secp256k1 — Bitcoin's Curve

Full parameters:

p  = 2^256 - 2^32 - 977
a  = 0
b  = 7
G  = (
    0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798,
    0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8
)
n  = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
h  = 1

n is the order of G — multiplying G by n gives ∞. All scalars are mod n.

Why secp256k1?

• Koblitz curve (a=0, b=7) admits efficient endomorphism for fast scalar mul.
• 128-bit symmetric security level.
• Used by Bitcoin, Ethereum, Lightning, dozens of crypto protocols.

Compare to P-256:

• P-256 has random a,b chosen by NIST. Some folks distrust the constants.
• secp256k1 has structure (a=0, b=7), arguably less suspicious.

Cryptographic primitives needed:

• SHA-256 (the hash inside ECDSA on Bitcoin).
• Keccak-256 (Ethereum uses different hash function).

Public key from private:

Pubkey is a point — 64 bytes uncompressed (x||y), or 33 bytes compressed (sign of y || x).

Compressed encoding:

Decoding requires square root mod p — solvable via pow(v, (p+1)//4, p) for p ≡ 3 mod 4 (which secp256k1 is).