# The order of the generator point G used in bitcoin

Hi I was just wondering how the order of the generator point G used in bitcoin was actually calculated.

From the specification listed http://www.secg.org/SEC2-Ver-1.0.pdf for secp256k1 I can see listed is the generator point G along with its order, however I am unsure how this was actually calculated.

In one of the books I was looking through it was mentioned that Hasse's Theorem was used to calculate this value, however upon looking up this theorem this seems to only provide a bound. Any insight would be appreicated thanks :)

• What you're looking for is Schoof's algorithm. – Pieter Wuille Mar 18 at 21:36

The order of G is the number of time you will have to add G to get a point at infinity. You start at G, then add G you get 2G. If you add G a total of `n` times, you will get a point at infinity. This order `n` will tell you how many times you can add G before you reach infinity or how many distinct points are there on the curve.