Elliptic curve

An elliptic curve is a set of points that satisfy an equation of the form y² = x³ + ax + b. Bitcoin uses one specific curve, secp256k1, where a = 0 and b = 7, so every point on it satisfies y² = x³ + 7. You can combine two points, a process called addition, and you can multiply a point by a whole number. Multiplication is easy to run forward and very hard to reverse. That one-way property is what makes ECDSA and Schnorr signatures work.

You do not need this maths to use Bitcoin. A library handles it for you. Read this page if you want to know what the libraries do.

What does the curve look like?

Over real numbers, the curve is a smooth line. It has a tip on the left, where x³ + 7 is zero, and two branches that mirror each other across the x-axis. For any x where x³ + 7 is positive, there are two points, one above the axis and one below. The curve is symmetrical, so a point and its mirror image share the same x coordinate.

Bitcoin does not use real numbers. It uses whole numbers modulo a large prime, explained below, so the points look like a scatter of dots rather than a line.

What are the secp256k1 parameters?

Bitcoin's curve is fixed by a handful of numbers, defined in SEC 2 by the Standards for Efficient Cryptography Group. Every node and wallet uses the same values.

a  = 0
b  = 7
p  = FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
n  = FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
Gx = 79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798
Gy = 483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8

• p is the prime that sets the size of the number field. It is 2²⁵⁶ − 2³² − 977.
• n is the order of the curve: the number of points you reach by repeatedly adding the generator point to itself. Private keys are numbers from 1 to n − 1.
• G is the generator point. Every public key is a multiple of G. SEC 2 fixes its value, which has a large prime order and no known weakness.

The name is a code. It points to the SEC standards, a prime field, a 256-bit size, a Koblitz-type curve, and the first curve of that type.

Why does the curve look like a scatter plot?

Bitcoin calculates with whole numbers modulo p. A number is reduced to what remains after dividing by p. This keeps every value exact, which matters on a computer, where decimals lose precision.

Take the small field modulo 47. Here is the point (17, 19). Check it: 19² = 361, and 361 mod 47 is 32. Also 17³ + 7 = 4,920, and 4,920 mod 47 is also 32. So the point sits on the curve. The field has 47 points with coordinates, plus one extra point called the point at infinity, for 48 in total. The point at infinity is what you get when you add a point to its own mirror image. Secp256k1 has a far larger field. Its order n is about 1.16 × 10⁷⁷, in the same range as the number of atoms in the observable universe (roughly 10⁸⁰).

What is a modular inverse?

Modulo a prime there is no plain division, so the formulas multiply by an inverse instead. The inverse of a number a modulo m is the number b where a × b leaves a remainder of 1 when divided by m.

For example, 13 × 29 = 377, and 377 = 8 × 47 + 1. So 29 is the inverse of 13 modulo 47. Python computes it directly:

print(pow(13, -1, 47))  # 29

Because p is prime, every non-zero number has an inverse. That is why the formulas below always work.

How do you add two points?

Adding two points is not normal addition. It is a geometric rule. Draw a line through the two points. The line meets the curve at a third point. Reflect that third point across the x-axis, and the result is the sum. The formulas for points P = (x1, y1) and Q = (x2, y2) are:

s  = (y2 − y1) / (x2 − x1)    mod p
x3 = s² − x1 − x2             mod p
y3 = s·(x1 − x3) − y1         mod p
P + Q = (x3, y3)

Each division uses the modular inverse from the previous section. The animation below shows the steps with real numbers, which keep the geometry easy to see. The points are P = (1, √8) and Q = (2, √15). The line has slope s ≈ 1.045. It meets the curve at (−1.909, −0.210), and the reflection gives P + Q ≈ (−1.909, 0.210).

How do you double a point?

Adding a point to itself is called doubling. The line becomes the tangent to the curve at that point. The tangent meets the curve once more. Reflect that point, and the result is 2P:

s  = (3·x1² + a) / (2·y1)     mod p
x3 = s² − 2·x1                mod p
y3 = s·(x1 − x3) − y1         mod p

The same example, P = (1, √8), gives a slope of 3 / (2√8) ≈ 0.530. The result is 2P ≈ (−1.719, −1.387).

Doubling is the one case where you cannot use the addition formula, since the two points would make the line undefined. Calculate it with the tangent instead.

How do you multiply a point by a number?

Multiplication is repeated addition, but adding a point a million times would be far too slow. The double-and-add method needs only one doubling per bit and an addition for each 1 bit. Write the number in binary and read the bits after the leading 1, from left to right. For each bit, double. If the bit is 1, also add P.

Here is 21 × P. The number 21 is 10101 in binary.

Bit	Step	Multiple of P
Start	P	1
0	double	2
1	double, then add P	5
0	double	10
1	double, then add P	21

The same method in code reads the bits from left to right, as the table does. None stands for the point at infinity, the identity for addition.

def multiply(k, P):
    R = None                      # None is the point at infinity
    for bit in bin(k)[2:]:       # from the leading 1 to the last bit
        R = add(R, R)            # every bit: double
        if bit == "1":
            R = add(R, P)        # a 1 bit: also add P
    return R

For a 256-bit number this takes about 256 doublings and about 128 additions, since about half the bits are 1. A brute-force search would take far longer.

Why is multiplication hard to reverse?

Given P and the product k·P, finding k is called the elliptic curve discrete logarithm problem. No shortcut is known for it. The best general attacks need about √n group operations, which is around 2¹²⁸ steps for secp256k1. That is why a public key can be shared safely, and why the private key stays hidden even when the public key is known.

Where does the curve appear in Bitcoin?

Your private key is a number d. Your public key is the point d·G. The signature schemes use multiplication and addition on the same curve. ECDSA signs with a random point, and Schnorr signatures use the same kind of point to prove that the key holder signed the message.

Next, the ECDSA page uses point multiplication to make and check signatures. For a fuller introduction to the curve, see Andrea Corbellini's guide.