# Please explain parameters of RFC5639 Elliptic Curves including brainpoolP160r1

RFC 5639 brainpoolP160r1 has

p = E95E4A5F737059DC60DFC7AD95B3D8139515620F (Wolfram Alpha says prime)

A = 340E7BE2A280EB74E2BE61BADA745D97E8F7C300

B = 1E589A8595423412134FAA2DBDEC95C8D8675E58

x = BED5AF16EA3F6A4F62938C4631EB5AF7BDBCDBC3

y = 1667CB477A1A8EC338F94741669C976316DA6321

q = E95E4A5F737059DC60DF5991D45029409E60FC09 (Wolfram Alpha says prime)

h = 1

I do not understand why h = 1 yet q < p. I thought that if you had a prime field size then there is only one cyclic subgroup in size equal to the field size (c.f. Lagrange). This doesn't seem to be the case for brainpoolP160r1

The order of the curve $$\#E(\mathbb{F}_p)$$ is different from $$p$$. In fact, according to Hasse's theorem, $$\#E(\mathbb{F}_p)=p+1-t$$ where $$t$$ the Frobenius trace satisfies $$|t|<2\sqrt{p}$$. So the gap between $$\#E(\mathbb{F}_p)$$ and $$p$$ is at most $$2\sqrt{p}$$. Note that, if $$\#E(\mathbb{F}_p)=p+1$$, $$\textit{i.e.}$$ $$t=0$$, the curve is supersingular. For brainpoolP160r1, the order is 1332297598440044874827085038830181364212942568457 (160-bit). You can play with sage code:

p = 0xE95E4A5F737059DC60DFC7AD95B3D8139515620F
B = 0x1E589A8595423412134FAA2DBDEC95C8D8675E58
x = 0xBED5AF16EA3F6A4F62938C4631EB5AF7BDBCDBC3
y = 0x1667CB477A1A8EC338F94741669C976316DA6321
E = EllipticCurve(GF(p),[A,B])
G = E(x,y)
G.order()
E.order()


This would be more appropriate on crypto.SX where it has been addressed several times:
https://crypto.stackexchange.com/questions/27904/how-to-determine-the-order-of-an-elliptic-curve-group-from-its-parameters
https://crypto.stackexchange.com/questions/8888/elliptic-curve-parameter-generation
https://crypto.stackexchange.com/questions/28947/how-to-calculate-elliptic-curve-parameters

Briefly, the order of the curve #E(GF(p)) (sometimes abbreviated n) is NOT p, although it is fairly close in magnitude. The curve group is the relevant finite group and is subject to Lagrange; any point on the curve has order (of the subgroup it generates) dividing n, and if n is prime, as is chosen to be the case for the Brainpool prime curves and also the X9/SECG prime curves, every point has order q=n and cofactor h=1.