<p>No, there cannot be.</p>
<p>There are two groups defined by the secp256k1 field, the addition group, and the group of multiplication of its non-zero elements.</p>
<p>Neither has a large <em>2<sup>n</sup></em> subgroup, because the order of a subgroup of a finite group must be a divisor of the order of that group.</p>
<ul>
<li><p>The order of the additive group must divide the size of the field, namely p, the modulus itself, which is prime, and thus only has itself and the trivial group as subgroups.</p>
</li>
<li><p>The order of the multiplicative group of a field is one less than the size of the field, so <em>p-1</em>, which factors as <em>2 * 3 * 7 * 13441 * 205115282021455665897114700593932402728804164701536103180137503955397371</em>. Thus, it only has <em>C<sub>2</sub></em> (the cyclic group with two elements) as subgroup whose order is a power of two. Specifically, in the embedding in the secp256k1 multiplicative group, that subgroup consists of the elements <em>1</em> and <em>p-1</em>, and the multiplication between them.</p>
</li>
</ul>

CC BY-SA 4.0
2024-01-31T21:34:10.220Z
@user108963: the answer is correct. The question is about the prime field of order p that [secp256k1](https://www.secg.org/sec2-v2.pdf#subsubsection.2.4.1) is defined over, independent of other parameters of secp256k1 (like b=7, and the curve order n). If we change the question to make it about a subgroup of the elliptic curve group secp256k1, the answer remains NO, because the order of a subgroup divides the order of the group, which for secp256k1 is the prime n, thus any subgroup of secp256k1 has order 1 or n, and none of 1 or n is a large power of 2.
fgrieu
CC BY-SA 4.0
2024-01-31T21:38:29.450Z
@fgrieu okey, that's true.
user108963
CC BY-SA 4.0
2022-07-22T17:55:29.053Z
2022-07-22T18:50:16.060Z
2022-07-22T18:50:16.060Z
Pieter Wuille
<p>the curve secp256k1 is defined over the prime finite field F_p with p = 2^256 - 2^32 - 2^9 - 2^8 - 2^7 - 2^6 - 2^4 - 1.</p>
<p>Is there any known cyclic subgroup of order 2^n of F_p?</p>

<secp256k1>
Is there a subgroup of order 2^n (for large n) of the prime field that secp256k1 is defined over?
jet
# Is there a subgroup of order 2^n (for large n) of the prime field that secp256k1 is defined over?

(Asked by: username_0 on 2022-07-22)

the curve secp256k1 is defined over the prime finite field F\_p with p = 2^256 - 2^32 - 2^9 - 2^8 - 2^7 - 2^6 - 2^4 - 1.

Is there any known cyclic subgroup of order 2^n of F\_p?

**Tags:** secp256k1


---

## 1 answers

### Answer by username_1 on 2022-07-22. Score: 7 | Accepted answer

No, there cannot be.

There are two groups defined by the secp256k1 field, the addition group, and the group of multiplication of its non-zero elements.

Neither has a large *2n* subgroup, because the order of a subgroup of a finite group must be a divisor of the order of that group.

* The order of the additive group must divide the size of the field, namely p, the modulus itself, which is prime, and thus only has itself and the trivial group as subgroups.
* The order of the multiplicative group of a field is one less than the size of the field, so *p-1*, which factors as *2 \* 3 \* 7 \* 13441 \* 205115282021455665897114700593932402728804164701536103180137503955397371*. Thus, it only has *C2* (the cyclic group with two elements) as subgroup whose order is a power of two. Specifically, in the embedding in the secp256k1 multiplicative group, that subgroup consists of the elements *1* and *p-1*, and the multiplication between them.

> **Comments:**
> **username_2**: @username_3: the answer is correct. The question is about the prime field of order p that [secp256k1](https://www.secg.org/sec2-v2.pdf#subsubsection.2.4.1) is defined over, independent of other parameters of secp256k1 (like b=7, and the curve order n). If we change the question to make it about a subgroup of the elliptic curve group secp256k1, the answer remains NO, because the order of a subgroup divides the order of the group, which for secp256k1 is the prime n, thus any subgroup of secp256k1 has order 1 or n, and none of 1 or n is a large power of 2.  
> **username_3**: @username_2 okey, that's true.  

---

