<p>xG ( x of Generator point G) is a carefully selected 256 bit number that is divisible by the elements 0001, 0010, 0011, 0100, 0101, 0110, 0111 (1 to 7) i.e</p>
<p>0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798 =</p>
<p>55066263022277343669578718895168534326250603453777594175500187360389116729240 mod 1, mod 2, mod 3, up to mod 7 will all have the same result = 0</p>
<p>This means that for the elements 1 to 7 that make up the smallest sub-group of order n there exists no residuals that may leak information as a result of operating G under addition or multiplication ( which is successive addition) since all points on the curve must satisfy the same equation y^2=x^3+7 used to construct the smallest subgroup.</p>
<p>A pleasure to have my first interaction with a Bitcoin community on Bitcoin.Stackexchange</p>

CC BY-SA 4.0
2022-07-07T21:22:53.477Z
This all sounds very confused. The order of the generator is n, the same as the order of the curve (by definition, as it is a generator). It's an interesting observation that its X coordinate is a multiple of so many small numbers, but I'm not convinced that's intentional or coincidence. It's not true for Y, and I don't see what advantage there could be to this.
Pieter Wuille
CC BY-SA 4.0
2022-07-07T23:24:31.170Z
The order "n" (a prime integer) is the max number of times a single element G ( an X,Y coordinate where both x and y are integers too) can be added to itself geometrically. Since x & y are essentially integers as well, then the geometric structure is nothing but the relation between those integers x and y that satisfies the equation "y^2=x^3+7" which is the shape of the EC. If the equation is satisfied then they become "points" (x,y) on the EC. Also only x matters, as we are not solving for Y it is there to define the geometric relation thats why we can use compressed pub keys
Moussa Al-Basheer
CC BY-SA 4.0
2022-07-07T23:25:45.240Z
x and y are integers modulo p, but the order of G is with respect to the elliptic curve point addition operations, and this has as far as I know nothing to do with the integer value factorization of the coordinates.
Pieter Wuille
CC BY-SA 4.0
2022-07-07T23:37:36.417Z
the doubling and adding operations are over the x &y coordinates of G,   where x at G defined by SEC is already a 256 bit number, if you just perform G+G+G by the 3rd addition, the x-value is already bigger than the 256 bits prime modulus when you have only performed 3*G. that why we have the 2 mods, one, is to keep the integer coordinates within range, and the other simply denoting how many operations we can do
Moussa Al-Basheer
CC BY-SA 4.0
2022-07-07T23:39:27.667Z
either way , the coordinates and the number of operations allowed are eventually in an integer field  one bigger than the other with a cofactor h =1 ensuring that  factorization wouldnt be possible
Moussa Al-Basheer
CC BY-SA 4.0
2022-07-07T23:47:43.737Z
I hate it when wiki does a better job explaining than i do :(  hehe  (let there be link) https://en.wikipedia.org/wiki/Quotient_group
Moussa Al-Basheer
CC BY-SA 4.0
2022-07-07T23:53:12.843Z
The addition operation on elliptic curve groups is _not_ just adding the coordinates together, but a much more involved operation: see "Point Addition" on https://en.m.wikipedia.org/wiki/Elliptic_curve_point_multiplication for example.
Pieter Wuille
CC BY-SA 4.0
2022-07-08T00:15:37.307Z
of course, we are dealing with abstract math. Any forums u recommend where we can discuss further?  am new here, so pardon me
Moussa Al-Basheer
CC BY-SA 4.0
2022-07-08T13:39:43.787Z
I don't understand what you're talking about then. The X and Y coordinates are not members of the integer ring, they are field elements. Their additive order is p. Their multiplicative order is p-1 (since p is prime). They have no non-trivial subgroups. Further, none of that matters to the elliptic curve they define, whose points have order n, and whose group also has no non-trivial subgroups.
Pieter Wuille
CC BY-SA 4.0
2022-07-07T20:19:54.697Z
2022-07-07T20:19:54.697Z
Moussa Al-Basheer
<p>The comment stating <code>n</code> “has to be prime” is a bit confusing.</p>

