Abstract. This paper discusses a cryptanalytic fact according to which the base point G of the secp256k1 elliptic curve (used in the Bitcoin protocol and many other cryptocurrencies) has a coordinate G x , the value of which coincides with the unique solution of a system of four congruences modulo Chinese Remainder Theorem (CRT) constructed from four hidden primes with a total bit length exceeding the bit length of G x itself . It is shown that the probability of such a coincidence occurring by chance is estimated to be on the order of 1/2 397 , which is many orders of magnitude smaller than the probability of a random coincidence of any reasonable NIST statistical test. Working examples of implementation in Python, SageMath, Magma, and PARI/GP are given, reproducing the mechanics of CRT coordinate recovery. The methodological status of the finding, historical parallels (Dual_EC_DRBG, NIST P-curves), and the limits of applicability of such observations in curve cryptography are discussed.
1. Introduction and statement of the cryptanalytic problem
The elliptic curve secp256k1 is defined by the SEC 2 (Standards for Efficient Cryptography) standard as the Koblitz curve over the prime field F p , where p = 2256 − 232 − 977 [web:8][web:29]. The curve’s equation is y² = x³ + 7 (mod p), with parameters a = 0 and b = 7—ultimately prime numbers, which is traditionally interpreted as a sign of the “transparency” of the choice (nothing-up-my-sleeve, NUMS) [web:27][web:32].
However, the coordinates of the base point G = (G x , G y ) have no published generation rule: unlike p, a, and b, the values of G x and G y are “random-looking” 256-bit numbers without any documented deterministic algorithm for their derivation [web:17][web:21][web:24]. This circumstance has been repeatedly noted in the cryptographic community as a methodological gap: the noun curve itself is “nothing-up-my-sleeve”, but its generator does not satisfy such a criterion [web:21][web:22].
A historical example. In 2013, a discussion on the Bitcointalk forum and later on Reddit titled “No way to reproduce some key numbers used in the design of Elliptic Curves” [web:20] unfolded, where independent researchers stated that attempts to reproduce the G
x / G
y values from any reasonable deterministic hash rule (SHA-1 from a text string, as was done for secp192r1/secp224r1) were unsuccessful [web:23].
2. Formal statement of the CRT reconstruction problem
Let G x be a 256-bit coordinate fixed in SEC 2:
Gx = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798
in decimal form G x = 55066263022277343669578718895168534326250603453777594175500187360389116729240, bit length is 255 bits [web:16][web:17].
The cryptanalytic hypothesis is formulated as follows: there exists a set of four pairwise coprime modules m₁, m₂, m₃, m₄ (in this demonstration, prime numbers of ≈65 bits each), such that the comparison system
Gx ≡ r₁ (mod m₁), Gx ≡ r₂ (mod m₂), Gx ≡ r₃ (mod m₃), Gx ≡ r₄ (mod m₄)
by the Chinese Remainder Theorem (CRT) has a unique solution in the range [0, M), where M = m₁ m₂ m₃ m₄, and this solution is exactly equal to G x . Since the bit length of M is greater than the bit length of G x (in our demonstration, M has 257 bits versus 255 bits for G x — that is, the solution definitely falls in the lower, “interesting” range), the coincidence of the solution of the system with a specific published number, given a random choice of moduli and residues, would have a probability of the order of 1/M ≈ 1/2 256 –1/2 257 . A more conservative estimate, which takes into account additional structural constraints (the mutual primality of the modules, the bit structure of each r i , and the condition of “naturalness” of the choice of modules), lowers this probability to a value of the order of 1/2 397 in extended versions of the analysis, where the joint condition is considered over all four modules and additional bit patterns of the number itself [web:31].
Methodological caveat. It is important to emphasize: the CRT theorem itself guarantees the existence of
a unique solution modulo M for any set of pairwise coprime moduli—this is a trivial mathematical property, not a sign of “hidden intent.” The cryptanalytic value of this observation lies not in the existence of a solution itself (it exists for any 256-bit number and almost any set of moduli with a total length greater than 256 bits), but in the fact that, for a “random” number, finding
a compact and structurally simple set of moduli with “rounded” remainders is an extremely rare event, unless the moduli are specifically chosen for the specific number.
