so #bitcoiner this is a short thread about #secp256k1 (just for my own sake. Warning!!! it might even contains some mistake, still rumping up)
#Bitcoin uses secp256k1 for signing/verifying transaction via ECDSA
#Bitcoin uses secp256k1 for signing/verifying transaction via ECDSA
secp256k1 was originally specified in STANDARDS FOR EFFICIENT CRYPTOGRAPHY by Certicom Research
It is a Koblitz curve (but not a Koblitz binary anomalous curve) defined by the short Weistrass equation y^2=x^3+7.
It is a Koblitz curve (but not a Koblitz binary anomalous curve) defined by the short Weistrass equation y^2=x^3+7.
There is an endomorphism (GLV endomorphism) that can be used to speed up multiplications (different than the Frobenius endomorphism in the binary case) that is turned off by default.
In order to allow the GLV endomorphism the CM discriminant need to be low (hence why secp256k1 is listened as "dangerous" in safecurves.cr.yp.to).The j-invariant of secp256k1 is equal to zero hence has also a sextic twist that turns out to be kind of weak (thanks @pbarreto)
