Henri Cohen, Karim Belabas et al.; Université de Bordeaux; PARI/GP 2.15+.

Annotation

The PARI/GP elliptic curve subsystem is considered as an environment for precise number-theoretic computations: model initialization, point arithmetic, order determination, reductions, invariants, local data, formal groups, isogenies, and analytic-modular functions. The central application scenario is independent verification of the parameters and points  secp256k1used by Bitcoin: checking membership, equality  [n]G=O, non-minority, and public key consistency with scalar multiplication.

Keywords:  PARI/GP, elliptic curve, secp256k1, ECDLP, ECDSA, Bitcoin, point order, modular forms, Frobenius trace, SEA.

Setting and boundaries

PARI/GP operates on the general Weierstrass model

\[y^2+a_1xy+a_3y=x^3+a_2x^2+a_4x+a_6,\qquad \Delta\ne0.\]

For a cryptographic curve over a prime field, the short form is usually used

\[E(\mathbb F_p):\quad y^2\equiv x^3+ax+b\pmod p.\]

This article describes the research and auditing role of PARI/GP. It is not a replacement for constant-time libraries in production: the GP interpreter and its high-level operations should not be used to process sensitive scalars in an online service.

Leadership Map

Documentation category	Key tools	Cryptanalytic value
Structures and fields	ellinit, invariants b_i,c_i,disc,j	Model, discriminant, and computation domain checking
Group arithmetic	elladd,  ellsub,  ellneg,  ellmul, ellorder	ECDSA/ECDH implementation tests, order and subgroup checks
Finite fields and reduction	ellcard,  ellap,  ellgroup, ellsea	Group structure audit, analysis of small/abnormal curves
Isomorphisms and isogenies	ellminimalmodel,  ellchangecurve,  ellisogeny, ellisomat	Normalization of models, study of equivalent curves
Divisions and pairings	elldivpol, ellweilpairing	Torsion, control of conditions of pairing-based attacks
Formal and p-adic theory	ellformallog,  ellformalexp, ellpadic*	Local analysis and learning experiments with vulnerable classes
Modularity and L-functions	ellak,  ellan,  ellL1,  ellanalyticrank, ellbsd	The relationship between local traces, new forms of weight 2, and global arithmetic

ellinit: computation model

ellinit Builds an internal structure  ell from coefficients and, if necessary, fields. Expensive components are cached lazily; the documentation explicitly states that the internal structure layout cannot be used as a programming interface.

? p = 2^256 - 2^32 - 977;
? E = ellinit([0,7], p); \\ y^2 = x^3 + 7 over F_p
? E.disc
? Ej

For the short form, the discriminant is

\[\Delta=-16(4a^3+27b^2).\]

For secp256k1  a=0,  b=7, is therefore  \Delta=-16\cdot27\cdot7^2 non-zero in absolute value  p; hence, the curve is non-singular.

Archival context

The standardized parameters of secp256k1 are defined by SEC 2: prime field, coefficients, base point, order, and cofactor. This published set allows any researcher to reproduce the proof without trusting a specific wallet or network node.

ellmul, ellorder and the group law

The point of infinity in PARI/GP is represented as  [0]. The operation  ellmul(E,P,k) computes  [k]P, and  ellorder(E,P) returns the smallest positive  rsuch that  [r]P=O.

\[\operatorname{ord}(P)=\min\{r>0:[r]P=\mathcal O\}.\]

For ECDSA, the private key is  d\in[1,n-1], and the public key is  Q=[d]G. The difficulty of recovering  d from  G,Q is the elliptic curve discrete logarithm problem (ECDLP), not the computation problem  ellmul.

? p = 2^256 - 2^32 - 977;
? n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141;
? gx = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798;
? gy = 0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8;
? E = ellinit([0,7], p); G = [Mod(gx,p), Mod(gy,p)];
? ellisoncurve(E,G)
% = 1
? ellmul(E,G,n)
% = [0]
? ellorder(E,G)
% = 115792089237316195423570985008687907852837564279074904382605163141518161494337

Practical implications.  For secp256k1, the base point order is equal to the published prime  n, and the cofactor is  h=1. Equality  [n]G=O is a necessary test of the correctness of the domain parameters; it does not reveal the private key and does not weaken ECDLP.

A historical cryptanalytic example

Nonce duplication incidents in ECDSA demonstrate that the practical risk often lies not in the ECDLP solution, but in faulty randomness generation. If two signatures use the same  k, then  s=k^{-1}(z+rd)\bmod n a linear equation is derived from , and  k, then ,  is recovered d. PARI/GP is useful for testing algebra on training or your own test data, but should not be applied to other people’s keys without permission.

Verification secp256k1

The SEC 2 parameters specify  p=2^256-2^32-977, curve  y^2=x^3+7, base point  G, prime  n , and  h=1. The script below verifies fundamental assertions sufficient to independently reproduce the parameters.

