2
$\begingroup$

While exploring secp256k1, I came across what seems like the official definition at https://www.secg.org/, specifically in https://www.secg.org/sec2-v2.pdf. In terms of authorship, the document only contains references to the Standards for Efficient Cryptography group and Certicom (acquired by Blackberry). However, many resources I come across mention "NIST curves" in the context of secp256k1.

I've searched https://www.nist.gov/publications for definitions of the curve, although wasn't successful. The document's only mention of NIST is as a reference to "National Institute of Standards and Technology. Recommended Elliptic Curves for Federal Government Use, Jul. 1999", which doesn't seem to be available at NIST anymore, but can be found here and seems to contain different curve definitions.

So what's the relationship between NIST and secp256k1? Is NIST the author of secp256k1? What's the relationship between SEC and NIST? Why does the bitcoinbook say that NIST established secp256k1?

Bitcoin uses a specific elliptic curve and set of mathematical constants, as defined in a standard called +secp256k1+, established by the National Institute of Standards and Technology (NIST)

How does NIST fit into the story of secp256k1?

$\endgroup$
2
  • 1
    $\begingroup$ Could you quote some other of those «many resources (that) mention "NIST curves" in the context of secp256k1»? The one cited in the question seems isolated. I can't remember secp256k1 quoted as a NIST curve. Is this a confusion with secp256r1, which is in NIST's FIPS 186-2 and later? $\endgroup$
    – fgrieu
    May 9, 2023 at 12:55
  • $\begingroup$ Other than the bitcoin book, I unfortunately don't recall the other resources. $\endgroup$
    – aryzing
    May 9, 2023 at 15:28

1 Answer 1

4
$\begingroup$

The NIST FIPS 186-4 digital signature standard (and earlier versions 186-2 and 18-3) recommended several elliptic curves suitable for Federal government use, specifically Appendix D lists curves that also appear in the SECG SEC 2 document, but introducing different designators. Two of these curves predate both documents and coe from the ANSI X9.62 document.* To be precise

  • secp192r1 NIST P-192 (ANSI: prime192v1)
  • secp224r1 NIST P-224
  • secp256r1 NIST P-256 (ANSI: prime 256v1)
  • secp384r1 NIST P-384
  • secp521r1 NIST P-521
  • sect163k1 NIST K-163
  • sect163r2 NIST B-163
  • sect233k1 NIST K-233
  • sect233r1 NIST B-233
  • sect283k1 NIST K-283
  • sect283r1 NIST B-283
  • sect409k1 NIST K-409
  • sect409r1 NIST B-409
  • sect571k1 NIST K-571
  • sect571r1 NIST B-571

The ANSI X9.62 document specified a procedure for the generation of curve which was followed in generating the curves above.

Other curves from the SEC2 document including the secp*k1, sect163r1, sec239k1 curves were not included in FIPS186-5. The SEC group was an industry research group and their document perhaps did not carry the same weight as NIST's endorsement. These curve saw wider adoption into Internet standards such as RFC 8422 which try to make the overlap clear. In informal usage the curves often became known as "NIST curves". This loose terminology now seems to have been inaccurately extended to all of the SEC2 curves.

Dave Thompson points out that as of three months ago FIPS 186-4 has been superceded by FIPS 186-5 he writes "the curves are now moved to SP800-186 instead, and there B/K-163 and P-192 are reduced to 'legacy use', all remaining B/K are 'deprecated', the Bernstein 25519 and 448 curves (in Montgomery, Edwards and Weierstrass forms!) are added, and Appendix H 'allows' some brainpool curves and (relevant here) secp256k1 'for blockchain'"


(*) - The publication order as far as I can tell is ANSI X9.62 (1999), FIPS 186 (2000), SEC2 (2000) with the curves in Appendix 6 of FIPS 186 dated July 1999 (thanks fgrieu). However these dates are sufficiently close together, that contributions are likely hard to separate out. There was presumably discussion between the different groups.

$\endgroup$
7
  • 2
    $\begingroup$ Your link is actually to FIPS186-4 which did include those curves (as did -3 and -2 but not earlier) but FIPS186-5, adopted 3 months ago, no longer does; the curves are now moved to SP800-186 instead, and there B/K-163 and P-192 are reduced to 'legacy use', all remaining B/K are 'deprecated', the Bernstein 25519 and 448 curves (in Montgomery, Edwards and Weierstrass forms!) are added, and Appendix H 'allows' some brainpool curves and (relevant here) secp256k1 'for blockchain'. $\endgroup$ May 10, 2023 at 0:50
  • $\begingroup$ @dave_thompson_085 Many thanks I have added you comment to the main body. $\endgroup$
    – Daniel S
    May 10, 2023 at 6:51
  • $\begingroup$ FWIW: The first version of FIPS 186 with the NIST curves is FIPS 186-2, published Jan 2000. They are in appendix 6, dated July 1999. $\endgroup$
    – fgrieu
    May 10, 2023 at 7:11
  • $\begingroup$ @fgrieu Many thanks, I've edited the footnote. $\endgroup$
    – Daniel S
    May 10, 2023 at 7:16
  • $\begingroup$ @dave_thompson_085 Hang on. The motivation for using secp256k1 is because of the reciprocal nature of the "secq256k1" curve. Standardising one without the other surely removes that use case. $\endgroup$
    – Daniel S
    May 10, 2023 at 7:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.