Abstract. A common claim in the cryptographic community and in publications related to Bitcoin authorship claims is that the secp256k1 curve, for certain (“hidden”) prime moduli, becomes supersingular, has a Frobenius trace of t=0, and has an embedding degree of k=2, making it vulnerable to MOV reduction. This paper provides a formal cryptanalytic analysis of this claim: it provides a precise definition of supersingularity, calculates the actual embedding degree of secp256k1, analyzes the mechanism of the Menezes–Okamoto–Vanstone MOV attack, and, using published mathematical data, demonstrates that the claim of secp256k1 supersingularity is not supported by calculations and belongs to the category of cryptographic pseudoscientific myths. Historical parallels are also considered—legal and scientific episodes in which similar theses were put forward and refuted by the professional community.
1. Statement of the problem and origin of the thesis
The claim of “seven supersingular curves over hidden primes” is one of a class of claims that have appeared in arguments attempting to prove special mathematical properties of the secp256k1 curve used in the Bitcoin protocol. These claims gained prominence in connection with Craig Steven Wright’s public claim to authorship of Bitcoin, which included claims about the applicability of bilinear pairings to secp256k1. The cryptographic community, including specialists from the BitcoinCashSV forum and independent researchers, formally verified these claims and found no attackable pairings on secp256k1 [cite:14].
A historical example. In 2019, Craig Wright presented a proof at the CoinGeek conference claiming that secp256k1 allows for bilinear pairing (pairing-friendly property). Independent cryptographers, including experts from the Bitcoin Cash SV community, analyzed the mathematical proof in detail and demonstrated that it lacked a correct calculation of the embedding degree, as well as misrepresented the definitions of supersingularity and ordinary curve [cite:14].
2. Formal definition of supersingularity of an elliptic curve
An elliptic curve E defined over a finite field F_q (q = p^n) is called supersingular if its group of points satisfies the condition:
#E(F_p) = p + 1 − t, where t ≡ 0 (mod p)
For a prime field F_p (n=1) this is equivalent to the condition t=0, that is, the curve has exactly p+1 points. Ordinary (non-supersingular) curves are characterized by t≠0 (modp). Secp256k1 is defined by the equation y² = x³+7 over the prime field F_p, where p = 2^256 − 2^32 − 977 A direct calculation of the order of secp256k1 gives #E(F_p) = n, where n is a 256-bit prime, and n≠p+1, which immediately rules out the supersingularity condition t=0 [cite:2][cite:9].
A historical example. The study “Bitcoin Security with a Twisted Edwards Curve” (HAL, University of Caen Normandy) explicitly states: “#secp256k1(F_p1) = n1 ≠ p1 + 1”, directly refuting the supersingularity hypothesis for the standard parameters of the curve [cite:2].
3. Embedding degree secp256k1: calculation and interpretation
The embedding degree k of a curve with respect to its principal prime divisor of order n is defined as the smallest natural number for which:
n | (p^k − 1)
For supersingular curves, Menezes, Okamoto, and Vanstone (1993) showed that k is always bounded above by a small number: k ≤ 6 for field characteristics other than 2 and 3. For secp256k1, the embedding degree is of the order of n itself—that is, comparable in size to a 256-bit number—making the field F_{p^k} astronomically large and unsuitable for an efficient index calculus [cite:1][cite:7].
| Parameter | Supersingular curve (hypothetical) | secp256k1 (real parameters) |
|---|---|---|
| Frobenius trace t | t ≡ 0 (mod p) | t ≠ 0, a specific 128-bit value [cite:2] |
| Embedding degree k | k ≤ 6 | k ~ n (of the order of 2^256), not pair-friendly [cite:1][cite:7] |
| Vulnerability to MOV | Yes, DLP is carried over to F_{p^k} of small power | no, transfer to an impractically large field [cite:1][cite:5] |
| SafeCurves “MOV resistance” | doesn’t work | passes [cite:1] |
4. The MOV-reduction mechanism and why it is not applicable
The Menezes–Okamoto–Vanstone attack uses a Weyl or Tate bilinear map e: E[n] × E[n] → F_{p^k}* with the property e(rP, sQ) = e(P,Q)^{rs}. This allows one to transfer the discrete logarithm problem (ECDLP) on a curve to the discrete logarithm problem in the multiplicative group of a finite field, where subexponential index calculus algorithms are applicable. A key condition for the attack to be successful is the smallness of the embedding degree k; for k comparable to the group size, the resulting field F_{p^k} is too large, and the index calculus does not provide a gain relative to Pollard’s rho algorithm on the original curve [cite:5][cite:12].
A real historical precedent for the MOV attack. The original paper by Menezes, Okamoto, and Vanstone, “Reducing Elliptic Curve Logarithms to Logarithms in a Finite Field” (1993), demonstrated the practical applicability of the method specifically to supersingular curves, which were then considered promising for bipairing cryptography. This discovery led to the de facto exclusion of supersingular curves from classical (non-pairing) elliptic curve cryptography and formed the basis of a separate field—pairing-based cryptography (IBE Boneh–Franklin et al.), where the small embedding degree is used constructively rather than as a vulnerability [cite:5][cite:12].
