Skip to main content
38 votes
Accepted

Why is it not possible to get the private key out of the public key?

How I understood it, the equation for the public key is defined as so K = k * G With K being the public key, k the private key and G the generator point. That's correct. Now my first question, is G ...
Pieter Wuille's user avatar
35 votes

What does the curve used in Bitcoin, secp256k1, look like?

you can check the Bitcoin doc https://en.bitcoin.it/wiki/Secp256k1 , there you will find some technical details about the secp256k1 used in bitcoin. Below an illustration of the secp256k1's elliptic ...
Badr Bellaj's user avatar
  • 1,151
26 votes
Accepted

How is the generator point G chosen in the secp256k1 curve used in Bitcoin?

We don't know. The secp256k1 curve (and the corresponding generator) was defined and standardized by people at Certicom. I know people have inquired about its origins, but it appears those involved ...
Pieter Wuille's user avatar
14 votes
Accepted

What is the reasoning behind the choice of 2^256-2^32-977 for the prime on the secp256k1 curve?

Secp256k1 was designed to be a 256-bit size elliptic curve without cofactor and admitting an efficient endomorphism for optimization purposes. The choices of the relevant parameters are derived from ...
G. Maxwell's user avatar
  • 7,727
11 votes
Accepted

How can a deterministic wallet have one private key but multiple public keys

No, there is not one private key. There is one Master private key. The master private key is then used to generate more private keys in a deterministic fashion, i.e. using the same master private key, ...
Ava Chow's user avatar
  • 70.9k
11 votes
Accepted

Why was the Schnorr code removed from Bitcoin Core?

The Schnorr implementation was never in Bitcoin Core. Rather it is in the libsecp256k1 library that is a subtree in Bitcoin Core. The commit you reference is actually a commit in that library which ...
Ava Chow's user avatar
  • 70.9k
11 votes

Why doesn't basepoint G of Secp256K1 seem to be on the Elliptic Curve?

The secp256k1 curve is defined over x and y coordinates that are members of the finite field GF(2^256 - 2^32 - 977), or in other words, their operations hold only when considered modulo ...
Pieter Wuille's user avatar
11 votes

How is the generator point G chosen in the secp256k1 curve used in Bitcoin?

As Pieter already described in his answer it is not known why the multiplicative inverse of 2 of the generator point of secp256k1 is such a short (166 bit) number. But interestingly all prime order ...
Johannes Zweng's user avatar
10 votes
Accepted

BIP32 recommends a 256 bit seed. Why do most Bitcoin wallets only use a 128 bit seed?

The reasons for the 3 numbers: Bitcoin uses 256-bit ECDSA signatures. These require in the order of 2128 steps to find a private key from the public key is known. This is Bitcoin's security level: we ...
Pieter Wuille's user avatar
9 votes
Accepted

Is there a point on the secp256k1 curve for any given X coordinate?

The size of secp256k1's coordinate field is 2256 - 232 - 977. That means there are only 232 + 977 (about 4 billion) possible 32-byte combinations that are not a valid coordinate. Only slightly less ...
Pieter Wuille's user avatar
9 votes
Accepted

What is the difference between secp256k1_ecmult_gen and secp256k1_ecmult?

How should these two functions be used properly? A simple answer is "not at all". Those functions are not exposed in the public API of libsecp256k1, and that's the reason why they don't ...
real-or-random's user avatar
8 votes
Accepted

What is the relationship between the three possible X coordinates corresponding to a Y coordinate?

Yes, there is! For a given Y coordinate y, if on the curve, the three corresponding X coordinates are the cube roots of y2 - 7. If you have any such cube root y0, then multiplying it with a cube root ...
Pieter Wuille's user avatar
7 votes
Accepted

Private key generation doubt

You're right, there is no strict requirement that the private key is strictly less than the group order. However, it is required that the resulting public key is uniform, which implies that (x % n) ...
Pieter Wuille's user avatar
7 votes
Accepted

C secp256k1: What is the purpose of the idiom '(void)data;'?

Without (void) data;, gcc will complain about data being an unused variable. This is used throughout the codebase, especially for context objects, to deal with parameters which are required for API/...
Andrew Poelstra's user avatar
7 votes
Accepted

Why Schnorr was added to secp256k1 library instead of a separate library?

Yes, the BIP340 signature scheme that was added to libsecp256k1 is an Elliptic Curve based variant of Schnorr signatures. Traditionally Schnorr signatures use a group of integer multiplication modulo ...
Pieter Wuille's user avatar
7 votes

Why is it not possible to get the private key out of the public key?