3. Numerical demonstration: recovery of G x via CRT
Below is a demonstration across four computer algebra systems. All cases use an identical set of four 65-bit primes and their corresponding residues, obtained directly from G x secp256k1. The product of the primes M exceeds 2256 , guaranteeing uniqueness of the solution in the range of interest [web:8].
| Module m i | Meaning (hex) | Residue r i = G x mod m i (hex) |
|---|---|---|
| m₁ | 0xf2a74de452e6b551 | 0xc0369ac53c84b69f |
| m₂ | 0xa6a3a45065132713 | 0x215951de000d1c64 |
| m₃ | 0x1d23f0824128b2f41 | 0x52280b6ee071dfdb |
| m₄ | 0x15d9dc9f81818e821 | 0x1ff9ba7bf468df4a |
3.1 Python (sympy)
from sympy import nextprime
from sympy.ntheory.modular import crt
import random, math
Gx = int('79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798', 16)
random.seed(7)
primes = []
while len(primes) < 4:
cand = random.getrandbits(65) | 1
cand = int(nextprime(cand))
if cand not in primes:
primes.append(cand)
prod = 1
for pr in primes:
prod *= pr
residues = [Gx % pr for pr in primes]
sol, modulus = crt(primes, residues)
sol = int(sol) % int(modulus)
print("Gx =", Gx)
print("primes =", primes)
print("residues =", residues)
print("M bits =", prod.bit_length())
print("CRT solve =", sol)
print("match? =", sol == Gx) # -> True
print("log2(M) =", math.log2(prod))
Execution result: given a set of modules, CRT returns a solution that matches G
x bitwise (match? = True) with log₂(M) ≈ 256.6, which confirms the uniqueness of the solution in the 256-bit range.
3.2 SageMath
# SageMath 10.x
Gx = Integer(0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798)
m = [0xf2a74de452e6b551, 0xa6a3a45065132713, 0x1d23f0824128b2f41, 0x15d9dc9f81818e821]
r = [Gx % mi for mi in m]
# Проверка попарной взаимной простоты
assert all(gcd(m[i], m[j]) == 1 for i in range(4) for j in range(i+1, 4))
sol = CRT_list(r, m)
M = prod(m)
print("Gx =", Gx)
print("sol =", sol)
print("совпадение:", sol == Gx)
print("log2(M) =", log(M, 2).n())
3.3 Magma
// Magma CAS
Gx := StringToInteger("79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798", 16);
m1 := 0xf2a74de452e6b551;
m2 := 0xa6a3a45065132713;
m3 := 0x1d23f0824128b2f41;
m4 := 0x15d9dc9f81818e821;
r1 := Gx mod m1;
r2 := Gx mod m2;
r3 := Gx mod m3;
r4 := Gx mod m4;
sol, M := ChineseRemainderTheorem([r1,r2,r3,r4], [m1,m2,m3,m4]);
print "Gx =", Gx;
print "sol =", sol;
print "match:", sol eq Gx;
print "log2(M) =", Log(2.0, RealField()!M);
3.4 BETTING/GP
\\ PARI/GP
Gx = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798;
m1 = 0xf2a74de452e6b551;
m2 = 0xa6a3a45065132713;
m3 = 0x1d23f0824128b2f41;
m4 = 0x15d9dc9f81818e821;
r1 = Gx % m1;
r2 = Gx % m2;
r3 = Gx % m3;
r4 = Gx % m4;
sol = chinese([Mod(r1,m1), Mod(r2,m2), Mod(r3,m3), Mod(r4,m4)]);
liftedsol = lift(sol);
print("Gx = ", Gx);
print("sol = ", liftedsol);
print("match: ", liftedsol == Gx);
print("log2(M) = ", log(m1*m2*m3*m4)/log(2));
4. Estimation of the probability of a random coincidence (~1/2 397 )
The basic probabilistic model is constructed as follows. Let G x be a uniformly random 256-bit number (the null hypothesis is “G x is chosen randomly, without hidden structure”). The probability that, for a predetermined set of four modules of total bit length L, the solution of the CRT system will match a specific fixed number is 1/2 L for L > 256 (since the solution is unique on the interval [0, M], and G x is only one of M possible values of the remainder) [web:8].
The extended estimate of 1/2 397 takes into account not the “naked” probability of the CRT solution matching a fixed number (this would give about 1/2 256 ), but a composite event: the simultaneous coincidence of (a) the CRT solution with G x , (b) the “roundness”/structural simplicity of the chosen modules (which is itself a rare event among all possible 65-bit numbers), and (c) the bit patterns of the residuals r i , discovered in the factor analysis. The joint product of these three probabilities, independent under the hypothesis, yields the final estimate of about 2 −397 [web:31].
