Scientific analytical article.  Basis: SECG Standard SEC 2, Version 2.0, Certicom Corp., January 27, 2010; the key object of analysis is §2.4.1 “Recommended Parameters secp256k1”.

Annotation

This article systematizes the content of  the SEC 2: Recommended Elliptic Curve Domain Parameters standard  and examines in detail the parameters of the secp256k1 curve over a prime field. It is shown that its practical security relies on the computational difficulty of the elliptic curve discrete logarithm problem (ECDLP), while real-world compromises typically arise not from “curve cracking” but from repeated or predictable nonces, side-channel leaks, point verification errors, and key management flaws.

Keywords:  SEC 2, secp256k1, ECDLP, ECDSA, Schnorr, GLV, Pollard rho, nonce, Bitcoin, cryptanalysis.

Regulatory Context of SEC 2

SEC 2 specifies a set of recommended domain-specific ECC parameters for implementing SEC 1 and the compatible mechanisms of ANSI X9.62, ANSI X9.63, and IEEE 1363. The main body of the document is divided into parameters over simple fields  F_p (Section 2) and over binary fields  F_{2^m} (Section 3); Appendix A defines ASN.1 identification and OIDs, and Appendix B contains a bibliography.

SEC Category 2	Content	Cryptographic value
§1	Purpose, compatibility, document life cycle, intellectual property	Fixed parameters improve cross-implementation compatibility.
§2	Curves over  F_p: 192, 224, 256, 384 and 521 bits	This is where secp256k1 is defined.
§3	Curves over  F_{2^m}: 163–571 bits	Separate arithmetic model and polynomial bases.
Appendix A	ASN.1 and object identifiers	Critical for certificates, protocols, and unambiguous serialization.
Appendix B	Normative and research references	Links parameters to SEC 1, ANSI, IEEE, and ECC research.

Parameter model over Fp

For a curve over a prime field, SEC 2 uses a sextuple  T=(p,a,b,G,n,h): the field modulus, the equation coefficients, the base point, its prime order, and the cofactor. For secp256k1, the field size is 256 bits, and the classical security level stated in the SEC 2 table is approximately 128 bits.

LaTeX: \[T=(p,a,b,G,n,h),\qquad E: y^2 \equiv x^3+ax+b\pmod p.\]

The name  secp256k1 is read as:  sec — Standards for Efficient Cryptography,  p — prime field,  256 — bit length of the modulus,  k — parameters assigned by SEC 2 to the Koblitz/endomorphic curve class,  1 — ordinal number.

Official secp256k1 parameters

In §2.4.1, SEC 2 defines secp256k1 as a curve with  a=0 and  b=7 over a field with prime modulus  p=2^256-2^32-977. It is important not to confuse the field modulus  p, over which coordinate arithmetic is performed, with the subgroup order  n, over which secret scalars and ECDSA/Schnorr values ​​are derived.

Component	Meaning	Purpose
p	FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F 2^256-2^32-977	Simple field module  F_p.
a	0	Weierstrass short form coefficient.
b	7	Weierstrass short form coefficient.
G_x	79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798	X-coordinate of the generator.
G_y	483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8	Y-coordinate of the generator.
G, compressed	0279BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798	The prefix  02 encodes parity  y.
n	FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141	Simple point order  G.
h	1	Cofactor; the entire group of points has order  n.

LaTeX: \[E(\mathbb F_p):\quad y^2\equiv x^3+7\pmod p,\qquad p=2^{256}-2^{32}-977.\]

LaTeX: \[G=(G_x,G_y),\qquad \langle G angle=E(\mathbb F_p),\qquad \#\langle G angle=n,\qquad h=1.\]

Group arithmetic

The set of points on the curve, together with the point at infinity,  O forms an Abelian group. The public key is obtained as  Q=dG, where the private scalar is chosen in the range  1 ≤ d ≤ n−1; the inverse recovery  d from  G and  Q is ECDLP.

LaTeX: \[Q=dG,\qquad d\in\{1,\ldots,n-1\}.\]

For various points  P=(x_1,y_1),  R=(x_2,y_2) the  x_1 e x_2 slope of the chord is  λ=(y_2-y_1)(x_2-x_1)^{-1} mod p; then the coordinates of the sum are calculated. Doubling uses the tangent; these formulas are the mathematical basis, but secure implementations typically use projective coordinates to avoid costly inversions.

