Applied cryptography

secp256k1

secp256k1 is the specific elliptic curve Bitcoin and Ethereum use for keys and signatures. The name encodes its pedigree: a SEC (Standards for Efficient Cryptography) curve, over a 256-bit prime field, of Koblitz type (the 'k'), variant 1.

It is the curve y^2 = x^3 + 7 (so a = 0, b = 7) over the prime field F_p with p = 2^256 − 2^32 − 977. Its group of points has a large prime order n very close to 2^256, and a fixed generator point G is fixed by the standard. A private key is an integer d in [1, n−1]; the public key is the point d·G. The choices a = 0, the special form of p, and the Koblitz structure permit highly optimized arithmetic (such as the GLV endomorphism), which makes signing and verification fast.

Unlike the NIST P-256 curve, secp256k1's parameters were chosen rigidly and transparently with no unexplained 'magic' constants, which the community trusts more given lingering worries that some NIST curve seeds could hide a backdoor. Bitcoin uses it for ECDSA; since the 2021 Taproot upgrade it also supports Schnorr signatures on the same curve. An Ethereum address is the last 20 bytes of keccak256 of the 64-byte (uncompressed, prefix-stripped) public key.

A private key is simply a 256-bit number below n. Because the keyspace is about 2^256, the chance two users independently pick the same key is vanishing — which is precisely what makes 'generate offline, never coordinate' a safe way to create wallets.