<p>I believe Satoshi was once asked this question, and answered that it was just some curve that existed and was presumed to be efficiently implemented.</p>

<p>I'll try to find a reference.</p>

CC BY-SA 3.0
2013-09-14T22:59:06.917Z
Thanks for that, but that makes it seem like Satoshi just randomly choose one of the many specifications available -- which may in fact be true. Nonetheless, I'm looking for specific differences between specifications that might effect things like signature performance, overall security, etc... – John Henry 1 hour ago
John Henry
CC BY-SA 3.0
2014-08-15T13:53:58.370Z
I had heard that he had a very good reason to choose this one over another, I'll also try to find the reference, though this was perhaps just a rumor when there was the big thing with the NSA having backdoor in some SHA algorithms. I would love to see this answered!
Mark
CC BY-SA 3.0
2013-09-13T23:17:45.200Z
2013-09-13T23:17:45.200Z
Pieter Wuille
<blockquote>
  <p>What are the advantages (and disadvantages) of using this over other specifications such as secp256r1?</p>
</blockquote>

<p>Secp256k1 is less widely used than secp256r1 so for some time there were faster implementations of r1 than k1.  That isn't true today, and the fastest implementations of k1 are considerably faster than r1.</p>

<p>Secp256k1's security critical parameters are essentially fixed by its design criteria, while r1's parameters are generated based on a 'random number' with no documented origin, causing some to worry that it might have been intentionally weakened.</p>

<p>I don't believe a new application would standardize on a 256-bit curve at this time, but if I had to pick between k1 and r1 for something where compatibility wasn't a concern picking k1 would be an easy decision.</p>

CC BY-SA 4.0
2019-01-14T03:49:10.293Z
2019-01-14T03:49:10.293Z
G. Maxwell
<p>Bitcoin uses <strong>secp256k1</strong> as the specification for it's address system (<a href="https://en.bitcoin.it/wiki/Secp256k1" rel="nofollow">https://en.bitcoin.it/wiki/Secp256k1</a>). What are the advantages (and disadvantages) of using this over other specifications such as <strong>secp256r1</strong>?</p>

<p><strong>Edit</strong>: I found this page (<a href="https://bitcointalk.org/index.php?topic=151120.0" rel="nofollow">https://bitcointalk.org/index.php?topic=151120.0</a>) which speculates on some possible differences, but I'm hoping to find something concrete.</p>

<cryptography><secp256k1>
What are the advantages of using Secp256k1?
John Henry
# What are the advantages of using Secp256k1?

(Asked by: username_0 on 2013-09-13)

Bitcoin uses **secp256k1** as the specification for it's address system (<https://en.bitcoin.it/wiki/Secp256k1>). What are the advantages (and disadvantages) of using this over other specifications such as **secp256r1**?

**Edit**: I found this page (<https://bitcointalk.org/index.php?topic=151120.0>) which speculates on some possible differences, but I'm hoping to find something concrete.

**Tags:** cryptography, secp256k1


---

## 2 answers

### Answer by username_3 on 2019-01-14. Score: 4 | Accepted answer

> What are the advantages (and disadvantages) of using this over other specifications such as secp256r1?

Secp256k1 is less widely used than secp256r1 so for some time there were faster implementations of r1 than k1. That isn't true today, and the fastest implementations of k1 are considerably faster than r1.

Secp256k1's security critical parameters are essentially fixed by its design criteria, while r1's parameters are generated based on a 'random number' with no documented origin, causing some to worry that it might have been intentionally weakened.

I don't believe a new application would standardize on a 256-bit curve at this time, but if I had to pick between k1 and r1 for something where compatibility wasn't a concern picking k1 would be an easy decision.


---

### Answer by username_1 on 2013-09-13. Score: 5

I believe Satoshi was once asked this question, and answered that it was just some curve that existed and was presumed to be efficiently implemented.

I'll try to find a reference.

> **Comments:**
> **username_0**: Thanks for that, but that makes it seem like Satoshi just randomly choose one of the many specifications available -- which may in fact be true. Nonetheless, I'm looking for specific differences between specifications that might effect things like signature performance, overall security, etc... – username_0 username_0 1 hour ago  
> **username_2**: I had heard that he had a very good reason to choose this one over another, I'll also try to find the reference, though this was perhaps just a rumor when there was the big thing with the NSA having backdoor in some SHA algorithms. I would love to see this answered!  

---