5. Why the “hidden primes” thesis fails to stand up to scrutiny
The parameters of secp256k1 are defined by the SEC 2 (Standards for Efficient Cryptography) standard and are completely public and deterministic: p, a=0, b=7, the base point G, and the order n are fixed and reproducible by any researcher. The generation formula p = 2^256 − 2^32 − 977 is a special kind of “Solinas prime” chosen for the efficiency of modular reduction, and not a hidden or arbitrarily chosen value [cite:9]. The hypothesis of the existence of alternative “hidden” prime moduli for which the curve acquires t=0 and k=2 contradicts the very definition of secp256k1 as a curve with fixed public parameters: changing p changes the curve itself, turning it into a different, non-standardized object that has no relation to the cryptography actually used in Bitcoin.
Critical remark: Even if we hypothetically choose an arbitrary prime modulus p’ for which the curve y²=x³+7 over F_{p’} turns out to be supersingular, this has no bearing on Bitcoin’s security, since the network uses strictly fixed secp256k1 parameters, not an arbitrary family of modules. Conflating “the existence of supersingular curves in principle” with “secp256k1 is supersingular” is a logical fallacy of substituting the object of analysis.
6. Historical Parallels: Pseudoscientific Attacks on Cryptocurrency Primitives
Claims of “hidden backdoors” in cryptographic curves have a long history and are not limited to secp256k1. In 2013–2014, Bitcoin Core developers including Wladimir van der Laan publicly commented on Satoshi Nakamoto’s choice of the Koblitz-based secp256k1 curve over the NIST-based secp256r1 curve, noting that secp256r1 was generated with opaque NSA (“seed”) parameters, whereas secp256k1’s parameters are deterministically derived and leave no room for hidden backdoors [cite:10].
Example: the Dual EC DRBG case. Unlike the secp256k1 hypothesis, a real and documented case of cryptographic backdoor exploitation is the Dual_EC_DRBG pseudorandom number generator (NIST SP 800-90A, 2006), in which, in 2007, Microsoft researchers (Dan Shumov and Nils Ferguson) publicly demonstrated the existence of parameters allowing the NSA to reconstruct the generator’s internal state. This is an established fact, confirmed by Snowden documents, unlike the unproven secp256k1 hypothesis, illustrating the difference between a valid cryptanalytic discovery and an unproven thesis.
Example: attack on Bitcoin wallets with k=1 (2023). In 2023, a real cryptanalytic success was recorded against ECDLP on a 130-bit subset of secp256k1 (Bitcoin Puzzle #130) using Pollard’s “kangaroo” method using GPU clusters, requiring about 2^65 operations—this confirms that the only practical attack method on secp256k1 is generic algorithms against the full 256-bit group order, not MOV reduction [cite:1].
7. Attacks that are actually applicable to j=0 curves (including secp256k1)
Although the supersingularity conjecture is false, secp256k1 does have a peculiarity related to the j-invariant j=0 (a consequence of a=0 in the Weierstrass equation): the presence of an effective endomorphism (GLV endomorphism) that speeds up scalar multiplication, but also speeds up Pollard’s rho attack by about a factor of √2. The study “Degenerate Fault Attacks on Elliptic Curve Parameters” (IACR ePrint 2019/400) shows that curves with j=0, including secp256k1, are particularly vulnerable to fault injection attacks that reduce key recovery to solving a single quadratic equation—but this is a side-channel vulnerability of the implementation, not a structural weakness of the curve itself [cite:4].
| Attack type | Applicability to secp256k1 | Source of threat |
|---|---|---|
| MOV reduction (Weyl pairs) | Not applicable – embedding degree is huge [cite:1][cite:5] | Hypothetical, not confirmed |
| Pohlig–Hellman | Not applicable – n prime [cite:1] | Group structure |
| GLV-accelerated Pollard rho | Applicable, acceleration ~√2 [cite:11] | Endomorphism j=0 |
| Fault injection (j=0 degenerate) | Applicable with physical access to the device [cite:4] | Implementation, not math, is crooked |
| Small-subgroup / invalid curve | Requires no validation point [cite:1] | Library implementation |
8. Methodological analysis: why the “seven curves” thesis is structurally flawed
The formulation of the problem assumes the existence of a family of seven “hidden” prime moduli, the substitution of which yields t=0 and k=2 simultaneously. For a supersingular curve over F_p (p>3), there is only one value t=0, and this condition is not parameterized by a “choice of seven” at all—it is either satisfied for a given (p, a, b) or not. Embedding degree k=2 for a supersingular curve means that n divides p²−1—a direct check for the official secp256k1 modulus shows that this condition is not satisfied, making the entire construct of “seven supersingular secp256k1 modules” a mathematically incorrect description of a non-existent object [cite:1][cite:12].
9. Conclusion of the cryptanalytic examination
A set of formal calculations of the group order, Frobenius trace, and embedding degree, confirmed by independent academic and industrial sources (SafeCurves, CoinFabrik, HAL, NCC Group), clearly shows that the secp256k1 curve used in Bitcoin is not supersingular, has t ≠ 0, and an embedding degree comparable in magnitude to the order of the group itself, which rules out the practical applicability of MOV reduction. The only documented attack vectors against secp256k1 are related to generic discrete logarithm algorithms, side-channel and fault injections, and incorrect validation of input points – but not to pairing-based methods [cite:1][cite:4][cite:8]. The thesis about “seven supersingular curves over hidden primes” should be classified as an unproven and mathematically untenable hypothesis, characteristic of the pseudoscientific genre of “proofs of Bitcoin vulnerability” that periodically arises in disputes about the authorship of the cryptocurrency.