<p>you can check  the Bitcoin doc <a href="https://en.bitcoin.it/wiki/Secp256k1" rel="noreferrer">https://en.bitcoin.it/wiki/Secp256k1</a> ,
there you will find some technical details about the secp256k1 used in bitcoin.</p>

<p>Below an illustration of the secp256k1's elliptic curve y2 = x3 + 7 over the real numbers (plot using <a href="http://www.desmos.com/calculator/ialhd71we3" rel="noreferrer">www.desmos.com/calculator/ialhd71we3</a>)</p>

<p><a href="https://i.sstatic.net/JGSXb.png" rel="noreferrer"><img src="https://i.sstatic.net/JGSXb.png" alt="secp256k1 plot using www.desmos.com/calculator/ialhd71we3"></a></p>

<p>in the context of a finite field Zp, which greatly changes the ECC appearance but not its underlying equation or special properties. the picture below represents the same equation in a finite field F17 (the x and y values are integers between 0 and 17).</p>

<p><a href="https://i.sstatic.net/SvjBj.png" rel="noreferrer"><img src="https://i.sstatic.net/SvjBj.png" alt=" Elliptic curve over F17"></a></p>

<p>and here over F59 :</p>

<p><a href="https://i.sstatic.net/HugPF.png" rel="noreferrer"><img src="https://i.sstatic.net/HugPF.png" alt="enter image description here"></a></p>

<p>You will find an online opensource tool here <a href="https://cdn.rawgit.com/andreacorbellini/ecc/920b29a/interactive/modk-add.html" rel="noreferrer">https://cdn.rawgit.com/andreacorbellini/ecc/920b29a/interactive/modk-add.html</a>
which will help you to plot the graphe and to make addition or scalar multiplication on a EC. E.g plot over F97 with P+Q.</p>

<p><a href="https://i.sstatic.net/I3NpQ.png" rel="noreferrer"><img src="https://i.sstatic.net/I3NpQ.png" alt="enter image description here"></a></p>

<p>another good article to read about ECDSA in Bitcoin is  <a href="https://github.com/bellaj/Bitcoin_Ethereum_docs/blob/6bffb47afae6a2a70903a26d215484cf8ff03859/ecdsa_bitcoin.pdf" rel="noreferrer">https://github.com/bellaj/Bitcoin_Ethereum_docs/blob/6bffb47afae6a2a70903a26d215484cf8ff03859/ecdsa_bitcoin.pdf</a></p>

<blockquote>
  <p>secp256k1 was almost never used before Bitcoin became popular, but it
  is now gaining in popularity due to its several nice properties. Most
  commonly-used curves have a random structure, but secp256k1 was
  constructed in a special non-random way which allows for especially
  efficient computation. As a result, it is often more than 30% faster
  than other curves if the implementation is sufficiently optimized.
  Also, unlike the popular NIST curves, secp256k1's constants were
  selected in a predictable way, which significantly reduces the
  possibility that the curve's creator inserted any sort of backdoor
  into the curve.</p>
</blockquote>

