Secp256k1
secp256k1 is a standardized elliptic curve used by Bitcoin for public-key cryptography. It is one of the domain-parameter sets published by the Standards for Efficient Cryptography Group in SEC 2.[1]
The curve is defined over the prime field whose modulus is p = 2^256 − 2^32 − 977, with the equation y^2 = x^3 + 7. SEC 2 also specifies a generator point G, its prime order n, and cofactor 1. The name identifies these parameters; it is not the name of a signature format or an encoding.
Domain parameters
In the SEC naming convention, sec denotes the standards, p a prime-field curve, 256 the field size, k a Koblitz-associated curve and 1 the sequence number. SEC 2 assigns the curve an estimated 128-bit security level and gives these exact values:[1]
| Parameter | Value |
|---|---|
p |
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
|
a, b |
0, 7
|
compressed G |
0279BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798
|
n |
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
|
h |
1
|
The Koblitz-associated structure admits specialized arithmetic, including an efficiently computable endomorphism. libsecp256k1 combines such techniques with precomputed tables and other optimizations; performance depends on the implementation, so a universal percentage is not implied.[2]
Keys and signatures
A Bitcoin private key is a scalar in the valid range defined by the curve order. Its corresponding public key is a curve point obtained by scalar multiplication of the generator. The practical security assumption is that deriving the private scalar from the public point is computationally infeasible.
Bitcoin historically used the Elliptic Curve Digital Signature Algorithm (ECDSA) over secp256k1. Taproot introduced BIP 340 Schnorr signatures over the same curve. BIP 340 fixes the public-key and signature encodings, uses x-only public keys, and defines deterministic nonce generation requirements for compatible signers.[3]
SEC 1 represents a public point in compressed form with a 02 or 03 prefix plus the x-coordinate, or in uncompressed form with 04 plus both coordinates.[4] BIP 340's 32-byte x-only public keys are a separate Bitcoin convention and must not be confused with either SEC 1 representation.
BIP 32 hierarchical deterministic wallets also perform private and public child-key derivation using secp256k1. Their extended keys include chain-code and metadata and are commonly serialized with Base58Check; that text encoding is separate from the elliptic-curve operations.[5]
Implementation
Correct implementation requires validation of scalars and curve points, secure nonce generation, protection against side channels, and careful parsing of signatures and public keys. Bitcoin Core and related software use the dedicated libsecp256k1 library. The project implements signing and public-key operations, including ECDSA and BIP 340-compatible Schnorr signatures, with constant-time code for secret-dependent operations.[2]
secp256k1 does not encrypt wallet files, store keys, or turn a private key into an address by itself. Address construction and wallet serialization add hashing, scripts, network identifiers and encodings around the curve keys. Security therefore depends on the complete signing and custody system, not only on the choice of curve.
See also
References
- ↑ 1.0 1.1 Standards for Efficient Cryptography Group, “SEC 2: Recommended Elliptic Curve Domain Parameters,” version 2.0, January 2010.
- ↑ 2.0 2.1 bitcoin-core/secp256k1 repository, checked 15 September 2026.
- ↑ BIP 340: Schnorr Signatures for secp256k1, checked 15 September 2026.
- ↑ Standards for Efficient Cryptography Group, “SEC 1: Elliptic Curve Cryptography,” version 2.0, May 2009.
- ↑ BIP 32: Hierarchical Deterministic Wallets, checked 15 September 2026.