<p>You're right, there is no strict requirement that the private key is strictly less than the group order.</p>

<p>However, it is required that the resulting public key is uniform, which implies that (x % n) must be uniformly distributed between 1 and n-1 inclusive (or at least indistinguishably close to uniform). The easiest way to accomplish this is by saying that the private key must be picked directly uniformly between its bounds. However, you could just as well say you pick a private key uniformly between 1 and 1337*n-1 (except no multiple of n).</p>

<p>To elaborate on "indistinguishably close to uniform": specifically for the secp256k1 curve (which is used in Bitcoin's signatures), the curve order is very close to 2^256, and in general you won't ever generate a 256-bit number that is >= n. This is not the case for all elliptic curves however, and biasing private keys can actually threaten security.</p>

CC BY-SA 4.0
2019-03-27T00:12:38.773Z
For size, n is approximately 2^32 shy of 2^256
Claris
CC BY-SA 4.0
2019-03-27T00:19:01.977Z
@Anonymous That's the field size. The group order is around 2^256 - 1.27*2^128.
Pieter Wuille
CC BY-SA 4.0
2019-03-26T18:23:50.660Z
2019-03-26T18:23:50.660Z
Pieter Wuille
<p>I read that the private key <strong>pk</strong> has to be any number between 1 and <em>n</em>, where <em>n</em> is almost 10^77.
Since <strong>pk</strong>' s function is practically to be used as a scalar for multiplying the generator point <em>G</em>, why does it have to be strictly less than <em>n</em>?</p>

<p>I've thought that is because the math behind secp256k: 
inside a order-<em>n</em> group, if I multiply times x a number <em>A</em> (with x > <em>n</em>), it's equivalent to multiply the same number <em>A</em> times y, with y =  x % n. So y will be extremely less than x, making <em>A</em> easier to be discovered.
Is this argument correct?</p>

<security><private-key><cryptography><secp256k1>
Private key generation doubt
dcfg
# Private key generation doubt

(Asked by: username_0 on 2019-03-26)

I read that the private key **pk** has to be any number between 1 and *n*, where *n* is almost 10^77.
Since **pk**' s function is practically to be used as a scalar for multiplying the generator point *G*, why does it have to be strictly less than *n*?

I've thought that is because the math behind secp256k:
inside a order-*n* group, if I multiply times x a number *A* (with x > *n*), it's equivalent to multiply the same number *A* times y, with y = x % n. So y will be extremely less than x, making *A* easier to be discovered.
Is this argument correct?

**Tags:** security, private-key, cryptography, secp256k1


---

## 1 answers

### Answer by username_1 on 2019-03-26. Score: 7 | Accepted answer

You're right, there is no strict requirement that the private key is strictly less than the group order.

However, it is required that the resulting public key is uniform, which implies that (x % n) must be uniformly distributed between 1 and n-1 inclusive (or at least indistinguishably close to uniform). The easiest way to accomplish this is by saying that the private key must be picked directly uniformly between its bounds. However, you could just as well say you pick a private key uniformly between 1 and 1337\*n-1 (except no multiple of n).

To elaborate on "indistinguishably close to uniform": specifically for the secp256k1 curve (which is used in Bitcoin's signatures), the curve order is very close to 2^256, and in general you won't ever generate a 256-bit number that is >= n. This is not the case for all elliptic curves however, and biasing private keys can actually threaten security.

> **Comments:**
> **username_2**: For size, n is approximately 2^32 shy of 2^256  
> **username_1**: @Anonymous That's the field size. The group order is around 2^256 - 1.27*2^128.  

---

