suspicious then? Why not pick a trivially small number for x to remove any concern that this base point has some fatal flaw or backdoor?
    – lurf jurv
    Commented Jan 29, 2019 at 21:28
  • 1
    Not only secp256k1, but also the generators of secp160k1, secp192k1, secp224k1 were created using this scheme. And even more interestingly the x coordinate of these G/2 points all look very similar. See: bitcoin.stackexchange.com/a/113495/109728 And here a gist with a Sage script to calculate these values: gist.github.com/johnzweng/863f412689ee383cc41ac7c709ca662c Commented Apr 28, 2022 at 16:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.