4
points on curve secp256k1 form a group E(Fp) over field Fp.
p = 2^256 - 2^32 - 2^9 - 2^8 - 2^7 - 2^6 - 2^4 - 1 is prime.
n is the order of group E, n=115792089237316195423570985008687907852837564279074904382605163141518161494337
Is n prime too?
Is E(Fp) a cyclic group?
Theorem. Working over a finite field, the group of points E(Fp) is always either a cyclic group or the product of two cyclic groups.
3
The comment stating n “has to be prime” is a bit confusing.
The order of base point “has” to be prime in the sense that this is a requirement in the particular documents defining standard curves—for example, in SECG, which includes secp256k1. Bitcoin's base point order r is prime.
In SECG, it is also stated that cofactor of secp256k1 curve is 1, which makes n = r × 1, again prime. A group of prime order is obviously cyclic.
Thank you for your answer! So E(K) is a cyclic group, r = n is prime and then each element of E(K)* has order n --> each element could have been the base point. Is there a reason SEC chose G = 02 79BE667E F9DCBBAC 55A06295 CE870B07 029BFCDB 2DCE28D9 59F2815B 16F81798 as base point? – arulbero – 2015-06-21T06:37:52.157
@arulbero re SEC defined G: great question. Anyone know why? Why not start at x=0? – Wizard Of Ozzie – 2015-06-21T14:17:25.173
@Wizard Of Ozzie The point "O" is the only one that cannot be chosen, because order of O is 1. To generate safely a public key starting from G, G's order must be a prime number, as large as possible; in our case each element except O has the same order, n. – arulbero – 2015-06-21T17:42:44.620
1@WizardOfOzzie@arulbero It's likely the base points in SECG were chosen randomly. It's also likely that this had led to some controversy since then. References are not very easy to locate, sorry. – akater – 2015-06-22T18:22:30.563
nhas to be a prime such that(Gx, Gy) * n = slope is infinity. Hopefully someone can answer the other part – Wizard Of Ozzie – 2015-06-21T00:34:33.840