I understand that G is a point on curve which holds true for y^2 = x^3 + ax + b. But there can be several other points as well which holds true for above equation but how do we choose which one is our G?

2 Answers 2


There often are multiple points which could be generators. In fact, for prime order curves, every point on the curve is a generator.

For practical use, a specific point is picked based on some constraints.

May curves use rules such as lowest abs(x) value or use some deterministic generator with a random seed.

I can't seem to find the login behind the G selection for secp256k1, however, but the point itself is defined in the curve specification.

  • Thanks for the answer. I am actually trying to understand elliptic curve cryptography, specifically how the signature is verified, shared secret generation and the math behind it. I have gone through lot of information on internet, i am still not able to connect dots to fully understand it. can you help me? Commented Aug 10, 2018 at 12:58

It's defined in the specification of the curve. In Bitcoin, the curve was SECP256k1 is chosen and the curve parameters are defined here: SEC 2: Recommended Elliptic Curve Domain Parameters, Version 1.0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.