<p>The value of </p>

<p>G(compressed) = 02 79BE667E F9DCBBAC 55A06295 CE870B07 029BFCDB 2DCE28D9 59F2815B 16F81798 </p>

<p>and </p>

<p>G(uncompressed) = 04 79BE667E F9DCBBAC 55A06295 CE870B07 029BFCDB 2DCE28D9 59F2815B 16F81798 483ADA77 26A3C465 5DA4FBFC 0E1108A8 FD17B448 A6855419 9C47D08F FB10D4B8 </p>

<p>source:  <a href="https://en.bitcoin.it/wiki/Secp256k1" rel="noreferrer">https://en.bitcoin.it/wiki/Secp256k1</a></p>

CC BY-SA 3.0
2017-07-07T16:18:29.273Z
This is a potentially useful answer, but it could be improved by adding a little more explanation.
Murch
CC BY-SA 3.0
2017-07-13T11:06:09.873Z
Yes.. Uncompressed G has 2 co-ordinates X and Y since it is point on the curve and its size is 520 bits(65 Bytes) i.e 256 bits for each co-ordinate And it has a prefix 04 , While Compressed G has only one co-ordinate i.e.X And a prefix either 02 when Y co-ordinate is positive or 03 when Y co-ordinate is Negative.
DOLLY PATWA
CC BY-SA 3.0
2017-07-05T09:51:41.927Z
2017-07-05T09:51:41.927Z
DOLLY PATWA
<p>You can think of the generator G as the first point after infinity on the curve.  Begin with infinity and add G; the result is G. Add G to this and you get 2G. Add G to this and you get 3G. And so on. If you add G a total of <code>n</code> times (where <code>n</code> is the <em>order</em> of the curve) you will be back at infinity, where you started; the whole curve is a never-ending loop. The order <code>n</code> is how many distinct points are on the curve, or in Bitcoin terms, how many possible private keys there are (plus 1 for the point at infinity).</p>

CC BY-SA 4.0
2022-04-12T20:26:50.000Z
Is the order `n` that you're referring to the same as the `finite field` in the context of the discrete log problem?
Olshansky
CC BY-SA 3.0
2014-12-22T19:39:39.363Z
2014-12-22T19:39:39.363Z
Chuck Batson
<p>Starting with a private key in the form of a randomly generated number k, we multiply
it by a predetermined point on the curve called the generator point G to produce another
point somewhere else on the curve, which is the corresponding public key K. The generator point is specified as part of the secp256k1 standard and is always the same for all
keys in bitcoin:
K = k *G
where k is the private key, G is the generator point, and K is the resulting public key, a
point on the curve. Because the generator point is always the same for all bitcoin users,a private key k multiplied with G will always result in the same public key K. The rela‐
tionship between k and K is fixed, but can only be calculated in one direction, from k
to K. That’s why a bitcoin address (derived from K) can be shared with anyone and does
not reveal the user’s private key (k).</p>

<p>from the Book "Mastering Bitcoin" by Andreas Antonopoulos
<a href="http://uplib.fr/w/images/8/83/Mastering_Bitcoin-Antonopoulos.pdf" rel="nofollow">http://uplib.fr/w/images/8/83/Mastering_Bitcoin-Antonopoulos.pdf</a></p>

CC BY-SA 3.0
2016-09-17T08:58:30.313Z
2016-09-17T08:58:30.313Z
gtopal
<p>Ok first and foremost people no offense but your both just a little off on your thoughts of how it is supposed to be understood. The fact is that {y^2=x^3+ax+b} = n order h= base point G 02/03 in compressed format and 04 in uncompressed. 04 was to show the whole uncompressed key (X^3, Y^2). The understanding of the compression is that the 02 is even and the 03 is odd for X. But in order to so called get your private key back if lost (because the public key is not supposed to be shared hence the reason for the ripemd and md5 versions). Simply put in an easier understanding for most. X<em>X</em>X+7=Y<em>Y so the cubic sqrt of x generates the x and the sqrt of Y generates the Y of the random number that was began with because this is a graph either way around. Meaning function(x,y)=(x) random number. So from the beginning when you use a random number in the curve it is a point on the Elliptic curve in elliptic curve cryptoGRAPHy so a X and Y coordinate comes from your random number that is entered into the equation x</em>x<em>x+ax+b=y</em>y where a=0 and b=7 over a finite field which is basically a square with 0,0 : 0,1 : 1,1 : 1,0 hence the reason for the cubic function of x. Where most get confused is because of the exponents P,N,A,B,G and H being thrown in there but you must understand that the truth is those variables make up the sextuple T. Where they are pretty much constant variables except h which is either 1 or 0 to determine the outcome of G. P is the finite field 2^255-2^32-2^9-2^8-2^7-2^6-2^4-1. A=0 B=7 and N is the order mod h to determine the outcome of G. N does not change values it is the sqrt of 2^255 so basically 2^128. Trust me I know what I speak of. Although things have changed with the addition of all of the bips, HD wallets, and the various upgrades throughout the years. What I speak of is the truth. In the beginning you started out with a key that was unserialized at first which meant it was 228 bits then it was serialized which gave you a shorter key that was your Eckey(elliptic curve key) meaning your random number that your public key would be derived from following the math I have laid before you. It would calculate your public key, a signature, and a new private key if needed. But of course with everyone thinking they know best and using programs to manipulate keys to their benefit, or because they think theirs is better, the differences from the beginning are astounding. Just saying.... Hope this clears up things a lot better for you guys. If you don't believe me right now just know at some point in the future you will understand why my knowledge on this subject is so confident.</p>