Mathematicians like their analogies, sometimes those analogies can be helpful, but they can equally be confusing, particularly to those new to a field. In mathematics a "group" consists of a ...
Peter Green's user avatar
7 votes
Accepted

Why bitcoin's generator point does not satisfy Elliptic Curve Cryptography equation?

The secp256k1 arithmetic is defined over the finite field of integers modulo 2256 - 232 - 977. The following code works: M = 2**256 - 2**32 - 977 Acurve = 0 Bcurve = 7 Gx = ...
Pieter Wuille's user avatar
7 votes
Accepted

Why does BIP-340 use secp256k1?

Couldn't it have used other curves, like Curve25519 and its signature schemes that are being used by many other projects? Curve25519 is a key agreement scheme, but if you're referring to the (related)...
Pieter Wuille's user avatar
6 votes

How were the secp256k1 base point coordinates decided?

Since the secp256k1 curve order is prime, every point on the curve except the point at infinity is a generator. Nothing is known about how the designers of the curve chose this specific generator. ...
Pieter Wuille's user avatar
6 votes

tiny-secp256k1 and ECDSA signing determinism

The secp256k1 library uses RFC6979 to generate deterministic nonce values (k). It essentially takes the hash of both the private key and the message being signed in order to get k. This means that ...
Ava Chow's user avatar
  • 70.9k
6 votes
Accepted

SECP256K1 Minimum Value for Private Key

If people in general would more often pick lower integers as private keys than larger integers, then it would be a good strategy for an attacker to start with lower integers. However, the opposite ...
Pieter Wuille's user avatar
6 votes

Schnorr batch validation speed statistics

Speedup in well optimized cryptographic functions are hard to come by. In libsecp256k1 we'll usually celebrate a 4% algorithmic speedup. Figures on the order of 2x are reasonable for the usage in ...
G. Maxwell's user avatar
  • 7,727
6 votes

Openssl magic values? Secp256k1 and ECDSA similarities? What makes secp256k1 special?

You are using the eliptic curve function of openssl and providing a serialized bytestring as an input. DER (Distinguished Encoding Rules) is a restricted variant of BER for producing unequivocal ...
Dontpanicburns's user avatar
6 votes
Accepted

What are the co-ordinates of generator G in his uncompressed form on secp256k1?

The 04 first byte header indicates this is an uncompressed point (02 indicates compressed). From there, it is simply an x followed by y representation - The first 32 bytes are x, the following 32 ...
Raghav Sood's user avatar
  • 17.1k
6 votes
Accepted

Who is the creator of the secp256k1 standard?

It can be found in https://www.secg.org/sec2-v2.pdf: SEC 2: Recommended Elliptic Curve Domain Parameters Certicom Research Contact: Daniel R. L. Brown ([email protected]) January 27, 2010 Version 2....
Pieter Wuille's user avatar
6 votes
Accepted

Can secp256k1 have different parameters and still be called secp256k1?

The SEC2 document recommends the use of a number of curves. One of these curves is called secp256k1. The recommendation doesn't refer to the parameters. What is recommended is the use of the secp256k1 ...
Pieter Wuille's user avatar
6 votes
Accepted

why int128 in secp256k1?

I assume you're referring to the C implementation of secp256k1 arithmetic, perhaps specfically this pull request? If not, comment and I'll revise my answer. Why do they write an int128 type in ...
Pieter Wuille's user avatar
6 votes
Accepted

Is there a subgroup of order 2^n (for large n) of the prime field that secp256k1 is defined over?

No, there cannot be. There are two groups defined by the secp256k1 field, the addition group, and the group of multiplication of its non-zero elements. Neither has a large 2n subgroup, because the ...
Pieter Wuille's user avatar
6 votes
Accepted

How many elements does Bitcoin's secp256k1 have?

Over the field GF(2256 - 232 - 977), the equation y2 = x3 + 7 has exactly 115792089237316195423570985008687907852837564279074904382605163141518161494336 distinct solutions for (x, y), or roughly 2256 -...
Pieter Wuille's user avatar
6 votes
Accepted

Questions about secp256k1_pubkey_load/save() implementation

Wouldn't the code below work just as well? Possibly, but I believe it would be undefined behavior (and if it isn't, it'd need careful language lawyering to make sure it isn't). The existing code is ...
Pieter Wuille's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible