I would like to find the fastest way to derive G for secp256k1 and secq256k1 curves, does anyone know the method, equation? Edit: I'm interested to know how can this happen, when we use n/2 of secp256k1 we would get this as our x coordinate 0x3b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63 However, half of the secq256k1 group order also produces the same x coordinate while G is different on both curves, how is that possible? Thank you


1 Answer 1


Elliptic curves are used because points on the curve, together with an operation (elliptic curve point addition), form a cyclic Abelian group.

The curve is chosen such that this group will have a prime order. (There may be a cofactor, in which case only a subset of points on the curve will be members of the prime-order group).

Because the group is cyclic and the group order is prime, all points in the group (other than the identity element, which on some curves is the "point at infinity") can be used as generators of all other points in the group.

There is nothing special about the well-known and widely used generator point $G$. It is not something that is derived - it is something that is arbitrarily chosen, ideally using a "nothing up my sleeve" approach. In the case of secp256k1, it is not fully known how the well-known generator point $G$ was arbitrarily chosen.

The bottom line is that $G$ is not a special point with special mathematical properties, and so you can't derive it using knowledge of properties of the curve. It is a point that is arbitrarily chosen as part of a particular protocol, and you simply need to hard-code the value such that it is the same point that other protocol participants are using.

  • 1
    $\begingroup$ Well, we don't fully know how $G$ was generated in secp256k1, but there's every reason to believe that was by doubling a point with a particularly small $x$ coordinate, as shown by this data. $\endgroup$
    – fgrieu
    Dec 27, 2023 at 7:20
  • 1
    $\begingroup$ @kelalaka thanks, amended $\endgroup$
    – knaccc
    Dec 27, 2023 at 13:37
  • $\begingroup$ Also, if for any $G$ the DLog is easy then for all. Self-random reducibiliy.. $\endgroup$
    – kelalaka
    Dec 27, 2023 at 14:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.