79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798,483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8 seems very random to me. I see how this point is on the curve, but how exactly was this specific point chosen to be the base point? Could other base points have worked?
-
2Does this answer your question? How is the generator point G chosen in the secp256k1 curve used in Bitcoin?– Pieter WuilleCommented May 16, 2022 at 17:26
Add a comment
|
1 Answer
Since the secp256k1 curve order is prime, every point on the curve except the point at infinity is a generator.
Nothing is known about how the designers of the curve chose this specific generator.
However, there is one tell-tale sign that hints about its construction. When the chosen generator G is multiplied by 1/2 (i.e. multiplied by the multiplicative inverse of 2 modulo the curve order), the resulting X coordinate is an exceptionally low number. This very likely means that G was created by picking that X, finding a corresponding Y on the curve, and then doubling the resulting point.
answered Aug 28, 2017 at 1:04
-
-
1G/2 = (0x3b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63, 0xc0c686408d517dfd67c2367651380d00d126e4229631fd03f8ff35eef1a61e3c). Commented Jan 23, 2018 at 15:01
-
1@lurfjurv To the best of my knowledge, the choice of the generator is not relevant to the security of ECDSA. Commented Jan 28, 2019 at 19:55
-
3I see, so the choice is irrelevant. Is this not suspicious then? Why not pick a trivially small number for x to remove any concern that this base point has some fatal flaw or backdoor? Commented Jan 29, 2019 at 21:28
-
1Not only secp256k1, but also the generators of secp160k1, secp192k1, secp224k1 were created using this scheme. And even more interestingly the x coordinate of these G/2 points all look very similar. See: bitcoin.stackexchange.com/a/113495/109728 And here a gist with a Sage script to calculate these values: gist.github.com/johnzweng/863f412689ee383cc41ac7c709ca662c Commented Apr 28, 2022 at 16:05