<p>The order of base point “has” to be prime in the sense that this is a requirement in the particular documents defining standard curves—for example, in <a href="http://www.secg.org/sec2-v2.pdf" rel="noreferrer">SECG</a>, which includes secp256k1. Bitcoin's base point order <code>r</code> is prime.</p>

<p>In SECG, it is also stated that cofactor of secp256k1 curve is 1, which makes <code>n = r × 1</code>, again prime. A group of prime order is obviously cyclic.</p>

CC BY-SA 3.0
2015-06-21T06:37:52.157Z
Thank you for your answer! So E(K) is a cyclic group, r = n is prime and then each element of E(K)* has order n  --> each element could have been the base point. Is there a reason SEC chose  G = 02 79BE667E F9DCBBAC 55A06295 CE870B07 029BFCDB 2DCE28D9 59F2815B 16F81798 as base point?
arulbero
CC BY-SA 3.0
2015-06-21T14:17:25.173Z
@arulbero re SEC defined G: great question. Anyone know why? Why not start at `x=0`?
Wizard Of Ozzie
CC BY-SA 3.0
2015-06-21T17:42:44.620Z
@Wizard Of Ozzie   The point "O" is the only one that cannot be chosen, because order of O is 1. To generate safely a public key starting from G, G's order must be a prime number, as large as possible; in our case each element except O has the same order, n.
arulbero
CC BY-SA 3.0
2015-06-22T18:22:30.563Z
@WizardOfOzzie@arulbero It's likely the base points in SECG were chosen randomly. It's also likely that this had led to some controversy since then. References are not very easy to locate, sorry.
akater
CC BY-SA 3.0
2015-06-21T03:41:38.550Z
2015-06-21T03:41:38.550Z
akater
<p>points on curve secp256k1 form a group E(Fp) over field Fp.</p>

<p>p = 2^256 - 2^32 - 2^9 - 2^8 - 2^7 - 2^6 - 2^4 - 1  is prime.</p>

<p>n is the order of group E, 
n=115792089237316195423570985008687907852837564279074904382605163141518161494337</p>

<p>Is n prime too?</p>

<p>Is E(Fp) a cyclic group?</p>

<p>Theorem. 
Working over a finite field, the group of points E(Fp) is always either a cyclic group or the product of two cyclic groups.</p>

CC BY-SA 3.0
2015-06-21T00:34:33.840Z
`n` has to be a prime such that `(Gx, Gy) * n = slope is infinity`. Hopefully someone can answer the other part
Wizard Of Ozzie
<secp256k1>
order of group of points of secp256k1
arulbero
# order of group of points of secp256k1

(Asked by: username_0 on 2015-06-20)

points on curve secp256k1 form a group E(Fp) over field Fp.

p = 2^256 - 2^32 - 2^9 - 2^8 - 2^7 - 2^6 - 2^4 - 1 is prime.

n is the order of group E,
n=115792089237316195423570985008687907852837564279074904382605163141518161494337

Is n prime too?

Is E(Fp) a cyclic group?

Theorem.
Working over a finite field, the group of points E(Fp) is always either a cyclic group or the product of two cyclic groups.

**Tags:** secp256k1

> **Comments:**
> **username_1**: `n` has to be a prime such that `(Gx, Gy) * n = slope is infinity`. Hopefully someone can answer the other part  

---

## 2 answers

### Answer by username_4 on 2015-06-21. Score: 5 | Accepted answer

The comment stating `n` “has to be prime” is a bit confusing.

The order of base point “has” to be prime in the sense that this is a requirement in the particular documents defining standard curves—for example, in [SECG](http://www.secg.org/sec2-v2.pdf), which includes secp256k1. Bitcoin's base point order `r` is prime.

In SECG, it is also stated that cofactor of secp256k1 curve is 1, which makes `n = r × 1`, again prime. A group of prime order is obviously cyclic.