CC BY-SA 4.0
2022-01-31T14:13:19.563Z
https://andrea.corbellini.name/ecc/interactive/modk-add.html
this is the correct address.
tanaydin
CC BY-SA 4.0
2022-04-13T19:47:01.847Z
To help connect a few points, is the finite field you keep referring to also known as the "order" or the "large prime" necessary for the discrete log problem?
Olshansky
CC BY-SA 4.0
2016-10-04T19:03:56.043Z
2018-06-29T20:46:20.417Z
2018-06-29T20:46:20.417Z
Badr Bellaj
<p>Since the underlying field for the elliptic curve for secp256k1 is F<sub>p</sub> where p=2<sup>256</sup>-2<sup>32</sup>-977, and since p is very close to a power of 2,
it makes sense to try to graph the elliptic curve y<sup>2</sup>=x<sup>3</sup>+7 over the field of 2-adic numbers or related rings. Since we only have a finite amount of room to post here, let us simply graph the elliptic curve over a ring of the form Z<sub>2<sup>n</sup></sub>.
The ring of 2-adic integers is the inverse limit of the rings of the form Z<sub>2<sup>n</sup></sub>. Therefore, the rings Z<sub>2<sup>n</sup></sub> can be thought of as finite approximations for the ring of 2-adic integers. Now, we want to graph the elliptic curve in such a way so that two points which are near each other with respect to the 2-adic metric are also near each other on the graphical representation of the elliptic curve.</p>
<p>Let f:Z<sub>2<sup>n</sup></sub>-&gt;{0,...,2<sup>n</sup>-1} be the function where
f(a<sub>0</sub>2<sup>0</sup>+...+a<sub>n-1</sub>2<sup>n-1</sup>)=
a<sub>n-1</sub>2<sup>0</sup>+...+a<sub>0</sub>2<sup>n-1</sup>
whenever a<sub>0</sub>,...,a<sub>n-1</sub> are all elements of the set {0,1}. In other words, f simply reverses the bits in the binary representation of an element of
Z<sub>2<sup>n</sup></sub>. Then the white pixels in the following graph are precisely at the points with coordinates (f(x),f(y)) where y<sup>2</sup>=x<sup>3</sup>+7 mod 2<sup>n</sup> where n=9. This picture is an approximation of the image of the elliptic curve over the ring of 2-adic integers.</p>
<p><a href="https://i.sstatic.net/Ko2nV.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/Ko2nV.png" alt="enter image description here" /></a></p>
<p>Since the field of complex numbers is isomorphic to any ultraproduct of the algebraic closures of finite fields F<sub>p</sub> by a non-principal ultrafilter on the set of all prime numbers, one should think of the finite fields as an approximation to the set of all complex numbers. Furthermore, the field of p-adic numbers embeds into the field of complex numbers, so one may think of the finite fields as objects that approximate a field that contains the field of p-adic numbers as a sub-field. Therefore, it is appropriate to use the graphs of the elliptic curve y<sup>2</sup>=x<sup>3</sup>+7 over the reals, complex numbers, or even the p-adic numbers as a visualization for the fields used in elliptic curve cryptography. One just needs to realize that one is working in a different field for visualization purposes.</p>

CC BY-SA 4.0
2021-05-23T04:43:55.167Z
2021-05-23T04:43:55.167Z
Joseph Van Name
<p>I'm afraid you won't like the answer.</p>
<p>These curves - including the <code>secp256k1</code> curve, <em>y<sup>2</sup> = x<sup>3</sup> + 7</em> - 'look' nice when evaluated in typical fields (like the real numbers), but secp256k1 is defined over the finite field <em>Z<sub>2<sup>256</sup>-2<sup>32</sup>-977</sub></em>, which means the X and Y coordinates are 256-bit integers modulo a large number. Curves using such coordinates do not have any concept of continuous lines.</p>
<p>I've tried to plot this curve over a similar but much smaller field, Z<sub>2<sup>8</sup>+1</sub>. Coordinates extend from -128 to 128.</p>
<p><img src="https://i.sstatic.net/Iil7a.png" alt="y² = x³ + 7 over Z257, -128 through 128" /></p>
<p>Note that even though it may not make sense geometrically anymore, it still has all properties you need. A line (which means, a group of points with equation <em>ay + bx + c = 0</em>) that 'intersects' 2 points of the curve, will intersect a third. Tangent again has no geometric interpretation anymore, but you can still symbolically compute a derivative of the equation in a given point, which will have the property of intersecting the curve in a second point.</p>
<p>To show you what you'd get if this were over the real numbers, here is a plot of the same curve equation for that case. Once with coordinates -128 through 128, once with -8 through 8.</p>
<p><img src="https://i.sstatic.net/sNHuH.png" alt="y² = x³ + 7 over R, -128 through 128" />
<img src="https://i.sstatic.net/nhutd.png" alt="y² = x³ + 7 over R, -8 through 8" /></p>