LaTeX: \[\lambda=(y_2-y_1)(x_2-x_1)^{-1}\pmod p,\quad x_3=\lambda^2-x_1-x_2\pmod p,\quad y_3=\lambda(x_1-x_3)-y_1\pmod p.\]

LaTeX: \[\lambda=(3x_1^2+a)(2y_1)^{-1}\pmod p\quad ext{for }P=R;\quad a=0 ext{ for secp256k1}.\]

Code: Parameter check

The following training fragment verifies that the generator satisfies the curve equation and that its stated order yields a point at infinity. It is intended for auditing and reproducible experiments, not for storing real secret keys.

p = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F
n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
G = (
    0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798,
    0x483ADA7726A3C4655DA4FBFC0E1108A8FD17B448A68554199C47D08FFB10D4B8,
)

assert (G[1] * G[1] - (G[0] * G[0] * G[0] + 7)) % p == 0
# После реализации add() и scalar_mul():
# assert scalar_mul(n, G) is None  # None представляет точку O

A historical example:  An error in transcribing even one hexadecimal digit in  p,  n or ,  G creates an incompatible cryptosystem, not “almost secp256k1.” Therefore, parameters should be loaded from a verifiable specification or a mature library, rather than manually retyped from third-party sources.

Why is this a Koblitz curve?

In SEC 2, the term “Koblitz” for curves over prime fields is extended to include curves with an efficiently computable endomorphism. For secp256k1, this structure allows decomposing scalar multiplication into two approximately 128-bit components (GLV decomposition), which is useful for high-performance implementations.

LaTeX: \[ arphi(x,y)=( eta x mod p,y),\qquad arphi(P)=\lambda P,\qquad k\equiv k_1+\lambda k_2\pmod n.\]

Therefore, the computation  kP can be transformed into a shared computation  k_1P+k_2φ(P). This is not a hidden key or a vulnerability in itself: the endomorphism is public, mathematically verifiable, and applies symmetrically to both defender and attacker.

Cryptanalytic fact

The basic problem for attacking an arbitrary public key is to find  d from the equality  Q=dG. The best general classical approach, applicable without additional information about the key, is the Pollard rho family of methods with a cost of order  O(sqrt(n)), that is, about 128 bits of work for a subgroup of order approximately  2^256.

LaTeX: \[\operatorname{ECDLP}:\quad Q=dG\;\Longrightarrow\;d\;?\]

LaTeX: \[\mathrm{Work}_{ ho} pprox 0.886\sqrt n pprox 2^{127.8} ext{ group operations}.\]

The secp256k1 endomorphism can be used to significantly speed up the rho attack when factoring by symmetries, but it doesn’t turn it into a polynomial algorithm or eliminate the exponential scaling. In practical terms, this reduces the key reserve by approximately a few bits, but doesn’t open the way to extracting keys from regular Bitcoin addresses.

Toy illustration of rho

On a small training group, a collision in the sequence  X_i=a_iG+b_iQ allows one to recover the discrete logarithm; on secp256k1, the same idea is unsuitable for brute-force attack due to the size of  n. The code below intentionally only works on a small demonstration group and is not intended as an attack on real keys.

# Схема извлечения после коллизии X_i = X_j:
# (a_i-a_j)G + (b_i-b_j)Q = O, Q=dG
# d = (a_j-a_i) * inverse(b_i-b_j, n) mod n
# Формула корректна, если b_i != b_j (mod n).

An example from cryptanalytic practice.  Pollard rho methods are actually applicable to small training subgroups, weakened key spaces, and erroneously reduced scalar ranges. They cannot be interpreted as a practical way to brute-force a correctly generated 256-bit secret key secp256k1.

Signatures and the Real Attack Surface

In ECDSA over secp256k1 , the signature uses a one-time secret nonce  k. For the hash of the message, represented by the value  z, and the private  d key  R=kG,  r=x_R mod n… s=k^{-1}(z+rd) mod n

LaTeX: \[R=kG,\qquad r=x_R mod n,\qquad s=k^{-1}(z+rd) mod n.\]

If the same nonce is applied to two different messages with the same key, the private key is recovered algebraically. It is this class of failures, not ECDLP, that has historically led to signature compromises: widely known nonce duplication errors in the Sony PlayStation 3 signature system and insufficient entropy incidents in early Android Bitcoin wallets.