> **Comments:**
> **username_0**: Thank you for your answer! So E(K) is a cyclic group, r = n is prime and then each element of E(K)* has order n  --> each element could have been the base point. Is there a reason SEC chose  G = 02 79BE667E F9DCBBAC 55A06295 CE870B07 029BFCDB 2DCE28D9 59F2815B 16F81798 as base point?  
> **username_1**: @username_0 re SEC defined G: great question. Anyone know why? Why not start at `x=0`?  
> **username_0**: @username_1   The point "O" is the only one that cannot be chosen, because order of O is 1. To generate safely a public key starting from G, G's order must be a prime number, as large as possible; in our case each element except O has the same order, n.  
> **username_4**: @username_1@username_0 It's likely the base points in SECG were chosen randomly. It's also likely that this had led to some controversy since then. References are not very easy to locate, sorry.  

---

### Answer by username_2 on 2022-07-07. Score: 0

xG ( x of Generator point G) is a carefully selected 256 bit number that is divisible by the elements 0001, 0010, 0011, 0100, 0101, 0110, 0111 (1 to 7) i.e

0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798 =

55066263022277343669578718895168534326250603453777594175500187360389116729240 mod 1, mod 2, mod 3, up to mod 7 will all have the same result = 0

This means that for the elements 1 to 7 that make up the smallest sub-group of order n there exists no residuals that may leak information as a result of operating G under addition or multiplication ( which is successive addition) since all points on the curve must satisfy the same equation y^2=x^3+7 used to construct the smallest subgroup.

A pleasure to have my first interaction with a Bitcoin community on Bitcoin.Stackexchange

> **Comments:**
> **username_3**: This all sounds very confused. The order of the generator is n, the same as the order of the curve (by definition, as it is a generator). It's an interesting observation that its X coordinate is a multiple of so many small numbers, but I'm not convinced that's intentional or coincidence. It's not true for Y, and I don't see what advantage there could be to this.  
> **username_2**: The order "n" (a prime integer) is the max number of times a single element G ( an X,Y coordinate where both x and y are integers too) can be added to itself geometrically. Since x & y are essentially integers as well, then the geometric structure is nothing but the relation between those integers x and y that satisfies the equation "y^2=x^3+7" which is the shape of the EC. If the equation is satisfied then they become "points" (x,y) on the EC. Also only x matters, as we are not solving for Y it is there to define the geometric relation thats why we can use compressed pub keys  
> **username_3**: x and y are integers modulo p, but the order of G is with respect to the elliptic curve point addition operations, and this has as far as I know nothing to do with the integer value factorization of the coordinates.  
> **username_2**: the doubling and adding operations are over the x &y coordinates of G,   where x at G defined by SEC is already a 256 bit number, if you just perform G+G+G by the 3rd addition, the x-value is already bigger than the 256 bits prime modulus when you have only performed 3*G. that why we have the 2 mods, one, is to keep the integer coordinates within range, and the other simply denoting how many operations we can do  
> **username_2**: either way , the coordinates and the number of operations allowed are eventually in an integer field  one bigger than the other with a cofactor h =1 ensuring that  factorization wouldnt be possible  
> **username_2**: I hate it when wiki does a better job explaining than i do :(  hehe  (let there be link) https://en.wikipedia.org/wiki/Quotient_group  
> **username_3**: The addition operation on elliptic curve groups is _not_ just adding the coordinates together, but a much more involved operation: see "Point Addition" on https://en.m.wikipedia.org/wiki/Elliptic_curve_point_multiplication for example.  
> **username_2**: of course, we are dealing with abstract math. Any forums u recommend where we can discuss further?  am new here, so pardon me  
> **username_3**: I don't understand what you're talking about then. The X and Y coordinates are not members of the integer ring, they are field elements. Their additive order is p. Their multiplicative order is p-1 (since p is prime). They have no non-trivial subgroups. Further, none of that matters to the elliptic curve they define, whose points have order n, and whose group also has no non-trivial subgroups.  

---