CC BY-SA 3.0
2014-02-09T19:43:41.227Z
I'm not familiar with the subscript notation with exponents. `Z subscript: 2^256-2^32-977` (I'm learning this as I go along).  What does that mean... perhaps "take the mod of.." or is it something to do with the definition of a field I do not yet understand.
makerofthings7
CC BY-SA 3.0
2014-02-09T19:50:07.317Z
Yeah, Z modulo 2^256 - 2^32 - 977. Or written differently: the integers modulo 115792089237316195423570985008687907853269984665640564039457584007908834671663. In the simplified (first) plot above, I've used the numbers modulo 257 instead.
Pieter Wuille
CC BY-SA 3.0
2014-03-07T03:53:11.837Z
Actually **secp256k1 is defined over a Galois field,** not a ring of integers modulo a prime.  Now, it turns out that the secp256k1 field is a prime field and therefore isomorphic to a ring of integers modulo a prime, but this is not true for all ECDSA curves -- in fact, the "sectXXXyZ" curves (for which much faster hardware exists than the "secpXXXyZ" curves) cannot be described using rings of integers.  See this page for an explanation of why every finite field has a GF representation but only the prime fields have a a Z/pZ representation: http://en.wikipedia.org/wiki/Finite_field#Statement
eldentyrell
CC BY-SA 3.0
2014-03-07T08:52:17.267Z
Technically, every prime field is a Galois field. There indeed exist SEC curves defined over binary GF(2^n) Galois Fields, but this one is not. I'm not sure what you're trying to say here, the Galois representation of such a prime field is just GF(p^1).
Pieter Wuille
CC BY-SA 3.0
2014-03-10T16:09:15.593Z
Related: I was also curious if there was any way to visualize the rendezvous points that create weak private keys  http://bitcoin.stackexchange.com/a/23315/1878  but I suppose that would be difficult or impossible to do.
makerofthings7
CC BY-SA 3.0
2014-06-21T18:22:10.903Z
@makerofthings7 Those rendezvous points are just nonsense. You can come up with any set of 'special' points and transformations that make those easier to find, but there is no reason why they'd be more likely than others. We also don't actively try to avoid very low number for private keys for example - yes, those are easier to find IF you start by trying to crack those, but as they are not more likely than others to generate, why would you start there?
Pieter Wuille
CC BY-SA 3.0
2014-02-13T16:55:55.110Z
Is there any way to visualize signatures, and that the corresponding "S" value has two valid values?  Perhaps with a different field?  I'm entertaining the idea of educating people about transaction malleability in an interactive demo site.
makerofthings7
CC BY-SA 3.0
2017-09-30T22:56:24.150Z
@pieter you wrote: "that 'intersects' 2 points of the curve, will intersect a third.".  Image 3 in the original post seems to show a vertical line intersecting at P + Q ... but seemingly not at a 3rd point.  I'm just curious how is the "if 2 then 3" rule applied in ECC.
carl crott
CC BY-SA 3.0
2017-09-30T22:59:15.427Z
@carlcrott You're right - there is one exception, namely straight vertical lines intersect in only 2 points. This is solved by adding a virtual point 'at infinity' to the curve, which serves as neutral element. The result is a mathematical group.
Pieter Wuille
CC BY-SA 3.0
2017-12-31T14:12:24.937Z
Since a finite field is just a "wrap around", I am sure we can fit the original real numbers curve over some of those points in the finite field version --
 those points where  no wrap around happened.
Jus12
CC BY-SA 4.0
2020-07-03T19:56:37.810Z
excellent answer
Gewure
CC BY-SA 4.0
2021-05-23T06:53:39.150Z
I’m not sure the comment about continuity is mathematically correct, though I think what you are trying to say is clear. Continuity is a property defined for a function, which EC’s are (not unless we want to use the implicit function theorem and charts). Further, discrete functions (similar to curves over finite fields) are indeed continuous. Perhaps the more correct concepts to discuss for full rigor are connected components or smoothness. This small detail does hinder an otherwise high quality answer in my opinion.
Prince M
CC BY-SA 4.0
2021-05-23T13:52:12.103Z
I believe continuity is well-defined for curves in general, not just functions. But it doesn't apply in finite fields because there is no metric which maps distances to the real numbers, and which allows finding points arbritrarily close to another point. That said, I wasn't intended to be fully mathematically rigorous, only pointing out that despite there not being continuous lines drawn, we can still compute a tangent etc. by applying the same formulas - they just don't have the expected geometric meaning in finite fields, but the math works still.
Pieter Wuille
CC BY-SA 4.0
2014-02-09T19:05:07.487Z
2021-09-03T21:14:10.940Z
2021-09-03T21:14:10.940Z
Pieter Wuille
<p>I'm reading up on ECC curves and on many of them I see an illustration that looks like this</p>

<p><img src="https://i.sstatic.net/hAaxS.png" alt="enter image description here"></p>

<p>What does the comparable curve in Bitcoin look like, or are all curves generally the same?</p>

<cryptography><secp256k1>
What does the curve used in Bitcoin, secp256k1, look like?
makerofthings7
# What does the curve used in Bitcoin, secp256k1, look like?

(Asked by: username_0 on 2014-02-09)

I'm reading up on ECC curves and on many of them I see an illustration that looks like this

![enter image description here](https://i.sstatic.net/hAaxS.png)

What does the comparable curve in Bitcoin look like, or are all curves generally the same?

**Tags:** cryptography, secp256k1


---

## 3 answers

### Answer by username_5 on 2014-02-09. Score: 111 | Accepted answer

I'm afraid you won't like the answer.

These curves - including the `secp256k1` curve, *y2 = x3 + 7* - 'look' nice when evaluated in typical fields (like the real numbers), but secp256k1 is defined over the finite field *Z2256-232-977*, which means the X and Y coordinates are 256-bit integers modulo a large number. Curves using such coordinates do not have any concept of continuous lines.

