# Elliptic curve cryptography

Bitcoin keys live on the secp256k1 curve, y² = x³ + 7. Multiplying a point is easy and undoing it is practically impossible. See how it works.

Canonical page: https://mybitcoinexplorer.com/learn/elliptic-curve-cryptography
Topic: Cryptography
Published: 2026-10-29
Updated: 2026-10-30


## The curve
Bitcoin uses the curve **secp256k1**:

~~~
y² = x³ + 7
~~~

Here it's drawn over ordinary numbers so you can see its shape. The real thing uses whole numbers modulo a huge prime, so it looks like a scatter of points, but the rules are the same.

> Diagram: Adding two points: draw a line through them, find the third crossing, reflect it — 

## Adding and multiplying points
- **Adding** two points gives a third point on the curve (shown above).
- **Multiplying** a point by a number k means adding it to itself k times. With "double and add", even a 256-bit k takes only a few hundred steps.

## The one-way street
> Diagram: Easy one way, practically impossible the other — Private key k: a random number → (× G, easy)*Public key: the point k·G → (reverse? infeasible)!Back to k: discrete log problem

Every Bitcoin user shares the same starting point **G**. Your [public key](https://mybitcoinexplorer.com/learn/public-keys) is your [private key](https://mybitcoinexplorer.com/learn/private-keys) times G. Going backwards (finding k from k·G) is the elliptic curve discrete logarithm problem, with no known efficient solution on ordinary computers.

## Why curves?
They give strong security with small keys: a 256-bit curve key is comparable to a 3,072-bit RSA key.


## The numbers behind secp256k1
- Prime field size: just under 2^256.
- Number of points on the curve (the group order n): about 1.158 × 10^77. Every private key is a number from 1 to n − 1.
- The generator point G is fixed and public, written into every Bitcoin implementation.

## Why secp256k1 and not a more common curve?
Most software at the time used NIST curves like secp256r1. Satoshi chose secp256k1, whose constants were picked in a simple, predictable way, leaving little room for hidden weaknesses. It also allows some speed optimisations.


## Key takeaways

- Bitcoin uses the curve secp256k1: y² = x³ + 7 over a prime field.
- Public key = private key × the generator point G.
- Reversing that multiplication is infeasible, which keeps keys safe.

## Common questions

### What does secp256k1 stand for?

Standards for Efficient Cryptography, prime field, 256 bits, Koblitz curve, version 1.

### Do I need to understand this to use Bitcoin?

No. Wallets do all of it. It just explains why your public key can be shared safely.

### Is secp256k1 safe?

No practical attack is known against it on classical computers.

### Do I need to understand elliptic curves to use Bitcoin?

No. Wallets handle the maths; this lesson explains why sharing public keys is safe.

## Related lessons

- [Public keys](https://mybitcoinexplorer.com/learn/public-keys)
- [Private keys](https://mybitcoinexplorer.com/learn/private-keys)
- [ECDSA signatures](https://mybitcoinexplorer.com/learn/ecdsa)
- [Schnorr signatures](https://mybitcoinexplorer.com/learn/schnorr-signatures)