Elliptic curve cryptography

Bitcoin keys live on the secp256k1 curve, y² = x³ + 7. Multiplying a point is easy and undoing it is practically impossible. See how it works.

The curve

Bitcoin uses the curve secp256k1:

y² = x³ + 7

Here it's drawn over ordinary numbers so you can see its shape. The real thing uses whole numbers modulo a huge prime, so it looks like a scatter of points, but the rules are the same.

Adding and multiplying points

• Adding two points gives a third point on the curve (shown above).
• Multiplying a point by a number k means adding it to itself k times. With "double and add", even a 256-bit k takes only a few hundred steps.

The one-way street

Every Bitcoin user shares the same starting point G. Your public key is your private key times G. Going backwards (finding k from k·G) is the elliptic curve discrete logarithm problem, with no known efficient solution on ordinary computers.

Why curves?

They give strong security with small keys: a 256-bit curve key is comparable to a 3,072-bit RSA key.

The numbers behind secp256k1

• Prime field size: just under 2^256.
• Number of points on the curve (the group order n): about 1.158 × 10^77. Every private key is a number from 1 to n − 1.
• The generator point G is fixed and public, written into every Bitcoin implementation.

Why secp256k1 and not a more common curve?

Most software at the time used NIST curves like secp256r1. Satoshi chose secp256k1, whose constants were picked in a simple, predictable way, leaving little room for hidden weaknesses. It also allows some speed optimisations.