I've tried to plot this curve over a similar but much smaller field, Z28+1. Coordinates extend from -128 to 128.

![y² = x³ + 7 over Z257, -128 through 128](https://i.sstatic.net/Iil7a.png)

Note that even though it may not make sense geometrically anymore, it still has all properties you need. A line (which means, a group of points with equation *ay + bx + c = 0*) that 'intersects' 2 points of the curve, will intersect a third. Tangent again has no geometric interpretation anymore, but you can still symbolically compute a derivative of the equation in a given point, which will have the property of intersecting the curve in a second point.

To show you what you'd get if this were over the real numbers, here is a plot of the same curve equation for that case. Once with coordinates -128 through 128, once with -8 through 8.

![y² = x³ + 7 over R, -128 through 128](https://i.sstatic.net/sNHuH.png)
![y² = x³ + 7 over R, -8 through 8](https://i.sstatic.net/nhutd.png)

> **Comments:**
> **username_0**: I'm not familiar with the subscript notation with exponents. `Z subscript: 2^256-2^32-977` (I'm learning this as I go along).  What does that mean... perhaps "take the mod of.." or is it something to do with the definition of a field I do not yet understand.  
> **username_5**: Yeah, Z modulo 2^256 - 2^32 - 977. Or written differently: the integers modulo 115792089237316195423570985008687907853269984665640564039457584007908834671663. In the simplified (first) plot above, I've used the numbers modulo 257 instead.  
> **username_0**: Is there any way to visualize signatures, and that the corresponding "S" value has two valid values?  Perhaps with a different field?  I'm entertaining the idea of educating people about transaction malleability in an interactive demo site.  
> **username_6**: Actually **secp256k1 is defined over a Galois field,** not a ring of integers modulo a prime.  Now, it turns out that the secp256k1 field is a prime field and therefore isomorphic to a ring of integers modulo a prime, but this is not true for all ECDSA curves -- in fact, the "sectXXXyZ" curves (for which much faster hardware exists than the "secpXXXyZ" curves) cannot be described using rings of integers.  See this page for an explanation of why every finite field has a GF representation but only the prime fields have a a Z/pZ representation: http://en.wikipedia.org/wiki/Finite_field#Statement  
> **username_5**: Technically, every prime field is a Galois field. There indeed exist SEC curves defined over binary GF(2^n) Galois Fields, but this one is not. I'm not sure what you're trying to say here, the Galois representation of such a prime field is just GF(p^1).  
> **username_0**: Related: I was also curious if there was any way to visualize the rendezvous points that create weak private keys  http://bitcoin.stackexchange.com/a/23315/1878  but I suppose that would be difficult or impossible to do.  
> **username_5**: @username_0 Those rendezvous points are just nonsense. You can come up with any set of 'special' points and transformations that make those easier to find, but there is no reason why they'd be more likely than others. We also don't actively try to avoid very low number for private keys for example - yes, those are easier to find IF you start by trying to crack those, but as they are not more likely than others to generate, why would you start there?  
> **username_7**: @username_5 you wrote: "that 'intersects' 2 points of the curve, will intersect a third.".  Image 3 in the original post seems to show a vertical line intersecting at P + Q ... but seemingly not at a 3rd point.  I'm just curious how is the "if 2 then 3" rule applied in ECC.  
> **username_5**: @username_7 You're right - there is one exception, namely straight vertical lines intersect in only 2 points. This is solved by adding a virtual point 'at infinity' to the curve, which serves as neutral element. The result is a mathematical group.  
> **username_8**: Since a finite field is just a "wrap around", I am sure we can fit the original real numbers curve over some of those points in the finite field version --  those points where  no wrap around happened.  
> **username_9**: excellent answer  
> **username_10**: I’m not sure the comment about continuity is mathematically correct, though I think what you are trying to say is clear. Continuity is a property defined for a function, which EC’s are (not unless we want to use the implicit function theorem and charts). Further, discrete functions (similar to curves over finite fields) are indeed continuous. Perhaps the more correct concepts to discuss for full rigor are connected components or smoothness. This small detail does hinder an otherwise high quality answer in my opinion.  
> **username_5**: I believe continuity is well-defined for curves in general, not just functions. But it doesn't apply in finite fields because there is no metric which maps distances to the real numbers, and which allows finding points arbritrarily close to another point. That said, I wasn't intended to be fully mathematically rigorous, only pointing out that despite there not being continuous lines drawn, we can still compute a tangent etc. by applying the same formulas - they just don't have the expected geometric meaning in finite fields, but the math works still.  

