<blockquote>
<p>I want to change the margin of the elliptic curve to the new N value, while doing so I want to keep the parameters Standard G-point Generator Secp256k1</p>
</blockquote>
<p>What do you mean by &quot;margin&quot;?</p>
<p>What you're asking for is a contradiction. The generator order N is a property of the curve and its generator. It is not something that can be chosen independently.</p>
<p>It is the answer to the question &quot;After how many times adding the generator to itself do I end up with the point at infinity&quot;. It is completely determined by the curve equation (Y^2=X^3+7 for secp256k1) and the generator (which must be on that curve). N is computed using Schoof's algorithm.</p>
<p>If you want N to be different, you will need to pick a different generator. In the case of secp256k1, where the curve order is prime, every point has the same order, so another choice won't help (except the point at infinity, which by definition has order 1).</p>
<p>So, if you want a system where the generator order is the N value you desire, you'll need a different curve as well. Finding a curve which admits a generator with a specific order is a very nontrivial problem. I don't know of any generic way of doing so.</p>
<blockquote>
<p>to the new value: N = 115792089237316195423570985008687907853269978629958289035461602417822422574827</p>
</blockquote>
<p>Where does that number come from? Does it have some special properties that make you believe a curve with that order should exist?</p>
<blockquote>
<p>For the calculation, I use a Python script: but in the end I get the same result as in the standard Secp256k1 parameters</p>
</blockquote>
<p>This is completely expected, as you're not using N in the computation (nor can you). You're just computing generator+generator.</p>

CC BY-SA 4.0
2020-10-09T22:10:15.800Z
2020-10-09T22:41:44.860Z
2020-10-09T22:41:44.860Z
Pieter Wuille
<p>The elliptic curve is secp256k1: y<sup>2</sup> = x<sup>3</sup> + 7 (mod p)</p>
<p>where the field size is</p>
<p><code>p = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F</code>.</p>
<p>The curve order of secp256k1 is:</p>
<p><code>n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141</code></p>
<p>The public key P (point) is calculated by multiplying the private key d (scalar) by the generator point G (point) where</p>
<p>P = d (mod n).G</p>
<p>The n (N) you state is not the field size p, it is the curve order</p>
<p><code>n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141</code></p>
<p>This curve order n is such that nG = <a href="https://bitcoin.stackexchange.com/questions/95209/elliptic-curve-point-at-infinity">point at infinity</a>. This is a property of the curve and cannot be changed.</p>
<p>Thanks to Pieter Wuille for the corrections.</p>

CC BY-SA 4.0
2020-10-09T22:36:56.220Z
Ok sorry. I think that's at least not inaccurate now.
Michael Folkson
CC BY-SA 4.0
2020-10-09T22:39:43.627Z
Yeah, looks better now!
Pieter Wuille
CC BY-SA 4.0
2020-10-09T19:49:15.657Z
2020-10-09T22:44:24.223Z
2020-10-09T22:44:24.223Z
Michael Folkson
<p>I want to change the margin of the elliptic curve to the new N value, while doing so I want to keep the parameters Standard G-point Generator Secp256k1 that is, I want to replace: <code>N = 115792089237316195423570985008687907852837564279074904382605163141518161494337</code></p>
<p>to the new value: <code>N = 115792089237316195423570985008687907853269978629958289035461602417822422574827</code></p>
<p>leave the Secp256k1 parameters:</p>
<pre><code>Gx = 55066263022277343669578718895168534326250603453777594175500187360389116729240
Gy = 32670510020758816978083085130507043184471273380659243275938904335757337482424

P = 115792089237316195423570985008687907853269984665640564039457584007908834671663
</code></pre>
<p>For the calculation, I use a Python script:
but in the end I get the same result as in the standard Secp256k1 parameters</p>
<p>that is, with <em>Private key 2</em>, I get</p>
<pre><code>Public Key:
04C6047F9441ED7D6D3045406E95C07CD85C778E4B8CEF3CA7ABAC09B95C709EE51AE168FEA63DC339A3C58419466CEAEEF7F632653266D0E1236431A950CFE52A
Public Key (compressed):
02C6047F9441ED7D6D3045406E95C07CD85C778E4B8CEF3CA7ABAC09B95C709EE5
</code></pre>
<p>the result is the same as in the field <code>N = 115792089237316195423570985008687907852837564279074904382605163141518161494337</code></p>
<p>What exactly am I doing wrong because I have set a new field? <code>N = 115792089237316195423570985008687907853269978629958289035461602417822422574827</code></p>
<p>What needs to be changed so that as a result the Public Key is different from the standard Secp256k1 parameters?</p>
<p><em>Code :</em></p>
<pre><code>Pcurve = 2**256 - 2**32 - 2**9 - 2**8 - 2**7 - 2**6 - 2**4 -1 # The proven prime
Acurve = 0; Bcurve = 7 # These two defines the elliptic curve. y^2 = x^3 + Acurve * x + Bcurve
Gx = 55066263022277343669578718895168534326250603453777594175500187360389116729240
Gy = 32670510020758816978083085130507043184471273380659243275938904335757337482424
GPoint = (Gx,Gy) # Generator Point

