Bitcoin Forum
April 26, 2024, 01:07:26 AM *
News: Latest Bitcoin Core release: 27.0 [Torrent]
 
   Home   Help Search Login Register More  
Pages: [1]
  Print  
Author Topic: How was the order of secp256k1 calculated?  (Read 260 times)
mynonce (OP)
Full Member
***
Offline Offline

Activity: 233
Merit: 253


View Profile
November 23, 2021, 11:58:15 PM
 #1

We know that the prime of secp256k1 (p = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F) was chosen.
But how was the order (n = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141) calculated?
1714093646
Hero Member
*
Offline Offline

Posts: 1714093646

View Profile Personal Message (Offline)

Ignore
1714093646
Reply with quote  #2

1714093646
Report to moderator
1714093646
Hero Member
*
Offline Offline

Posts: 1714093646

View Profile Personal Message (Offline)

Ignore
1714093646
Reply with quote  #2

1714093646
Report to moderator
"This isn't the kind of software where we can leave so many unresolved bugs that we need a tracker for them." -- Satoshi
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction.
1714093646
Hero Member
*
Offline Offline

Posts: 1714093646

View Profile Personal Message (Offline)

Ignore
1714093646
Reply with quote  #2

1714093646
Report to moderator
gmaxwell
Moderator
Legendary
*
expert
Offline Offline

Activity: 4158
Merit: 8382



View Profile WWW
November 24, 2021, 08:13:35 AM
 #2

https://en.wikipedia.org/wiki/Schoof%27s_algorithm
mynonce (OP)
Full Member
***
Offline Offline

Activity: 233
Merit: 253


View Profile
November 24, 2021, 06:26:39 PM
 #3


Thanks. Very interesting.

'In 1985, Schoof discovered an algorithm which enabled him to count points on elliptic curves over finite fields in polynomial time. This was important for the use of elliptic curves in cryptography ...'

Without his discovery in 1985 we wouldn't have Bitcoin.
gmaxwell
Moderator
Legendary
*
expert
Offline Offline

Activity: 4158
Merit: 8382



View Profile WWW
December 09, 2021, 06:58:11 AM
Merited by hugeblack (4), ABCbits (1)
 #4

If Schoof's algorithm hadn't been discovered, Bitcoin would have just used different cryptography like RSA.

... or maybe it would use elliptic curves like RSA by users selecting a random group and using the hardness of finding its order for security.  ... only to have it broken when Schoof's algorithm is discovered. Smiley
mynonce (OP)
Full Member
***
Offline Offline

Activity: 233
Merit: 253


View Profile
December 09, 2021, 10:58:17 AM
 #5

If Schoof's algorithm hadn't been discovered, Bitcoin would have just used different cryptography like RSA.

... or maybe it would use elliptic curves like RSA by users selecting a random group and using the hardness of finding its order for security.  ... only to have it broken when Schoof's algorithm is discovered. Smiley

It is also very interesting that Satoshi used secp256k1 and not the common secp256r1, isn't it?
n0nce
Hero Member
*****
Offline Offline

Activity: 882
Merit: 5814


not your keys, not your coins!


View Profile WWW
December 09, 2021, 12:27:23 PM
 #6

It is also very interesting that Satoshi used secp256k1 and not the common secp256r1, isn't it?
Yeah; it was discussed a few times on this forum. You find it all through the search function.

Here's a quote from Mike Hearn:
I discussed this with Satoshi. There is no particular reason why secp256k1 is used. It just happened to be around at the time.

However it sounds like there's no real consensus that the k1 curve is really a terrible thing and indeed it may even be helpful in future as ECDSA verification is the primary CPU bottleneck for running a network node. So if Koblitz curves do indeed perform better we might end up grateful for that in future ...

And gmaxwell:
But I'm really not at ease knowing that every signature in a Bitcoin transaction is implemented using a very particular and unusual elliptic curve that has been selected for an unknown reason that his chooser is unwilling to elaborate on.
You mean you are uneasy that he chose the _only_ standardized curve at the time without unexplained parameters?

A full topic on this:
why did bitcoin choose secp256k1 over secp256r1?

StackExchange answer:
Should we trust the NIST-recommended ECC parameters?



Also; OT but lol your username is confusing me Cheesy

█▀▀▀











█▄▄▄
▀▀▀▀▀▀▀▀▀▀▀
e
▄▄▄▄▄▄▄▄▄▄▄
█████████████
████████████▄███
██▐███████▄█████▀
█████████▄████▀
███▐████▄███▀
████▐██████▀
█████▀█████
███████████▄
████████████▄
██▄█████▀█████▄
▄█████████▀█████▀
███████████▀██▀
████▀█████████
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
c.h.
▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▀▀▀█











▄▄▄█
▄██████▄▄▄
█████████████▄▄
███████████████
███████████████
███████████████
███████████████
███░░█████████
███▌▐█████████
█████████████
███████████▀
██████████▀
████████▀
▀██▀▀
mynonce (OP)
Full Member
***
Offline Offline

Activity: 233
Merit: 253


View Profile
December 11, 2021, 01:32:08 AM
 #7

A full topic on this:
why did bitcoin choose secp256k1 over secp256r1?

StackExchange answer:
Should we trust the NIST-recommended ECC parameters?


Also; OT but lol your username is confusing me Cheesy
Thanks.

myn0nce  Cheesy
mynonce (OP)
Full Member
***
Offline Offline

Activity: 233
Merit: 253


View Profile
December 14, 2021, 11:36:59 PM
 #8

It is also very interesting that Satoshi used secp256k1 and not the common secp256r1, isn't it?
Yeah; it was discussed a few times on this forum. You find it all through the search function.
Now, I found this:

'Many crypto experts have noticed that Bitcoin’s choice of secp256k1 elliptic curve was unusual for its time, as it was not yet well researched. ... Cointelegraph asked one of the world’s leading cryptographers, Tatsuaki Okamoto, about this unusual choice. Okamoto currently serves as director of the Cryptography & Information Security Lab at NTT Research. According to Okamoto, there are two alternative explanations for this choice: Either Satoshi picked because it offers greater efficiency or because it may have offered a secret backdoor.'
https://cointelegraph.com/news/this-researcher-says-bitcoins-elliptic-curve-could-have-a-secret-backdoor

'Laszlo Hanyecz, who worked closely with Satsohi in 2010, told Cointelegraph that he was befuddled by Satoshi’s choice of the elliptic curve secp256k1. The use of this curve, at the time, was unusual. ... At some point, Hanyecz sent Satoshi an email asking him why he picked this particular curve, Satoshi explained to Hanyecz that he had had some experts helping him: “‘I had a bunch of people look at it and they told me this was good.’ And he didn't really elaborate on it, but he said he had experts look at it.” It is not clear exactly when Satoshi sought this outside help, but prior to launching Bitcoin.'
https://cointelegraph.com/news/satoshi-nakamoto-had-outside-cryptography-help-says-early-bitcoin-dev

I had a bunch of people look at it and they told me this was good.  Huh
Pages: [1]
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!