I understand that G is a point on curve which holds true for y^2 = x^3 + ax + b. But there can be several other points as well which holds true for above equation but how do we choose which one is our G?

There often are multiple points which could be generators. In fact, for prime order curves, every point on the curve is a generator.

For practical use, a specific point is picked based on some constraints.

May curves use rules such as lowest abs(x) value or use some deterministic generator with a random seed.

I can't seem to find the login behind the G selection for secp256k1, however, but the point itself is defined in the curve specification.

  • Thanks for the answer. I am actually trying to understand elliptic curve cryptography, specifically how the signature is verified, shared secret generation and the math behind it. I have gone through lot of information on internet, i am still not able to connect dots to fully understand it. can you help me? – Ishwar Chandra Aug 10 at 12:58

It's defined in the specification of the curve. In Bitcoin, the curve was SECP256k1 is chosen and the curve parameters are defined here: SEC 2: Recommended Elliptic Curve Domain Parameters, Version 1.0

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.