N = 115792089237316195423570985008687907853269978629958289035461602417822422574827
privKey = 2

def modinv(a,b=Pcurve): #Extended Euclidean Algorithm/'division' in elliptic curves
    lm, hm = 1,0
    low, high = a%b,b
    while low &gt; 1:
        ratio = high/low
        nm, new = hm-lm*ratio, high-low*ratio
        lm, low, hm, high = nm, new, lm, low
    return lm % b

def ECAdd(a,b): # Point addition, invented for EC.
    LambdaAdd = ((b[1] - a[1]) * modinv(b[0] - a[0],Pcurve)) % Pcurve
    x = (LambdaAdd * LambdaAdd - a[0] - b[0]) % Pcurve
    y = (LambdaAdd * (a[0] - x) - a[1]) % Pcurve
    return (x,y)

def ECDouble(a): # Point Doubling, also invented for EC.
    LamdaDouble = ((3 * a[0] * a[0] + Acurve) * modinv((2 * a[1]), Pcurve)) % Pcurve
    x = (LamdaDouble * LamdaDouble - 2 * a[0]) % Pcurve
    y = (LamdaDouble * (a[0] - x) - a[1]) % Pcurve
    return (x,y)

def ECMultiply(GenPoint,privKeyHex): #Double &amp; add. Not true multiplication
    if privKeyHex == 0 or privKeyHex &gt;= N: raise Exception(&quot;Invalid Private Key&quot;)
    privKeyBin = str(bin(privKeyHex))[2:]
    Q=GenPoint
    for i in range (1, len(privKeyBin)):
        Q=ECDouble(Q);
        if privKeyBin[i] == &quot;1&quot;:
            Q=ECAdd(Q,GenPoint);
    return (Q)

publicKey = ECMultiply(GPoint,privKey)
print &quot;Private Key:&quot;;
print privKey; print
print &quot;Public Key (uncompressed):&quot;;
print publicKey; print
print &quot;Public Key (compressed):&quot;;
if publicKey[1] % 2 == 1: # If the Y coordinate of the Public Key is odd.
    print &quot;03&quot;+str(hex(publicKey[0])[2:-1]).zfill(64)
else: # If the Y coordinate is even.
    print &quot;02&quot;+str(hex(publicKey[0])[2:-1]).zfill(64)
</code></pre>

<private-key><public-key><cryptography><secp256k1>
How to change the field of the elliptic curve to the new value N while keeping the default Secp256k1 parameters?
Izi Tors
# How to change the field of the elliptic curve to the new value N while keeping the default Secp256k1 parameters?

(Asked by: username_0 on 2020-10-09)

I want to change the margin of the elliptic curve to the new N value, while doing so I want to keep the parameters Standard G-point Generator Secp256k1 that is, I want to replace: `N = 115792089237316195423570985008687907852837564279074904382605163141518161494337`

to the new value: `N = 115792089237316195423570985008687907853269978629958289035461602417822422574827`

leave the Secp256k1 parameters:

```
Gx = 55066263022277343669578718895168534326250603453777594175500187360389116729240
Gy = 32670510020758816978083085130507043184471273380659243275938904335757337482424

P = 115792089237316195423570985008687907853269984665640564039457584007908834671663

```

For the calculation, I use a Python script:
but in the end I get the same result as in the standard Secp256k1 parameters

that is, with *Private key 2*, I get

```
Public Key:
04C6047F9441ED7D6D3045406E95C07CD85C778E4B8CEF3CA7ABAC09B95C709EE51AE168FEA63DC339A3C58419466CEAEEF7F632653266D0E1236431A950CFE52A
Public Key (compressed):
02C6047F9441ED7D6D3045406E95C07CD85C778E4B8CEF3CA7ABAC09B95C709EE5

```

the result is the same as in the field `N = 115792089237316195423570985008687907852837564279074904382605163141518161494337`

What exactly am I doing wrong because I have set a new field? `N = 115792089237316195423570985008687907853269978629958289035461602417822422574827`

What needs to be changed so that as a result the Public Key is different from the standard Secp256k1 parameters?