CC BY-SA 4.0
2020-08-18T04:22:21.093Z
You should edit that to at least have some paragraphs/formatting - walls of texts are hard to digest in the best of times, and even harder when explaining crypto
Raghav Sood
CC BY-SA 4.0
2020-08-18T04:06:32.503Z
2020-08-18T04:06:32.503Z
Jazzwhit7
<p>For a curve with for instance the equation:  <code>y^2 = x^3 + a * x + b</code></p>

<p>The generator point G, or a ECDSA public key, is a pair of coordinates <code>x</code> and <code>y</code>, for which the above equation holds.</p>

<p>To reduce the storage size for a curve point, one can also store a sign and the <code>x</code> coordinate, this is what is known as point-compression.</p>

<p>You can then reconstruct the <code>y</code> by calculating  <code>sign * sqrt(x^3+a*x+b)</code>.</p>

<p>Note that for calculations in modular fields the square root can only be calculated efficiently when the <code>p != 1 (mod 8)</code></p>

CC BY-SA 3.0
2015-01-13T20:41:21.130Z
Note that in the specific case of Bitcoin's secp256k1 curve, a = 0 and b = 7, so the formula is y^2 = x^3 + 7.
Pieter Wuille
CC BY-SA 3.0
2014-08-07T17:17:11.973Z
2015-01-13T21:02:39.860Z
2015-01-13T21:02:39.860Z
Willem Hengeveld
<p>What exactly is the generator G in elliptical curve math?  It is typically described as a point on the curve.  Is this a tuple of values?  What properties does it have?</p>

<cryptography>
What exactly is generator G in Bitcoin's elliptical curve algorithm?
Eric S
# What exactly is generator G in Bitcoin's elliptical curve algorithm?

(Asked by: username_0 on 2014-08-07)

What exactly is the generator G in elliptical curve math? It is typically described as a point on the curve. Is this a tuple of values? What properties does it have?

**Tags:** cryptography


---

## 5 answers

### Answer by username_8 on 2014-08-07. Score: 10 | Accepted answer

For a curve with for instance the equation: `y^2 = x^3 + a * x + b`

The generator point G, or a ECDSA public key, is a pair of coordinates `x` and `y`, for which the above equation holds.

To reduce the storage size for a curve point, one can also store a sign and the `x` coordinate, this is what is known as point-compression.

You can then reconstruct the `y` by calculating `sign * sqrt(x^3+a*x+b)`.

Note that for calculations in modular fields the square root can only be calculated efficiently when the `p != 1 (mod 8)`

> **Comments:**
> **username_9**: Note that in the specific case of Bitcoin's secp256k1 curve, a = 0 and b = 7, so the formula is y^2 = x^3 + 7.  

---

### Answer by username_3 on 2014-12-22. Score: 9

You can think of the generator G as the first point after infinity on the curve. Begin with infinity and add G; the result is G. Add G to this and you get 2G. Add G to this and you get 3G. And so on. If you add G a total of `n` times (where `n` is the *order* of the curve) you will be back at infinity, where you started; the whole curve is a never-ending loop. The order `n` is how many distinct points are on the curve, or in Bitcoin terms, how many possible private keys there are (plus 1 for the point at infinity).

> **Comments:**
> **username_4**: Is the order `n` that you're referring to the same as the `finite field` in the context of the discrete log problem?  

