11

Could someone please explain, in simple and easy terms, how the creators did (or should have) derived the N, order of G for SECP256k1?

Its my understanding its derived from

p = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F

aka

p = 115792089237316195423570985008687907853269984665640564039457584007908834671663

and that the value itself, of N is

N = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141

aka

N = 115792089237316195423570985008687907852837564279074904382605163141518161494337

I understand that (N-1) is the total number of valid points on the curve, but how was that determined without going through and trying to count them?

I have seen similar questions, but the answers are either using terminologies I don't understand and or don't contain a "simple" and "easy" explanation.

Mike Edward Moras
  • 18,161
  • 12
  • 87
  • 240
Mine
  • 229
  • 2
  • 8

2 Answers2

13

I understand that (N-1) is the total number of valid points on the curve

Actually no. $N$ is the number of points on the curve, $N-1$ is the number of non-trivial points, where the point at infinity $\mathcal O$ is the trivial point (because it is essentially the $0$ for curves).

Could someone please explain, in simple and easy terms, how the creators did (or should have) derived the N, order of G for SECP256k1?

First, let's assume we already know the order of the curve, ie the number of points on it. Let's call this number $n$. It turns out that for secp256k1 $n$ is a prime. Now we know by Lagrange's Theorem the order of any subgroup (like the subgroup generated by $G$) of secp256k1 must divide $n$, so either have $1$ or $n$ elements. But the only element that generates a subgroup with one element is $\mathcal O$ (because $\mathcal O+\mathcal O=\mathcal O$) and thus $G$ must have order $n$.

But how do we find the order of the curve? It turns out that mathematicians have already solved this problem and found an algorithm to efficiently count the number of points on a curve without actually visiting every single one, it's called Schoof's algorithm. Now the details of this algorithm are very complex and thus I won't go into them here. If you really want to know, you can read the linked article and the references given at the bottom of the page.

SEJPM
  • 46,697
  • 9
  • 103
  • 214
0

If you want to count point on a given elliptic curve, a publicly available implementation of SEA (Schoof-Elkies-Atkin) algorithm is available in sage:

https://doc.sagemath.org/html/en/thematic_tutorials/explicit_methods_in_number_theory/elliptic_curves.html

As stated above, it is very complex and requires advanced number theory skills. Infinity point is definitely a point of the curve, you will reach it by computing (N-1).G, where N is the order (cardinality) of the curve. It is the neutral element (the 0 of the curve).

rdubois-crypto
  • 1