*Code :*

```
Pcurve = 2**256 - 2**32 - 2**9 - 2**8 - 2**7 - 2**6 - 2**4 -1 # The proven prime
Acurve = 0; Bcurve = 7 # These two defines the elliptic curve. y^2 = x^3 + Acurve * x + Bcurve
Gx = 55066263022277343669578718895168534326250603453777594175500187360389116729240
Gy = 32670510020758816978083085130507043184471273380659243275938904335757337482424
GPoint = (Gx,Gy) # Generator Point

N = 115792089237316195423570985008687907853269978629958289035461602417822422574827
privKey = 2

def modinv(a,b=Pcurve): #Extended Euclidean Algorithm/'division' in elliptic curves
    lm, hm = 1,0
    low, high = a%b,b
    while low > 1:
        ratio = high/low
        nm, new = hm-lm*ratio, high-low*ratio
        lm, low, hm, high = nm, new, lm, low
    return lm % b

def ECAdd(a,b): # Point addition, invented for EC.
    LambdaAdd = ((b[1] - a[1]) * modinv(b[0] - a[0],Pcurve)) % Pcurve
    x = (LambdaAdd * LambdaAdd - a[0] - b[0]) % Pcurve
    y = (LambdaAdd * (a[0] - x) - a[1]) % Pcurve
    return (x,y)

def ECDouble(a): # Point Doubling, also invented for EC.
    LamdaDouble = ((3 * a[0] * a[0] + Acurve) * modinv((2 * a[1]), Pcurve)) % Pcurve
    x = (LamdaDouble * LamdaDouble - 2 * a[0]) % Pcurve
    y = (LamdaDouble * (a[0] - x) - a[1]) % Pcurve
    return (x,y)

def ECMultiply(GenPoint,privKeyHex): #Double & add. Not true multiplication
    if privKeyHex == 0 or privKeyHex >= N: raise Exception("Invalid Private Key")
    privKeyBin = str(bin(privKeyHex))[2:]
    Q=GenPoint
    for i in range (1, len(privKeyBin)):
        Q=ECDouble(Q);
        if privKeyBin[i] == "1":
            Q=ECAdd(Q,GenPoint);
    return (Q)

publicKey = ECMultiply(GPoint,privKey)
print "Private Key:";
print privKey; print
print "Public Key (uncompressed):";
print publicKey; print
print "Public Key (compressed):";
if publicKey[1] % 2 == 1: # If the Y coordinate of the Public Key is odd.
    print "03"+str(hex(publicKey[0])[2:-1]).zfill(64)
else: # If the Y coordinate is even.
    print "02"+str(hex(publicKey[0])[2:-1]).zfill(64)

```

**Tags:** private-key, public-key, cryptography, secp256k1


---

## 2 answers

### Answer by username_1 on 2020-10-09. Score: 3

> I want to change the margin of the elliptic curve to the new N value, while doing so I want to keep the parameters Standard G-point Generator Secp256k1

What do you mean by "margin"?

What you're asking for is a contradiction. The generator order N is a property of the curve and its generator. It is not something that can be chosen independently.

It is the answer to the question "After how many times adding the generator to itself do I end up with the point at infinity". It is completely determined by the curve equation (Y^2=X^3+7 for secp256k1) and the generator (which must be on that curve). N is computed using Schoof's algorithm.

If you want N to be different, you will need to pick a different generator. In the case of secp256k1, where the curve order is prime, every point has the same order, so another choice won't help (except the point at infinity, which by definition has order 1).

So, if you want a system where the generator order is the N value you desire, you'll need a different curve as well. Finding a curve which admits a generator with a specific order is a very nontrivial problem. I don't know of any generic way of doing so.

> to the new value: N = 115792089237316195423570985008687907853269978629958289035461602417822422574827

Where does that number come from? Does it have some special properties that make you believe a curve with that order should exist?

> For the calculation, I use a Python script: but in the end I get the same result as in the standard Secp256k1 parameters

This is completely expected, as you're not using N in the computation (nor can you). You're just computing generator+generator.


---

### Answer by username_2 on 2020-10-09. Score: 2

The elliptic curve is secp256k1: y2 = x3 + 7 (mod p)

where the field size is

`p = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F`.

The curve order of secp256k1 is:

`n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141`

The public key P (point) is calculated by multiplying the private key d (scalar) by the generator point G (point) where

P = d (mod n).G

The n (N) you state is not the field size p, it is the curve order

`n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141`

This curve order n is such that nG = [point at infinity](https://bitcoin.stackexchange.com/questions/95209/elliptic-curve-point-at-infinity). This is a property of the curve and cannot be changed.

Thanks to username_1 username_1 for the corrections.

> **Comments:**
> **username_2**: Ok sorry. I think that's at least not inaccurate now.  
> **username_1**: Yeah, looks better now!  

---