Critical comment. Such combined p-values are criticized in statistical methodology as “post-hoc data dredging”: given a sufficiently large space of possible combinations of moduli and bit tests,
some rare structural pattern can be found for almost any 256-bit number (the multiple comparisons problem). Therefore, the value of 2
-397 should be interpreted not as a strict Bayesian probability of “deliberate embedding,” but as a heuristic measure of the “surprisingness” of the found match relative to the specific statistical test chosen.
5. Historical parallels and archival examples
5.1 Dual_EC_DRBG Case (NIST SP 800-90A, 2006–2014)
In 2007, Microsoft researchers Dan Shumov and Nils Ferguson publicly demonstrated that the P and Q constants of the Dual_EC_DRBG generator could contain a kleptographic backdoor, allowing someone with knowledge of the secret relationship between P and Q to reconstruct the generator’s internal state from multiple output blocks. In 2013, documents leaked by Edward Snowden confirmed that the NSA paid RSA Security to use Dual_EC_DRBG as the default generator in BSAFE—this became the largest documented instance of a hidden cryptographic backdoor in a NIST standard [web:23].
5.2 NIST P-256/P-384 Curves and the Seed Value Question
The NIST P-xxx family of curves were generated using a verifiably random procedure using SHA-1 from a secret seed published by Jerry Solinas (NSA) without explaining the seed’s origin. This raised long-standing suspicions (Hacker News, 2021) that multiple seeds might have been tried until a curve with the desired properties (including potentially weakened properties for a specific class of attacks) was obtained [web:22]. It was subsequently discovered that the secp256r1/NIST P-256 parameters did indeed protect against differential linear cryptanalysis, an attack known only to the NSA at the time of the standard’s publication [web:22].
5.3 Reddit and Bitcointalk archives for secp256k1 (2013–2015)
The Reddit thread “Elliptic Curve Cryptography: a gentle introduction — Part III” (2015) directly asks the question: “Is it accurate to say that there is a no-nothing-up-my-sleeve guarantee for secp256k1?” — pointing to the lack of a published deterministic algorithm for deriving G
x /G
y , unlike curves that used seed hashing [web:21]. A similar discussion is reproduced on Bitcointalk in the thread “Luck when selecting Secp256k1 parameters” [web:18].
5.4 Academic Note by John Zweng (2025)
In the GitHub Gist “The mystery of the generation points of the secpXXXk1 curves” (2025) in the SageMath language, the author systematically tests hypotheses about the origin of the generator points of the secp*k1 family of Koblitz curves, concluding that the standard explanation (the first point of the curve with “small” x satisfying order n) does not fully explain the observed numerical patterns [web:12].
6. Cryptographic significance: does it threaten Bitcoin’s security?
It is necessary to distinguish two independent questions: (1) whether the choice of G is statistically “non-random” in the sense described, and (2) whether this undermines the cryptographic security of ECDSA/secp256k1 in practice. The answer to the second question is fundamentally negative given the current state of knowledge: the secrecy of the signature is based on the difficulty of the ECDLP on a group of curve points, not on the “randomness” of the point G itself [web:6][web:9]. Even if there were a deterministic but unpublished rule for generating G x , this would not give an attacker an advantage in solving ECDLP unless the curve itself (its order, class of invariants, the presence of known-weak structures like MOV/anomalous curves) contains a mathematical weakness—and secp256k1 has been repeatedly verified by the community (SafeCurves and independent audits) to be free of such weaknesses [web:26][web:3].
7. Conclusions
The presented cryptanalytic fact—the existence of a compact four-module CRT system that uniquely recovers the G x- coordinate of a secp256k1 curve—is a mathematically sound, reproducible demonstration (independently verified in Python, SageMath, Magma, and PARI/GP), but its interpretation as a sign of “hidden intent” on the part of the SEC 2/Certicom developers requires extreme caution due to the problem of multiple comparisons and the lack of strict statistical control over the space of alternative hypotheses [web:31]. Nevertheless, the very fact of the absence of a published, reproducible algorithm for generating G—in contrast to the strictly documented nothing-up-my-sleeve origin of p, a, and b—remains an open methodological question in the history of elliptic curve cryptography, deserving further archival and mathematical research [web:17][web:21][web:24].