I understand that G is a point on curve which holds true for y^2 = x^3 + ax + b. But there can be several other points as well which holds true for above equation but how do we choose which one is our G?
2 Answers
There often are multiple points which could be generators. In fact, for prime order curves, every point on the curve is a generator.
For practical use, a specific point is picked based on some constraints.
May curves use rules such as lowest abs(x)
value or use some deterministic generator with a random seed.
I can't seem to find the login behind the G selection for secp256k1, however, but the point itself is defined in the curve specification.
-
Thanks for the answer. I am actually trying to understand elliptic curve cryptography, specifically how the signature is verified, shared secret generation and the math behind it. I have gone through lot of information on internet, i am still not able to connect dots to fully understand it. can you help me? Commented Aug 10, 2018 at 12:58
It's defined in the specification of the curve. In Bitcoin, the curve was SECP256k1 is chosen and the curve parameters are defined here: SEC 2: Recommended Elliptic Curve Domain Parameters, Version 1.0