Skip to main content
Share Your Experience: Take the 2024 Developer Survey
35 votes

What does the curve used in Bitcoin, secp256k1, look like?

you can check the Bitcoin doc https://en.bitcoin.it/wiki/Secp256k1 , there you will find some technical details about the secp256k1 used in bitcoin. Below an illustration of the secp256k1's elliptic ...
Badr Bellaj's user avatar
  • 1,151
26 votes
Accepted

Is a bitcoin address collision possible if generating 90 million addresses every 4 hours?

Because of the Birthday paradox, you only need 280 addresses (despite there existing 2160 different address combinations) before a collision becomes probable. Thankfully, that is still an enormous ...
Pieter Wuille's user avatar
26 votes
Accepted

How is the generator point G chosen in the secp256k1 curve used in Bitcoin?

We don't know. The secp256k1 curve (and the corresponding generator) was defined and standardized by people at Certicom. I know people have inquired about its origins, but it appears those involved ...
Pieter Wuille's user avatar
24 votes
Accepted

How can I manually (on paper) calculate a Bitcoin public key from a private key?

I've spent a fair bit of time thinking about this and can provide a fairly comprehensive answer about the state of the art. But unfortunately the TL;DR is that we don't know how to do this (yet) in ...
Andrew Poelstra's user avatar
17 votes
Accepted

What is the origin of insecure 64-bit nonces in signatures in the Bitcoin chain?

Based on the time-frame and my impression of the capabilities of the various groups developing wallet software during that period my initial guess was that the Bitpay copay software might be the ...
G. Maxwell's user avatar
  • 7,727
17 votes

Should I share my seed phrase to earn airdrop tokens?

No, it is not safe. Never share your 12 word phrase. It is a backup of your private key and allows people to spend your money. They only need your public key or Bitcoin address to give you money, not ...
noone392's user avatar
  • 422
12 votes
Accepted

Byte array to hexadecimal and back again in JavaScript

Here's something you can copy-paste in. byteArray = new Uint8Array([181,143,16,173,231,56,63,149,181,185,224,124,84,230,123,36]); function toHexString(byteArray) { return Array.prototype.map.call(...
Nick ODell's user avatar
  • 29.4k
11 votes

Why does the TXID have 256 bits when Bitcoin's address security is 160-bit?

Security levels First of all, the relation between security level and the number of bits involved is non-trivial, and depends on the sort of attack we're talking about. For what follows, there are ...
Pieter Wuille's user avatar
11 votes

How is the generator point G chosen in the secp256k1 curve used in Bitcoin?

As Pieter already described in his answer it is not known why the multiplicative inverse of 2 of the generator point of secp256k1 is such a short (166 bit) number. But interestingly all prime order ...
Johannes Zweng's user avatar
10 votes
Accepted

BIP32 recommends a 256 bit seed. Why do most Bitcoin wallets only use a 128 bit seed?

The reasons for the 3 numbers: Bitcoin uses 256-bit ECDSA signatures. These require in the order of 2128 steps to find a private key from the public key is known. This is Bitcoin's security level: we ...
Pieter Wuille's user avatar
9 votes
Accepted

How to generate a Bitcoin Private Key Checksum

F29E9187 are indeed the first four bytes of the double sha256 of the bytes: 802CF24DBA5FB0A30E26E83B2AC5B9E29E1B161E5C1FA7425E73043362938B982401 In order to check this, you need to compute the ...
Sven Williamson's user avatar
9 votes
Accepted

Is there a point on the secp256k1 curve for any given X coordinate?

The size of secp256k1's coordinate field is 2256 - 232 - 977. That means there are only 232 + 977 (about 4 billion) possible 32-byte combinations that are not a valid coordinate. Only slightly less ...
Pieter Wuille's user avatar
8 votes

Is a bitcoin address collision possible if generating 90 million addresses every 4 hours?

A very relevant answer can be found here: Is Each Bitcoin Address Unique? This is a question of the birthday attack on the hashes. Bitcoin addresses (assuming the "normal" style starting with a 1) ...
meshcollider's user avatar
  • 11.8k
8 votes
Accepted

How can my private key be revealed if I use the same nonce while generating the signature?

Let me rewrite your question in a different notation, where all lowercase values are integers and uppercase values are points. The group generator is G (a known constant). The private key is q, its ...
Pieter Wuille's user avatar
7 votes
Accepted

Private key generation doubt

You're right, there is no strict requirement that the private key is strictly less than the group order. However, it is required that the resulting public key is uniform, which implies that (x % n) ...
Pieter Wuille's user avatar
7 votes
Accepted

What are the 3 arguments called in function SHA256?

