4
$\begingroup$

Could someone please explain, in simple and easy terms, how the creators did (or should have) derived the N, order of G for SECP256k1?

Its my understanding its derived from

p = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F

aka

p = 115792089237316195423570985008687907853269984665640564039457584007908834671663

and that the value itself, of N is

N = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141

aka

N = 115792089237316195423570985008687907852837564279074904382605163141518161494337

I understand that (N-1) is the total number of valid points on the curve, but how was that determined without going through and trying to count them?

I have seen similar questions, but the answers are either using terminologies I don't understand and or don't contain a "simple" and "easy" explanation.

$\endgroup$
7
$\begingroup$

I understand that (N-1) is the total number of valid points on the curve

Actually no. $N$ is the number of points on the curve, $N-1$ is the number of non-trivial points, where the point at infinity $\mathcal O$ is the trivial point (because it is essentially the $0$ for curves).

Could someone please explain, in simple and easy terms, how the creators did (or should have) derived the N, order of G for SECP256k1?

First, let's assume we already know the order of the curve, ie the number of points on it. Let's call this number $n$. It turns out that for secp256k1 $n$ is a prime. Now we know by Lagrange's Theorem the order of any subgroup (like the subgroup generated by $G$) of secp256k1 must divide $n$, so either have $1$ or $n$ elements. But the only element that generates a subgroup with one element is $\mathcal O$ (because $\mathcal O+\mathcal O=\mathcal O$) and thus $G$ must have order $n$.

But how do we find the order of the curve? It turns out that mathematicians have already solved this problem and found an algorithm to efficiently count the number of points on a curve without actually visiting every single one, it's called Schoof's algorithm. Now the details of this algorithm are very complex and thus I won't go into them here. If you really want to know, you can read the linked article and the references given at the bottom of the page.

$\endgroup$
  • $\begingroup$ I think that above answer is not correct. The infinite point "O" is not a point on the curve. It is just an abstact,or an imaginary point. Just a mathmatical construct supposed to act like an identity element in the addition Group. Hey,can you give us the X and Y coordinates of this so called "trivial" point O? $\endgroup$ – Yanghwan Lim Feb 7 '18 at 19:33
  • 1
    $\begingroup$ the (projective) coordinates of O = [0:0:1] $\endgroup$ – 111 Feb 7 '18 at 20:25
  • $\begingroup$ @Yangwhan_Lim I think I get what you are trying to say, but there was much more (useful) information in his answer. $\endgroup$ – Mine Feb 7 '18 at 21:34
  • 2
    $\begingroup$ The ‘infinite point “O”’ is a point on the curve. It just doesn't have a representation in affine coordinates, which is part of why affine coordinates are a pain to work with and most sensible algebraic geometers work in some projective coordinate system. $\endgroup$ – Squeamish Ossifrage Feb 7 '18 at 22:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.