Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
This is possibly a dumb question. I'm trying to input SECP256K1 curve parameters to a system that expects any custom curve. The form is asking for "curve type". It offers three options:
What should I use for SECP256K1? I verified here and here, but they tell that SECP256K1 is a "Koblitz" curve. Is that compatible with any of the expected curve types above?
There are curve types, and equation types.
As algebraic objects, all curves can be expressed with a "Weierstraß equation". Through some changes of variables, that equation can be simplified into a "short Weierstraß format", which, for a finite field of characteristic more than 3, looks like:
$$ Y^2 = X^3 + aX + b $$
for two constants $a$ and $b$. In the case of the secp256k1 curve, the equation is:
$$ Y^2 = X^3 + 7 $$
i.e. the constants are $a = 0$ and $b = 7$.
"Montgomery curves" are curves which can also be expressed (with appropriate changes of variables, again) with another equation:
$$ bY^2 = X^3 + aX^2 + X $$
for some two other constants $a$ and $b$. When a curve can be expressed with such an equation, then it allows computing multiplications of points with the "Montgomery ladder", a mechanism which is simpler to implement, and somewhat faster, than generic code with Weierstraß equations. However, secp256k1 cannot be expressed that way. In fact, it is easily seen that a Montgomery curve necessarily contains the point $(0,0)$, which has order 2 (since its coordinate $Y$ is 0, that point, added to itself, yields the point-at-infinity). No curve with an odd order (and in particular curves whose order is a big prime, such as secp256k1) can have a point of order 2, and thus no such curve can be a Montgomery curve.
"Twisted Edwards curves" work with yet another equation, this time with a degree 4. They are more-or-less equivalent to Montgomery curves. There again, secp256k1 cannot be expressed as a twisted Edwards curve.
"Koblitz curves" (named after Neal Koblitz) are curves whose Weierstraß equation has a special format, which allows for some extra stuff. This terminology has been applied to curves in binary field (fields of characteristic 2, where addition is XOR), with equation: $$ Y^2 + XY = X^3 + aX^2 + 1 $$ where $a$ is either $0$ or $1$. For finite fields with a large prime characteristic (e.g. integers modulo a given prime $p$), a "Koblitz curve" is a curve with equation: $$ Y^2 = X^3 + b $$ i.e. a curve with a short Weierstraß equation with $a = 0$.
Koblitz curves have internal endomorphisms that can be leveraged to give a boost to performance (a much larger boost for binary curves). secp256k1 is a Koblitz curve.
Summary: all curves are "Weierstraß curves". For some curves, the Weierstraß equation has a special format, and they are called "Koblitz curves" (this is the case of secp256k1). For some curves, alternate equations can be used (Montgomery, twisted Edwards) with some implementation/performance benefits, but secp256k1 is not one of these curves.