Let's disect this function call: void sha256(struct sha256 *sha, const void *p, size_t size) First we realize that the return value is void which means the function does not return the sha256 of the ...
Rene Pickhardt's user avatar
7 votes
Accepted

Why bitcoin's generator point does not satisfy Elliptic Curve Cryptography equation?

The secp256k1 arithmetic is defined over the finite field of integers modulo 2256 - 232 - 977. The following code works: M = 2**256 - 2**32 - 977 Acurve = 0 Bcurve = 7 Gx = ...
Pieter Wuille's user avatar
7 votes
Accepted

Why does BIP-340 use secp256k1?

Couldn't it have used other curves, like Curve25519 and its signature schemes that are being used by many other projects? Curve25519 is a key agreement scheme, but if you're referring to the (related)...
Pieter Wuille's user avatar
6 votes

What exactly is generator G in Bitcoin's elliptical curve algorithm?

The value of G(compressed) = 02 79BE667E F9DCBBAC 55A06295 CE870B07 029BFCDB 2DCE28D9 59F2815B 16F81798 and G(uncompressed) = 04 79BE667E F9DCBBAC 55A06295 CE870B07 029BFCDB 2DCE28D9 59F2815B ...
DOLLY PATWA's user avatar
6 votes

ECDSA: (v, r, s), what is v?

As all the other answers already outline: v is required to recover the correct public key for a signature because there are sometimes (even with low probability) more than one valid public key to be ...
q9f's user avatar
  • 1,445
6 votes
Accepted

Why is only the block header SHA256-hashed and not the whole block?

In fact, it is done over the whole block, but indirectly. One of the members in the block header is the Merkle root hash of the transaction hashes. Effectively, that is a hash of all the transactions....
Pieter Wuille's user avatar
6 votes
Accepted

SECP256K1 Minimum Value for Private Key

If people in general would more often pick lower integers as private keys than larger integers, then it would be a good strategy for an attacker to start with lower integers. However, the opposite ...
Pieter Wuille's user avatar
6 votes
Accepted

What's the difference between xpub and bpub?

bpub appears to be the extended private key prefix for the Blockcypher testnet. Bitcoin addresses and private keys usually have a prefix to help differentiate the network/type of key. The original ...
Raghav Sood's user avatar
  • 17.1k
6 votes

To what extent does asymmetric cryptography secure bitcoin transactions?

Is there a specific attack or bug which asymmetric cryptography prevents during bitcoin transactions? asymmetric cryptography is not really something that was added on top of Bitcoin in order to ...
RedGrittyBrick's user avatar
6 votes
Accepted

Elliptic Curve Point at Infinity

What exactly is the "point at infinity"? It's a point that is added to the points on the curve. Together they form a group. It has the following properties: (x,y) + (x,-y) = infinity (x,y) + ...
Pieter Wuille's user avatar
5 votes

What is a compressed Bitcoin key?

a good explanation is available in How can I test if a bitcoin address is compressed or not? More specifically, a public key in Bitcoin is a pair integers (x,y). For uncompressed public keys, ...
Badr Bellaj's user avatar
  • 1,151
5 votes
Accepted

What is so special about chacha20 stream cipher along with poly1305 for message authentication codes?

What is so special about chacha20 stream cipher along with poly1305 for message authentication codes? There is nothing special about the combination. It's just a combination of two constructions (...
Pieter Wuille's user avatar
5 votes

To what extent does asymmetric cryptography secure bitcoin transactions?

Without asymetric cryptography, there wouldn't be information asymmetry: in other words, everyone knows exactly as much as everyone else. If everyone knows equally much, there is no way to distinguish ...
Pieter Wuille's user avatar
5 votes

Can I be rewarded for discovering, creating, and proving bugs on Bitcoin?

Yes, finding bugs in Bitcoin would be valuable. However this doesn't seem to be one. What's shown here is a series of supposed "signatures" with the hashes of messages they supposedly sign. ...
Murch's user avatar
  • 75.8k
5 votes

Why can't I reverse secp256k1's public key point in order to determine the private key?

If you naively implement this G * G * G...* G method, you will have to perform an enormous number of operations until get your public key. For instance, if your public key is 2^128, you need to add G ...
Davidson Souza's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible