<p>Since the secp256k1 curve order is prime, every point on the curve except the point at infinity is a generator.</p>

<p>Nothing is known about how the designers of the curve chose this specific generator.</p>

<p>However, there is one tell-tale sign that hints about its construction. When the chosen generator G is multiplied by 1/2 (i.e. multiplied by the multiplicative inverse of 2 modulo the curve order), the resulting X coordinate is an exceptionally low number. This very likely means that G was created by picking that X, finding a corresponding Y on the curve, and then doubling the resulting point.</p>

CC BY-SA 3.0
2018-01-23T09:12:08.167Z
Can you share this low number X?
k06a
CC BY-SA 3.0
2018-01-23T15:01:11.593Z
G/2 = (0x3b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63, 0xc0c686408d517dfd67c2367651380d00d126e4229631fd03f8ff35eef1a61e3c).
Pieter Wuille
CC BY-SA 4.0
2019-01-28T19:48:29.687Z
Is there a reason why it needs to be random and large like this? It seems like y^2=x^3+7 is a nice "nothing up my sleeve" curve, but I can't say the same about this base point. Is security compromised in any way if the X coordinate of the base point was chosen to be a tiny number like 3 or 7?
lurf jurv
CC BY-SA 4.0
2019-01-28T19:55:05.703Z
@lurfjurv To the best of my knowledge, the choice of the generator is not relevant to the security of ECDSA.
Pieter Wuille
CC BY-SA 4.0
2019-01-29T21:28:29.880Z
I see, so the choice is irrelevant. Is this not suspicious then? Why not pick a trivially small number for x to remove any concern that this base point has some fatal flaw or backdoor?
lurf jurv
CC BY-SA 4.0
2022-04-17T14:01:23.153Z
Pieter, to get a exceptionally low number, could you share the exact math ? I found a couple of different values of "curve order" and none of them are giving the exceptionally low number.
ramshi
CC BY-SA 4.0
2022-04-17T14:24:18.167Z
@lurfjurv You'll have to ask the people who designed secp256k1 and wrote it up as a standard, I'm afraid. Other elliptic curve standards sometimes use non-random-looking base points.
Pieter Wuille
CC BY-SA 4.0
2022-04-17T14:28:50.060Z
secp256k1's curve order is 2^256 - 432420386565659656852420866394968145599. The multiplicative inverse of 2 modulo the curve order is 2^255 - 216210193282829828426210433197484072799. So multiplying a point with that number is the reverse operation of doubling a point. If you do that with the generator point, you obtain a point with X coordinate 86918276961810349294276103416548851884759982251107 (a 166-bit number, which is extremely small; most X coordinates are 256-bit numbers).
Pieter Wuille
CC BY-SA 4.0
2022-04-28T16:05:48.123Z
Not only secp256k1, but also the generators of secp160k1, secp192k1, secp224k1 were created using this scheme. And even more interestingly the x coordinate of these G/2 points all look very similar. 

See: https://bitcoin.stackexchange.com/a/113495/109728

And here a gist with a Sage script to calculate these values: https://gist.github.com/johnzweng/863f412689ee383cc41ac7c709ca662c
Johannes Zweng
CC BY-SA 3.0
2017-08-28T01:04:09.287Z
2017-08-28T01:04:09.287Z
Pieter Wuille
<p><code>79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798,483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8</code> seems very random to me. I see how this point is on the curve, but how exactly was this specific point chosen to be the base point? Could other base points have worked?</p>

CC BY-SA 4.0
2022-05-16T17:26:52.750Z
Does this answer your question? [How is the generator point G chosen in the secp256k1 curve used in Bitcoin?](https://bitcoin.stackexchange.com/questions/113116/how-is-the-generator-point-g-chosen-in-the-secp256k1-curve-used-in-bitcoin)
Pieter Wuille
<secp256k1>
How were the secp256k1 base point coordinates decided?
lurf jurv
# How were the secp256k1 base point coordinates decided?

(Asked by: username_0 on 2017-08-28)

`79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798,483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8` seems very random to me. I see how this point is on the curve, but how exactly was this specific point chosen to be the base point? Could other base points have worked?

**Tags:** secp256k1

> **Comments:**
> **username_1**: Does this answer your question? [How is the generator point G chosen in the secp256k1 curve used in Bitcoin?](https://bitcoin.stackexchange.com/questions/113116/how-is-the-generator-point-g-chosen-in-the-secp256k1-curve-used-in-bitcoin)  

---

## 1 answers

### Answer by username_1 on 2017-08-28. Score: 6

Since the secp256k1 curve order is prime, every point on the curve except the point at infinity is a generator.

Nothing is known about how the designers of the curve chose this specific generator.

However, there is one tell-tale sign that hints about its construction. When the chosen generator G is multiplied by 1/2 (i.e. multiplied by the multiplicative inverse of 2 modulo the curve order), the resulting X coordinate is an exceptionally low number. This very likely means that G was created by picking that X, finding a corresponding Y on the curve, and then doubling the resulting point.

> **Comments:**
> **username_2**: Can you share this low number X?  
> **username_1**: G/2 = (0x3b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63, 0xc0c686408d517dfd67c2367651380d00d126e4229631fd03f8ff35eef1a61e3c).  
> **username_0**: Is there a reason why it needs to be random and large like this? It seems like y^2=x^3+7 is a nice "nothing up my sleeve" curve, but I can't say the same about this base point. Is security compromised in any way if the X coordinate of the base point was chosen to be a tiny number like 3 or 7?  
> **username_1**: @username_0 To the best of my knowledge, the choice of the generator is not relevant to the security of ECDSA.  
> **username_0**: I see, so the choice is irrelevant. Is this not suspicious then? Why not pick a trivially small number for x to remove any concern that this base point has some fatal flaw or backdoor?  
> **username_3**: username_1, to get a exceptionally low number, could you share the exact math ? I found a couple of different values of "curve order" and none of them are giving the exceptionally low number.  
> **username_1**: @username_0 You'll have to ask the people who designed secp256k1 and wrote it up as a standard, I'm afraid. Other elliptic curve standards sometimes use non-random-looking base points.  
> **username_1**: secp256k1's curve order is 2^256 - 432420386565659656852420866394968145599. The multiplicative inverse of 2 modulo the curve order is 2^255 - 216210193282829828426210433197484072799. So multiplying a point with that number is the reverse operation of doubling a point. If you do that with the generator point, you obtain a point with X coordinate 86918276961810349294276103416548851884759982251107 (a 166-bit number, which is extremely small; most X coordinates are 256-bit numbers).  
> **username_4**: Not only secp256k1, but also the generators of secp160k1, secp192k1, secp224k1 were created using this scheme. And even more interestingly the x coordinate of these G/2 points all look very similar.   See: https://bitcoin.stackexchange.com/a/113495/109728  And here a gist with a Sage script to calculate these values: https://gist.github.com/johnzweng/863f412689ee383cc41ac7c709ca662c  

---

