2
$\begingroup$

I refer to elliptic curve groups over prime fields and their application in cryptography.

If the order of a group is prime, it follows (am I wrong?) that:

  1. the group is cyclic and
  2. every element beside the zero element is a generator.

To my knowledge the first statement is well known and last statement is a consequence of the theorem:

If G is a cyclic group of order n and $\phi$ is Euler'sPhi-Function, then G has exactly $\phi(n)$ generators.

Now, if n=p is prime, then $\phi(p) = p-1$. Therefore it follows (2).

But: The order of P-256 (n=115792089210356248762697446949407573529996955224135760342422259061068512044369) is prime. So every point in this group beside the point at infinity should be a generater of the whole group. Why is a particular base point given in all the literature:

$G=(x,y)$, with

x=048439561293906451759052585252797914202762949526041747995844080717082404635286 y=002258390684796862237411570494974242622288194167061563441992324890848025900319

when every point is an equally good possible base point? is it just a convention to use that particular point and for what reason?

$\endgroup$
4
$\begingroup$

You are correct. All points in a prime order curve (except $\infty$) are generators of the whole group.

But for practical applications a specific one must be chosen to make protocols work.

For example, Diffie-Hellman works only if the two public keys are computed as a random multiple of the same generator.

So it make sense that, among the curve's parameters, there is also a chosen, fixed, base point.

You are free to design protocols with alternative generators, but, as any point (except $\infty$) is as good, it makes no sense for interoperability purposes.

For P-256 the choice of the generator, like for the curve's parameter $b$, is done using a deterministic algorithm with a (supposedly) random input seed.

Other curves might have different way of choosing it. For example curve25519 uses the point with the lowest absolute value of $x$ belonging to the large prime order subgroup.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.