If in ECDSA secp256k1 we have the prime field p=2256 - 232 - 29 - 28 - 27 - 26 - 24 - 1, can we increase it to p=2256, if we keep the double and add operations the same, the curve equation the same and we also keep the original generator point.


3 Answers 3


The short answer: No

The long answer: No because then the field would not be a prime and things would break horribly. The curve would not be secure anymore.

if we keep the double and add operations the same

Well these operation does not depend on finite fields. So it doesn’t matter what finite field you take they will always be done in same manner.

and we also keep the original generator point.

Nope the generator point cannot be same anymore because let $p’$ be the new field the old generator point $G(x, y)$ satisfied the old $p$ in the following way because of rules of division, ignoring modular arithmetic:

(the rule of division I am referring to are: dividend = divisor*quotient + remainder)

$(p \times n ) + y^2 = (x^3+7)$, for some $n \in \mathbb{Z}$

keeping the point same would mean that the following holds true:

$(p' \times m ) + y^2 = (x^3+7)$, for some $m \in \mathbb{Z}$

thus we need to show that there exist such integer $m$:

$(p' \times m ) + y^2 = (p \times n ) + y^2 = (x^3+7)$

$p' \times m = p \times n $

Since, $p'$ can never divide $p$ and also $p' > p$ there exist no $m \in \mathbb{Z}$ that satisfies above equation.

Hence you cannot increase $p$ in that way. The increase or decrease in $p$ should be followed by a change in parameters.

  • $\begingroup$ I just need to do some experimentation, I am not interested in security specifically, I just want to create a new curve wich share the points with secp256k1 but has more or less points then the original, if this is possible, how I can do it?(to change the p to a higher value but to keep G point, if I cant keep the G point how do I find the next G point) $\endgroup$
    – MR Man
    Commented Apr 20 at 8:13
  • $\begingroup$ @MRMan See the calculations in the question. For any arbitrary point on secp256k1, say $A(x_{p}, y_{p})$, and for any arbitrary point in anotherCurve , say $A_{p1}(x_{p1}, y_{p1})$, the conditions: $x_{p} = x_{p1}$ and $y_{p} = y_{p1}$ can only be true one at a time but in no case due to $p$ being prime both can be true at same time. It implies that generator of a curve over prime field cannot be a generator of another curve of any kind, whether prime or non-prime for same curve equation. $\endgroup$
    – madhurkant
    Commented Apr 20 at 12:55
  • $\begingroup$ Ok, thanks! I will seek another way $\endgroup$
    – MR Man
    Commented Apr 20 at 14:16


With p=2256, which is not prime:

Even if we stuck to a (different) prime p, likely we'd need to change the curve's equation to get a curve of prime order, that order would change, and the generator point would need to change to be on the curve.

  • 1
    $\begingroup$ “likely we'd need to change the curve's equation”, an example where such change is not needed: $y^2 = x^3+7$ over $F_p$ of $97$ the order of elliptic group would still be a prime $79$ $\endgroup$
    – madhurkant
    Commented Apr 19 at 17:31
  • $\begingroup$ @madhurkant: Indeed, we can comb $p$ so as to keep the equation and still get a curve of prime order. But that works only for a small fraction of $p$. So that's "unlikely", even if we pre-select $p$ prime with $p\bmod3=1$ (a necessary condition for the curve to be of prime order). $\endgroup$
    – fgrieu
    Commented Apr 20 at 13:25

yes its possible, example take prime p=23 parameter of curve x=x^3+ax+b where a=1 b=4 base point (0,2) field of curve is 29.

extand curve with p=529 (23x23) , same parameter, you got curve with field 841 (29x29)

new base point possible (0,2)*29 new possible base point like (230,324).

verify 230 mod 23 = 0 and 324 mod 23 = 2

230^3+230+4 mod 529 = 234 and 324^2 mod 529 =234 base point are on curve p=529 Field=841

Caution you have finite field every 29 step point (29;58;87;...etc)

  • $\begingroup$ Sorry this is not correct. $\endgroup$
    – kelalaka
    Commented May 23 at 13:59
  • 3
    $\begingroup$ Dear knuckballs. Please use only one account so you can comment below your posts. If you've lost access then you can contact the community team using the link at the bottom of each page. Currently your questions have not met the factual correctness required to be deemed an answer. We require answers to be well supported and formatted to the best of your abilities. This includes writing fully capitalized sentences, and preferably formatted using MathJax. $\endgroup$
    – Maarten Bodewes
    Commented May 23 at 20:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.