<blockquote>
<p>Does that mean that by accident there are almost as many points on the curve as the modulo to compute it?</p>
</blockquote>
<p>It is not an accident.</p>
<p>The number of points on an elliptic curve over a finite field is <strong>always</strong> close to the size of that field, by <a href="https://en.wikipedia.org/wiki/Hasse%27s_theorem_on_elliptic_curves" rel="nofollow noreferrer">Hasse's theorem</a>. Specifically it says that the difference between the number of points on the curve (excluding the point at infinity) and the size of the field is at most twice the square root of the field size.</p>
<blockquote>
<p>Or are these the same numbers and one is wrong?</p>
</blockquote>
<p>No, they are distinct.</p>
<p>The numbers can be computed using the following Sage code:</p>
<pre><code>&gt;&gt;&gt; F = GF(2**256 - 2**32 - 977) # secp256k1 field
&gt;&gt;&gt; E = EllipticCurve(F, [0,7])  # secp256k1 curve
&gt;&gt;&gt; F.order() + 1 - E.order()
432420386565659656852420866390673177327
&gt;&gt;&gt; int(sqrt(F.order())
340282366920938463463374607431768211455
</code></pre>

CC BY-SA 4.0
2021-10-11T20:32:32.000Z
Amazing thank you! Do you have any resource for the math and the formulas you used in your sage code?
J. Hesters
CC BY-SA 4.0
2021-10-11T20:37:10.820Z
No; I know the field size (2^256-2^32-977) and the curve equal parameters ([a,b]=[0,7]) for secp256k1 by heart.
Pieter Wuille
CC BY-SA 4.0
2021-10-11T18:20:38.350Z
2021-10-11T19:22:28.367Z
2021-10-11T19:22:28.367Z
Pieter Wuille
<p>I've read <a href="https://jun-wang-2018.github.io/MyBlog/en/ECDSA-and-Bitcoin-II/" rel="nofollow noreferrer">online</a> that the group order for the Bitcoin secp256k1 curve is:</p>
<pre><code>0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
</code></pre>
<p>Its decimal is:</p>
<pre><code>115792089237316195423570985008687907852837564279074904382605163141518161494337
</code></pre>
<p>However, the <a href="https://github.com/bitcoinbook/bitcoinbook/blob/develop/ch04.asciidoc#elliptic_curve" rel="nofollow noreferrer">modulo</a> for the secp256k1 curve is the prime number:</p>
<pre><code>0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
</code></pre>
<p>Its decimal is:</p>
<pre><code>115792089237316195423570985008687907853269984665640564039457584007908834671663
</code></pre>
<p>These numbers are almost identical. Since the secp256k1 curve has no subgroups, its cofactor is 1. Does that mean that by accident there are almost as many points on the curve as the modulo to compute it?</p>
<p>Or are these the same numbers and one is wrong?</p>

<secp256k1>
Difference between Bitcoin private key space and secp256k1 modulo
J. Hesters
# Difference between Bitcoin private key space and secp256k1 modulo

(Asked by: username_0 on 2021-10-11)

I've read [online](https://jun-wang-2018.github.io/MyBlog/en/ECDSA-and-Bitcoin-II/) that the group order for the Bitcoin secp256k1 curve is:

```
0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141

```

Its decimal is:

```
115792089237316195423570985008687907852837564279074904382605163141518161494337

```

However, the [modulo](https://github.com/bitcoinbook/bitcoinbook/blob/develop/ch04.asciidoc#elliptic_curve) for the secp256k1 curve is the prime number:

```
0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F

```

Its decimal is:

```
115792089237316195423570985008687907853269984665640564039457584007908834671663

```

These numbers are almost identical. Since the secp256k1 curve has no subgroups, its cofactor is 1. Does that mean that by accident there are almost as many points on the curve as the modulo to compute it?

Or are these the same numbers and one is wrong?

**Tags:** secp256k1


---

## 1 answers

### Answer by username_1 on 2021-10-11. Score: 2 | Accepted answer

> Does that mean that by accident there are almost as many points on the curve as the modulo to compute it?

It is not an accident.

The number of points on an elliptic curve over a finite field is **always** close to the size of that field, by [Hasse's theorem](https://en.wikipedia.org/wiki/Hasse%27s_theorem_on_elliptic_curves). Specifically it says that the difference between the number of points on the curve (excluding the point at infinity) and the size of the field is at most twice the square root of the field size.

> Or are these the same numbers and one is wrong?

No, they are distinct.

The numbers can be computed using the following Sage code:

```
>>> F = GF(2**256 - 2**32 - 977) # secp256k1 field
>>> E = EllipticCurve(F, [0,7])  # secp256k1 curve
>>> F.order() + 1 - E.order()
432420386565659656852420866390673177327
>>> int(sqrt(F.order())
340282366920938463463374607431768211455

```

> **Comments:**
> **username_0**: Amazing thank you! Do you have any resource for the math and the formulas you used in your sage code?  
> **username_1**: No; I know the field size (2^256-2^32-977) and the curve equal parameters ([a,b]=[0,7]) for secp256k1 by heart.  

---

