Primes and Field Choice

ECDSA is parameterized by a curve, which is parameterized by a prime p (or extension field for binary curves). Choosing p well matters:

• Must be prime (or a prime power).
• Must be large (≥ 256 bits for modern security).
• Some primes admit faster modular reduction than generic Barrett reduction.

P-256 (NIST): p = 2^256 − 2^224 + 2^192 + 2^96 − 1.

secp256k1 (Bitcoin): p = 2^256 − 2^32 − 977.

These shapes allow optimized reduction: split a 512-bit product into 256-bit high/low halves, multiply by powers-of-two corrections. Avoids the cost of Barrett or Montgomery reduction.

Curve order n is also typically prime (for cofactor 1 curves like secp256k1). Sub-group attacks happen if n has small factors.

Curve-fitting matters too:

• Twist security: protect against attacks via the twist of the curve.
• Cofactor: small h, ideally 1.
• Constant-time-friendly: arithmetic doesn't branch on secrets.

Python:

We don't roll our own primes for production. We use standardized curves: secp256k1 (Bitcoin/Ethereum), P-256 (TLS, banking), Curve25519/Ed25519 (modern best).