# How were the P-256 parameters chosen?

In NIST FIPS 186-4 (page 90), it is said that $c$ is the output of SHA-1 on a seed that was chosen randomly. Then the parameter $b$ of the EC is chosen, according to the formula: $$b^2 \times c \equiv -27 \pmod p$$ Why choose $b$ this way? Why, as an example, couldn't $b = c$?

The curve generation algorithm requires $a,b$ to satisfy $b^2\cdot c \equiv a^3 \bmod p$, and it is not necessary that $a$ and $b$ be chosen at random. In the case of NIST Prime curves, they all use fixed $a=-3$, so $b^2\cdot c \equiv -27 \bmod p$.
As to the question why $b$ cannot equal to $c$, note if $a$ is not fixed then it is actually valid to choose $a=b=c$. But $a=-3$ is chosen by NIST, so this is not possible because the seed does not hash to $-3$.
• No this is not the same. That requires $4a^3+27b^2\ne 0$. In fact in NIST FIPS 186-4 D.5, step 8, it checks $4c+27\ne 0 \bmod p$, to ensure the discriminant is not 0 if $(a,b)$ is chosen by the formula $b^2\cdot c \equiv a^3$. As to where this $b^2\cdot c \equiv a^3$ formula comes from, I am not sure because it is not documented anywhere. – Changyu Dong Jul 17 '18 at 13:56