What Is secp256k1? Ethereum's Elliptic Curve Explained
Quick answer. secp256k1 is the elliptic curve behind Ethereum keys: y² = x³ + 7, modulo a large prime p. A public key is the private key times a shared generator point, and reversing that is practically impossible.
Elliptic curve cryptography enables everything in Ethereum, and it is notoriously hard to grasp.
This guide explains secp256k1, the curve behind every Ethereum key, step by step. It covers the curve's equation, the group of points it defines, how points are added and multiplied, and why that makes private keys safe.
It is the explanation we wish we had when we first started learning cryptography for smart contract auditing.
The secp256k1 Curve
secp256k1 is the particular elliptic curve Ethereum uses for its cryptography. If you have read Mastering Ethereum, you have already met it.
Understanding it means understanding two things: how a public key is generated from a private key, and why that gives Ethereum its security.
Sketched on an x and y plane, it has the familiar elliptic curve shape. It bulges out on the left and opens up and down to the right.
The Equation: y² = x³ + 7 mod p
The curve looks the way it does because of its equation.
y² ≡ x³ + 7 (mod p).
First, notice that y is squared. For every x that satisfies the equation, there is a positive y and a negative y that both work.
That is why the curve is a mirror image of itself across the x-axis.
Second, notice the mod p. The value of y² is congruent to x³ + 7 as a residue modulo p, which is modular arithmetic.
Without going deep into that arithmetic, the practical effect is that values do not run off forever. Past a certain point they wrap around and reappear on the other side of the curve.
Some people visualize the curve on a sphere to make that wrapping feel continuous. You do not need that picture to follow the rest.
What Is p?
p is a very large prime number, and it is one of the values that characterize secp256k1.
The curve has other characteristic values too. To describe them, you need a little group theory.
The Group of Points
secp256k1 does not really define a curve so much as a group of points that lie on the curve.
Think of it as a set of (x, y) points that satisfy the equation. Because everything is reduced modulo an extremely large prime, each coordinate is itself a very large number.
As a group, it has several properties.
- The order, n. n is the number of points defined on the curve.
- The field. Every coordinate is an integer modulo p. For group theorists, the coordinates live in the field Zp.
- n is prime. How n was calculated is beyond the scope of this guide, but the fact that it is prime matters a great deal.
Because n is prime, there is an isomorphism between the points on the curve and the numbers below n. Every number less than n is relatively prime to n, so each one maps to a point.
You do not need to know exactly what that isomorphism looks like. What matters is the consequence: very large numbers, like private and public keys, can be represented as points in the secp256k1 group.
Point Addition
Once you have a group, you can define operations over it. The integers have addition and multiplication; the points on this curve can have them too, defined however we please.
Here is how addition works for two points, A and B.
- Draw the line that passes through both A and B.
- A property of elliptic curves is that this line always meets the curve at exactly one other point.
- That third point is not the answer. Reflect it across the x-axis.
- The reflected point is A + B.
To add B again, draw the line through A + B and B, find where it meets the curve, and reflect that point. The result is another point on the curve.
Point Multiplication
Multiplication is repeated addition. To multiply a point by an integer, add the point to itself that many times, and you land on some resulting point R.
Here is the property that matters for cryptography. If you are given only R, and told it came from multiplying A, finding how many times A was added is insurmountably hard.
This is known as the elliptic curve discrete logarithm problem.
How Ethereum Builds Keys
secp256k1 defines a generator point, G. It is a common point that everybody uses.
Your private key is a number, k. Your public key is K = k × G under elliptic curve multiplication.
- k is below n, so it maps to a point in the group.
- G is the shared generator point on the curve.
- The group is closed under multiplication, so K is also a point in the group.
The public key can be shared with anybody. Only its owner knows the private key that produced it.
Why the Keys Are Secure
The security of every Ethereum account rests on that one-way multiplication. Going from k to K is easy; going from K back to k is practically impossible.
The private key is also what signs messages. A signature proves that the owner of a public key signed a given message.
Verifying a signature is easy. Working backwards from it to the private key is very hard, and the signing algorithm includes randomness that makes backtracking impossible.
That combination is what makes the system cryptographically secure: anyone can check a signature, and nobody can recover the key behind it.
Signatures have their own pitfalls in smart contracts. See signature malleability for one of the most common. For how the EVM handles everything else, see how the EVM works.
This material rarely sinks in on the first read. Work through it a few times, and draw the addition steps yourself.
How Guardian Helps
Guardian's smart contract audits review the code that holds the money, including privileged flows and integrations, with exploit-driven review and proof-of-concept depth.
Vanguard puts two independent teams on one scope, then keeps reviewing every update after launch.
Frequently Asked Questions
What does secp256k1 stand for?
It is a standardized elliptic curve, defined by y² = x³ + 7 over integers modulo a very large prime p. Ethereum uses it to turn private keys into public keys and to sign messages.
How is an Ethereum public key generated?
The private key is a number, k. It is multiplied by the curve's shared generator point G using elliptic curve multiplication, which is repeated point addition. The resulting point, K = k × G, is the public key.
Why can't someone work out a private key from a public key?
Given the result of an elliptic curve multiplication, finding the number of times the generator point was added is insurmountably hard. The signing algorithm also includes randomness, so a signature cannot be traced back to the key either.
Why does it matter that the group order n is prime?
Because n is prime, the points on the curve map one to one onto the numbers below n. That is what lets very large numbers, such as private and public keys, be represented as points in the secp256k1 group.
Sources
Get your key and signature handling reviewed
Guardian's researchers attack the contracts that hold your users' funds before attackers do.