---

### Answer by username_1 on 2016-10-04. Score: 35

you can check the Bitcoin doc <https://en.bitcoin.it/wiki/Secp256k1> ,
there you will find some technical details about the secp256k1 used in bitcoin.

Below an illustration of the secp256k1's elliptic curve y2 = x3 + 7 over the real numbers (plot using [www.desmos.com/calculator/ialhd71we3](http://www.desmos.com/calculator/ialhd71we3))

[![secp256k1 plot using www.desmos.com/calculator/ialhd71we3](https://i.sstatic.net/JGSXb.png)](https://i.sstatic.net/JGSXb.png)

in the context of a finite field Zp, which greatly changes the ECC appearance but not its underlying equation or special properties. the picture below represents the same equation in a finite field F17 (the x and y values are integers between 0 and 17).

[![ Elliptic curve over F17](https://i.sstatic.net/SvjBj.png)](https://i.sstatic.net/SvjBj.png)

and here over F59 :

[![enter image description here](https://i.sstatic.net/HugPF.png)](https://i.sstatic.net/HugPF.png)

You will find an online opensource tool here <https://cdn.rawgit.com/andreacorbellini/ecc/920b29a/interactive/modk-add.html>
which will help you to plot the graphe and to make addition or scalar multiplication on a EC. E.g plot over F97 with P+Q.

[![enter image description here](https://i.sstatic.net/I3NpQ.png)](https://i.sstatic.net/I3NpQ.png)

another good article to read about ECDSA in Bitcoin is <https://github.com/username_1/Bitcoin_Ethereum_docs/blob/6bffb47afae6a2a70903a26d215484cf8ff03859/ecdsa_bitcoin.pdf>

> secp256k1 was almost never used before Bitcoin became popular, but it
> is now gaining in popularity due to its several nice properties. Most
> commonly-used curves have a random structure, but secp256k1 was
> constructed in a special non-random way which allows for especially
> efficient computation. As a result, it is often more than 30% faster
> than other curves if the implementation is sufficiently optimized.
> Also, unlike the popular NIST curves, secp256k1's constants were
> selected in a predictable way, which significantly reduces the
> possibility that the curve's creator inserted any sort of backdoor
> into the curve.

> **Comments:**
> **username_2**: https://andrea.corbellini.name/ecc/interactive/modk-add.html this is the correct address.  
> **username_3**: To help connect a few points, is the finite field you keep referring to also known as the "order" or the "large prime" necessary for the discrete log problem?  

---

### Answer by username_4 on 2021-05-23. Score: 1

Since the underlying field for the elliptic curve for secp256k1 is Fp where p=2256-232-977, and since p is very close to a power of 2,
it makes sense to try to graph the elliptic curve y2=x3+7 over the field of 2-adic numbers or related rings. Since we only have a finite amount of room to post here, let us simply graph the elliptic curve over a ring of the form Z2n.
The ring of 2-adic integers is the inverse limit of the rings of the form Z2n. Therefore, the rings Z2n can be thought of as finite approximations for the ring of 2-adic integers. Now, we want to graph the elliptic curve in such a way so that two points which are near each other with respect to the 2-adic metric are also near each other on the graphical representation of the elliptic curve.

Let f:Z2n->{0,...,2n-1} be the function where
f(a020+...+an-12n-1)=
an-120+...+a02n-1
whenever a0,...,an-1 are all elements of the set {0,1}. In other words, f simply reverses the bits in the binary representation of an element of
Z2n. Then the white pixels in the following graph are precisely at the points with coordinates (f(x),f(y)) where y2=x3+7 mod 2n where n=9. This picture is an approximation of the image of the elliptic curve over the ring of 2-adic integers.

[![enter image description here](https://i.sstatic.net/Ko2nV.png)](https://i.sstatic.net/Ko2nV.png)

Since the field of complex numbers is isomorphic to any ultraproduct of the algebraic closures of finite fields Fp by a non-principal ultrafilter on the set of all prime numbers, one should think of the finite fields as an approximation to the set of all complex numbers. Furthermore, the field of p-adic numbers embeds into the field of complex numbers, so one may think of the finite fields as objects that approximate a field that contains the field of p-adic numbers as a sub-field. Therefore, it is appropriate to use the graphs of the elliptic curve y2=x3+7 over the reals, complex numbers, or even the p-adic numbers as a visualization for the fields used in elliptic curve cryptography. One just needs to realize that one is working in a different field for visualization purposes.


---

