secp256k1 and secp256r1

secp256k1

• used in Bitcoin
  • all points on the curve are valid Bitcoin public keys
• chosen for Bitcoin over secp256r1 since it’s a Koblitz curve (known to be a few bits weaker than other curves)
  • has properties that make it possible to implement the group operation more efficiently
  • parameters are chosen as $a=0,b=7$, and not chosen at “random” which can provide a backdoor
• the strength of a 256-bit secp256k1 private key has the strength of 128 bits of encryption when the associated public key is exposed
• used for ECDSA Signature

secp256r1

• a.k.a. NIST P-256
• recommended by NIST until 2015, when it said quantum computing could render this curve insecure and recommended P-384 instead
• a non-Koblitz curve
• “r”: stands for random, as the parameters for the curves are meant to be chosen at random
  • but some people believe the “random” parameters chosen actually allow for a backdoor
• $a=FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC$, $b=5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B$
• RIP-7212 - Proposal to add secp256r1 precompile contract for signature verification