Why is only one generator stated in literature for elliptic curve group P-256?

Question

I refer to elliptic curve groups over prime fields and their application in cryptography.

If the order of a group is prime, it follows (am I wrong?) that:

1. the group is cyclic and
2. every element beside the zero element is a generator.

To my knowledge the first statement is well known and last statement is a consequence of the theorem:

If G is a cyclic group of order n and $\phi$ is Euler'sPhi-Function, then G has exactly $\phi(n)$ generators.

Now, if n=p is prime, then $\phi(p) = p-1$. Therefore it follows (2).

But: The order of P-256 (n=115792089210356248762697446949407573529996955224135760342422259061068512044369) is prime. So every point in this group beside the point at infinity should be a generater of the whole group. Why is a particular base point given in all the literature:

$G=(x,y)$, with

x=048439561293906451759052585252797914202762949526041747995844080717082404635286 y=002258390684796862237411570494974242622288194167061563441992324890848025900319

when every point is an equally good possible base point? is it just a convention to use that particular point and for what reason?

Answer 1

You are correct. All points in a prime order curve (except $\infty$) are generators of the whole group.

But for practical applications a specific one must be chosen to make protocols work.

For example, Diffie-Hellman works only if the two public keys are computed as a random multiple of the same generator.

So it make sense that, among the curve's parameters, there is also a chosen, fixed, base point.

You are free to design protocols with alternative generators, but, as any point (except $\infty$) is as good, it makes no sense for interoperability purposes.

For P-256 the choice of the generator, like for the curve's parameter $b$, is done using a deterministic algorithm with a (supposedly) random input seed.

Other curves might have different way of choosing it. For example curve25519 uses the point with the lowest absolute value of $x$ belonging to the large prime order subgroup.