8
$\begingroup$

This is possibly a dumb question. I'm trying to input SECP256K1 curve parameters to a system that expects any custom curve. The form is asking for "curve type". It offers three options:

  • Short Weierstrass
  • Twisted Edwards
  • Montgomery

What should I use for SECP256K1? I verified here and here, but they tell that SECP256K1 is a "Koblitz" curve. Is that compatible with any of the expected curve types above?

$\endgroup$
17
$\begingroup$

There are curve types, and equation types.

As algebraic objects, all curves can be expressed with a "Weierstraß equation". Through some changes of variables, that equation can be simplified into a "short Weierstraß format", which, for a finite field of characteristic more than 3, looks like: $$ Y^2 = X^3 + aX + b $$ for two constants $a$ and $b$. In the case of the secp256k1 curve, the equation is: $$ Y^2 = X^3 + 7 $$ i.e. the constants are $a = 0$ and $b = 7$.

"Montgomery curves" are curves which can also be expressed (with appropriate changes of variables, again) with another equation: $$ bY^2 = X^3 + aX^2 + X $$ for some two other constants $a$ and $b$. When a curve can be expressed with such an equation, then it allows computing multiplications of points with the "Montgomery ladder", a mechanism which is simpler to implement, and somewhat faster, than generic code with Weierstraß equations. However, secp256k1 cannot be expressed that way. In fact, it is easily seen that a Montgomery curve necessarily contains the point $(0,0)$, which has order 2 (since its coordinate $Y$ is 0, that point, added to itself, yields the point-at-infinity). No curve with an odd order (and in particular curves whose order is a big prime, such as secp256k1) can have a point of order 2, and thus no such curve can be a Montgomery curve.

"Twisted Edwards curves" work with yet another equation, this time with a degree 4. They are more-or-less equivalent to Montgomery curves. There again, secp256k1 cannot be expressed as a twisted Edwards curve.


"Koblitz curves" (named after Neal Koblitz) are curves whose Weierstraß equation has a special format, which allows for some extra stuff. This terminology has been applied to curves in binary field (fields of characteristic 2, where addition is XOR), with equation: $$ Y^2 + XY = X^3 + aX^2 + 1 $$ where $a$ is either $0$ or $1$. For finite fields with a large prime characteristic (e.g. integers modulo a given prime $p$), a "Koblitz curve" is a curve with equation: $$ Y^2 = X^3 + b $$ i.e. a curve with a short Weierstraß equation with $a = 0$.

Koblitz curves have internal endomorphisms that can be leveraged to give a boost to performance (a much larger boost for binary curves). secp256k1 is a Koblitz curve.


Summary: all curves are "Weierstraß curves". For some curves, the Weierstraß equation has a special format, and they are called "Koblitz curves" (this is the case of secp256k1). For some curves, alternate equations can be used (Montgomery, twisted Edwards) with some implementation/performance benefits, but secp256k1 is not one of these curves.

$\endgroup$
  • 1
    $\begingroup$ (Note: "curve" here means "elliptic curve".) $\endgroup$ – yyyyyyy Apr 19 '18 at 23:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.