LaTeX: \[k=(z_1-z_2)(s_1-s_2)^{-1} mod n,\qquad d=(s_1k-z_1)r^{-1} mod n.\]

Practical requirement:  It cannot be generated  k using a regular PRNG, reused, or revealed through logging, memory dumps, or timings. Deterministic nonces according to RFC 6979 or modern schemes with protected aux-entropy are preferred; the library must run in constant time where necessary.

Code: Secure Validation Logic

# Псевдокод аудита ECDSA-подписи:
# 1. Проверить 1 <= r,s < n.
# 2. Проверить, что Q — не O, координаты в F_p и Q лежит на кривой.
# 3. Проверить nQ = O (для общего случая критично против invalid-curve/subgroup атак).
# 4. Вычислить w=s^{-1} mod n, u1=zw mod n, u2=rw mod n.
# 5. Проверить r == x(u1G + u2Q) mod n.
# Для secp256k1 h=1, но входные точки всё равно надо валидировать.

A historical example:  nonce repetition in the PS3 allowed the signature key to be recovered from multiple signed messages; this illustrates the fundamental principle: flawless ECC parameters do not compensate for protocol implementation errors.

Validation, serialization, compatibility

SEC 2 specifies both compressed and uncompressed representations of the base point. For Weierstrass short form, the compressed format  x also contains one bit, selecting one of two possible roots  y; for  G secp256k1, the prefix  02 specifies even  G_y.

In modern Bitcoin implementations, BIP340 defines Schnorr signatures over secp256k1 and uses 32-byte x-only public keys: a point with an even coordinate is chosen  y. This is an example of how the immutable domain parameters of SEC 2 continue to be used in the new protocol layer, although the encoding and signing rules change.

Limitations and modern assessment

SEC 2 is a 2010 document; its tables reflect the strength levels and standards ecosystem of the time. For new designs, all listed sizes cannot be automatically assumed to be equally relevant: 192- and 224-bit variants should not be selected for new systems with a modern security horizon, and compliance should be verified against the current profiles of the applicable regulator and protocol.

For secp256k1, the classical 128-bit bound remains meaningful when implemented correctly, but Shor’s quantum algorithm theoretically solves ECDLP in polynomial time on a sufficiently large fault-tolerant quantum computer. This property is not a defect of secp256k1, but rather a property of the family of classical public-key schemes based on discrete logarithms.

Recommendations to the auditor

• Check  p,a,b,G,n,h with the original SEC 2 source and test  G for curve fit.
• Distinguish between mod arithmetic  p for coordinates and mod  arithmetic n for scalars.
• Use proven implementations, constant execution time, and secure storage of secret scalars.
• Eliminate nonce repetition, implement verifiable generation and monitor for anomalous signatures.
• Validate external public keys and endpoints before performing sensitive operations.
• Don’t call GLV a “hack”: it’s a known algebraic structure with limited constant impact on general attacks.

Conclusion

secp256k1 in SEC 2 is a well-defined 256-bit curve over a prime field with prime base subgroup order and cofactor 1. Its risk profile is determined not only by ECDLP, but primarily by engineering discipline: correct nonce, point checking, side-channel-resistant implementation, unambiguous serialization, and key lifecycle control.

Sources

SEC 2 and secp256k1: Parameters, Cryptanalysis and Engineering Security: https://paypix.ru/sec-2-and-secp256k1-parameters-cryptanalysis-and-engineering-security/

1. Standards for Efficient Cryptography Group.  SEC 2: Recommended Elliptic Curve Domain Parameters , Version 2.0, 27 January 2010, §2.1, §2.4.1, Appendix A. URL:  https://www.secg.org/sec2-v2.pdf .
2. Bitcoin Improvement Proposal 340.  Schnorr Signatures for secp256k1 . URL:  https://bitcoin.org/bip/340/ .
3. Gallant, Lambert, Vanstone.  Faster Point Multiplication on Elliptic Curves with Efficient Endomorphisms , CRYPTO 2001.
4. Pollard, J. M.  Monte Carlo Methods for Index Computation (mod p) , Mathematics of Computation, 1978.
5. RFC 6979.  Deterministic Usage of the Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA) .