secp256k1

secp256k1 is the elliptic curve that underpins every Bitcoin private key, public key, and signature. Its name encodes its parameters: sec (Standards for Efficient Cryptography, published by the SECG), p256 (a 256-bit prime field), k (a Koblitz curve, whose special structure permits faster arithmetic), and 1 (the first such curve in the standard). The curve equation is the deceptively simple y² = x³ + 7, defined over the finite field of integers modulo the prime p = 2²⁵⁶ − 2³² − 977. Before Bitcoin, secp256k1 was an obscure entry in a standards document; Satoshi's choice made it one of the most scrutinized pieces of cryptography on Earth.

The domain parameters

An implementation is fully specified by six values: the field prime p, the two curve coefficients a = 0 and b = 7, the generator point G, the group order n (a 256-bit prime just below 2²⁵⁶), and the cofactor h = 1. A cofactor of 1 is cryptographically ideal: every point other than infinity has the full prime order n, so there are no small subgroups for an attacker to push a victim into. The space of valid private keys is therefore simply the integers from 1 to n − 1 — any 256-bit number in that range works, which is why a key can be generated from dice rolls in a garage as validly as in any datacenter. That permissionless key generation is the quiet foundation of self-custody.

From secret number to public key

A private key is a scalar k; the corresponding public key is the point K = k·G, computed by elliptic curve point multiplication — adding G to itself k times, done efficiently in a few hundred doublings and additions. The security rests on the elliptic curve discrete logarithm problem: going from k to K is fast, but recovering k from K is, as far as anyone can demonstrate, computationally infeasible at 256-bit scale. The best known attacks would still need on the order of 2¹²⁸ operations — a number that makes the global Bitcoin mining fleet's output look like a rounding error. This one-way asymmetry is the entire trick: you can publish the public key to the world and keep the scalar in your head, on paper, or in a hardware wallet.

Why Bitcoin chose it

Two properties made secp256k1 attractive. First, its special Koblitz structure allows unusually efficient computation — often cited as more than 30% faster than comparable random curves — which matters when every full node verifies every signature in every block. Second, and more philosophically, its constants are transparent: a = 0, b = 7, and a prime chosen for arithmetic convenience are obviously not derived from any unexplained seed. The NIST P-curves, by contrast, use constants generated from opaque seeds, which has fueled lasting suspicion of hidden weaknesses. For a system meant to hold value without trusted authorities, nothing-up-my-sleeve parameters are not a nicety — they are a requirement. Bitcoin's history has since validated the choice: the dedicated libsecp256k1 library, written for Bitcoin Core, has made the curve's implementations among the fastest and most audited anywhere.

One curve, two signature schemes

Both signature schemes Bitcoin has used — ECDSA from launch, and the Schnorr signatures introduced with Taproot — operate over this same curve, so the 2021 upgrade changed the signature math without touching the underlying key material. Every seed phrase, every derivation path, every address format ultimately bottoms out here: one secret scalar, one public point, and a curve whose honesty anyone can check. Fifteen years of the world's most motivated attackers probing a transparent target is, in cryptography, the closest thing there is to a warranty.