\\ Complete self-test of secp256k1 parameters
p = 2^256 - 2^32 - 977;
n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141;
gx = 0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798;
gy = 0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8;
E = ellinit([0,7], p);
G = [Mod(gx,p), Mod(gy,p)];
print(ellisoncurve(E,G)); \\ 1
print(isprime(n)); \\ 1
print(ellmul(E,G,n)); \\ [0]
print(ellmul(E,G,n-1)); \\ -G, not [0]
Q = ellmul(E,G,2);
print(ellisoncurve(E,Q)); \\ 1

For an external public key,  Q the minimum verification protocol is: correctly parse the encoding; ensure that the coordinates lie in  [0,p-1]; verify the curve equation; exclude the infinity point; verify  [n]Q=O. For ,  h=1 the entire non-zero secp256k1 group has order  n, but explicit verification is useful for universal code and protection against domain spoofing.

Finite fields and reductions

ellap calculates the Frobenius trace  t, and  ellcard is the number of points:

\[#E(\mathbb F_q)=q+1-t.\]

ellgroup describes a finite Abelian group and  ellgenerators returns generators with qualifications for the non-cyclic case. For large characteristics, the manual recommends using SEA; for CM curves, a special fast formula is available.

? e = ellinit([0,1]);
? ellap(e,7)
% = -4
? ellcard(e,7)
% = 12
? ellgroup(e,7)
% = [6.2]

Cryptanalytic meaning

Point counting is a basic procedure when searching for secure curves and when auditing a non-standard domain. If the order contains small factors or the curve is anomalous  #E(\mathbb F_p)=p, special attacks are possible; therefore, confidence in secp256k1 cannot be generalized to any arbitrary “similar” curve.

Divisions, torsions and isogenies

elldivpol(E,m) constructs an m-divisible polynomial; its roots are related to the coordinates of the m-torsion points.  ellisogeny,  ellisomat and  ellisotree provide tools for studying isogenies, and  ellchangecurve and  ellminimalmodel are controlled model replacements.

? E = ellinit([0,7], 101);
? elldivpol(E,3)
? ellgroup(E)
? ellminimalmodel(ellinit([0,0,0,-25,4]))

In real-world audits, these tools are used to detect incorrect cofactor logic, small subgroup points, and ambiguities during transfers between coordinate systems. However, isogeny alone does not make secp256k1 practically hackable: common DLP transfer algorithms between isogenous curves do not provide a shortcut to private keys under standard parameters.

Formal groups and p-adics

The functions  ellformalpoint,  ellformalw,  ellformallog,  ellformalexp and  ellformaldifferential implement a local expansion at infinity. The formal logarithm transforms the formal group operation into an additive one:

\[L(P\oplus Q)=L(P)+L(Q),\qquad \operatorname{Exp}(L(P))=P.\]

? E = ellinit([-1,1/4]);
? L = ellformallog(E,9,'t)
? Exp = ellformalexp(E,10,'z)
? subst(Exp,z,L) \\ t + O(t^...)

Historically, p-adic methods have been particularly important for special classes of vulnerable curves—for example, anomalous ones—and for local structure analysis. Their presence in PARI/GP makes the system a useful research laboratory, but correctly determining the applicability of an attack requires strict adherence to its assumptions.

Modular forms and L-functions

The guide relates rational elliptic curves to new forms of weight 2:  ellak(E,n) it calculates the coefficient  a_n,  ellan(E,N) is the initial fragment of the series, and  ellL1 explores  ellanalyticrank the L-function for  s=1.

\[L(E,s)=\prod_{p\,\mathrm{bad}}(1-a_pp^{-s})^{-1}\prod_{p\,\mathrm{good}}(1-a_pp^{-s}+p^{1-2s})^{-1}.\]

? E = ellinit("11a1"); \\ requires the elldata package
? ellak(E,10)
? ellan(E,20)
?ellanalyticrank(E)
? ellL1(E)

This is not a cryptographic API, but an important bridge between local quantities  a_p, the group of rational points, and analytic theory. The functions  ellbsd,  ellglobalred,  elllocalred, periods, and quasi-periods support computational verifications of objects related to the Birch-Swinnerton-Dyer conjecture.

Limitations and audit methodology

• Record the PARI/GP version, source parameters, number format and output log.
• Work in a precise field  F_p: use  ellinit([a,b],p) coordinates as well  Mod(x,p).
• Separate the membership check, the dot order check, the group order check, and the public key encoding check.
• Do not interpret successful execution  [n]Q=O as proof of possession of the secret or the correctness of the ECDSA signature.
• Do not perform cryptanalytic operations against someone else’s keys, addresses, or signatures without explicit legal permission.
• For production, use proven constant-time implementations; reserve PARI/GP for offline verification, replication, and research.

Conclusion

The PARI/GP elliptic curve subsystem combines computational arithmetic geometry and applied ECC checking. In the context of secp256k1, the functions  ellinit, ,  ellmul and  ellorder form a compact, reproducible core for domain and point validation; modular, local, and p-adic functions extend it to a serious number-theoretic analysis environment.

Sources

PARI/GP Manual: Elliptic Curves Functions and Modular Forms: https://cryptoinside.ru/pari-gp-manual-elliptic-curves-functions-and-modular-forms/

1. PARI/GP Development Team.  Catalogue of GP/PARI Functions: Elliptic Curves , PARI/GP documentation, branch 2.15+.
2. Standards for Efficient Cryptography Group.  SEC 2: Recommended Elliptic Curve Domain Parameters , Version 2.0, 2010.
3. H. Cohen, K. Belabas et al.  PARI/GP documentation . Université de Bordeaux.