---

### Answer by username_1 on 2017-07-05. Score: 6

The value of

G(compressed) = 02 79BE667E F9DCBBAC 55A06295 CE870B07 029BFCDB 2DCE28D9 59F2815B 16F81798

and

G(uncompressed) = 04 79BE667E F9DCBBAC 55A06295 CE870B07 029BFCDB 2DCE28D9 59F2815B 16F81798 483ADA77 26A3C465 5DA4FBFC 0E1108A8 FD17B448 A6855419 9C47D08F FB10D4B8

source: <https://en.bitcoin.it/wiki/Secp256k1>

> **Comments:**
> **username_2**: This is a potentially useful answer, but it could be improved by adding a little more explanation.  
> **username_1**: Yes.. Uncompressed G has 2 co-ordinates X and Y since it is point on the curve and its size is 520 bits(65 Bytes) i.e 256 bits for each co-ordinate And it has a prefix 04 , While Compressed G has only one co-ordinate i.e.X And a prefix either 02 when Y co-ordinate is positive or 03 when Y co-ordinate is Negative.  

---

### Answer by username_5 on 2016-09-17. Score: 3

Starting with a private key in the form of a randomly generated number k, we multiply
it by a predetermined point on the curve called the generator point G to produce another
point somewhere else on the curve, which is the corresponding public key K. The generator point is specified as part of the secp256k1 standard and is always the same for all
keys in bitcoin:
K = k \*G
where k is the private key, G is the generator point, and K is the resulting public key, a
point on the curve. Because the generator point is always the same for all bitcoin users,a private key k multiplied with G will always result in the same public key K. The rela‐
tionship between k and K is fixed, but can only be calculated in one direction, from k
to K. That’s why a bitcoin address (derived from K) can be shared with anyone and does
not reveal the user’s private key (k).

from the Book "Mastering Bitcoin" by Andreas Antonopoulos
<http://uplib.fr/w/images/8/83/Mastering_Bitcoin-Antonopoulos.pdf>


---

### Answer by username_6 on 2020-08-18. Score: 0

Ok first and foremost people no offense but your both just a little off on your thoughts of how it is supposed to be understood. The fact is that {y^2=x^3+ax+b} = n order h= base point G 02/03 in compressed format and 04 in uncompressed. 04 was to show the whole uncompressed key (X^3, Y^2). The understanding of the compression is that the 02 is even and the 03 is odd for X. But in order to so called get your private key back if lost (because the public key is not supposed to be shared hence the reason for the ripemd and md5 versions). Simply put in an easier understanding for most. X*X*X+7=Y*Y so the cubic sqrt of x generates the x and the sqrt of Y generates the Y of the random number that was began with because this is a graph either way around. Meaning function(x,y)=(x) random number. So from the beginning when you use a random number in the curve it is a point on the Elliptic curve in elliptic curve cryptoGRAPHy so a X and Y coordinate comes from your random number that is entered into the equation x*x*x+ax+b=y*y where a=0 and b=7 over a finite field which is basically a square with 0,0 : 0,1 : 1,1 : 1,0 hence the reason for the cubic function of x. Where most get confused is because of the exponents P,N,A,B,G and H being thrown in there but you must understand that the truth is those variables make up the sextuple T. Where they are pretty much constant variables except h which is either 1 or 0 to determine the outcome of G. P is the finite field 2^255-2^32-2^9-2^8-2^7-2^6-2^4-1. A=0 B=7 and N is the order mod h to determine the outcome of G. N does not change values it is the sqrt of 2^255 so basically 2^128. Trust me I know what I speak of. Although things have changed with the addition of all of the bips, HD wallets, and the various upgrades throughout the years. What I speak of is the truth. In the beginning you started out with a key that was unserialized at first which meant it was 228 bits then it was serialized which gave you a shorter key that was your Eckey(elliptic curve key) meaning your random number that your public key would be derived from following the math I have laid before you. It would calculate your public key, a signature, and a new private key if needed. But of course with everyone thinking they know best and using programs to manipulate keys to their benefit, or because they think theirs is better, the differences from the beginning are astounding. Just saying.... Hope this clears up things a lot better for you guys. If you don't believe me right now just know at some point in the future you will understand why my knowledge on this subject is so confident.

> **Comments:**
> **username_7**: You should edit that to at least have some paragraphs/formatting - walls of texts are hard to digest in the best of times, and even harder when explaining crypto  

---

