<p>The order of G is the number of time you will have to add G to get a point at infinity. You start at G, then add G you get 2G. If you add G a total of <code>n</code> times, you will get a point at infinity. This order <code>n</code> will tell you how many times you can add G before you reach infinity or how many distinct points are there on the curve.</p>

CC BY-SA 4.0
2019-03-18T21:45:42.230Z
While correct, this is not how the number of points on the curve is computed (counting to 2^256 is rather infeasible).
Pieter Wuille
CC BY-SA 4.0
2019-03-18T22:43:06.540Z
True. I tried to provide more of a qualitative commentary around that.
Ugam Kamat
CC BY-SA 4.0
2019-03-18T21:00:47.290Z
2019-03-18T21:00:47.290Z
Ugam Kamat
<p>It's easy to verify the order (n):  Multiply G by n and find that you get the point at infinity. This proves that n is either the order or a multiple of it. Then convince yourself n is prime using a <a href="https://en.wikipedia.org/wiki/Baillie%E2%80%93PSW_primality_test" rel="nofollow noreferrer">Baillie-PSW</a> primality test, so it must be the order itself and not a multiple of it.</p>

<p>Finding the order is not quite so simple as verifying it. To do so you would use <a href="https://en.wikipedia.org/wiki/Schoof%27s_algorithm" rel="nofollow noreferrer">Schoof's_algorithm</a>, which requires quite a bit of number-theory complexity. The Wikipedia article on Schoof's explains how Hasse's theorem is critical to this process by restricting the range of orders that could possibly be the correct one.</p>

CC BY-SA 4.0
2019-03-19T04:02:36.757Z
2019-03-19T04:02:36.757Z
G. Maxwell
<p>Hi I was just wondering how the order of the generator point G used in bitcoin was actually calculated.</p>

<p>From the specification listed <a href="http://www.secg.org/SEC2-Ver-1.0.pdf" rel="nofollow noreferrer">http://www.secg.org/SEC2-Ver-1.0.pdf</a> for secp256k1 I can see listed is the generator point G along with its order, however I am unsure how this was actually calculated.</p>

<p>In one of the books I was looking through it was mentioned that Hasse's Theorem was used to calculate this value, however upon looking up this theorem this seems to only provide a bound. Any insight would be appreicated thanks :)</p>

CC BY-SA 4.0
2019-03-18T21:36:21.837Z
What you're looking for is Schoof's algorithm.
Pieter Wuille
<cryptography><ecdsa><schnorr-signatures>
The order of the generator point G used in bitcoin
Matt
# The order of the generator point G used in bitcoin

(Asked by: username_0 on 2019-03-18)

Hi I was just wondering how the order of the generator point G used in bitcoin was actually calculated.

From the specification listed <http://www.secg.org/SEC2-Ver-1.0.pdf> for secp256k1 I can see listed is the generator point G along with its order, however I am unsure how this was actually calculated.

In one of the books I was looking through it was mentioned that Hasse's Theorem was used to calculate this value, however upon looking up this theorem this seems to only provide a bound. Any insight would be appreicated thanks :)

**Tags:** cryptography, ecdsa, schnorr-signatures

> **Comments:**
> **username_1**: What you're looking for is Schoof's algorithm.  

---

## 2 answers

### Answer by username_3 on 2019-03-19. Score: 4 | Accepted answer

It's easy to verify the order (n): Multiply G by n and find that you get the point at infinity. This proves that n is either the order or a multiple of it. Then convince yourself n is prime using a [Baillie-PSW](https://en.wikipedia.org/wiki/Baillie%E2%80%93PSW_primality_test) primality test, so it must be the order itself and not a multiple of it.

Finding the order is not quite so simple as verifying it. To do so you would use [Schoof's\_algorithm](https://en.wikipedia.org/wiki/Schoof%27s_algorithm), which requires quite a bit of number-theory complexity. The Wikipedia article on Schoof's explains how Hasse's theorem is critical to this process by restricting the range of orders that could possibly be the correct one.


---

### Answer by username_2 on 2019-03-18. Score: 0

The order of G is the number of time you will have to add G to get a point at infinity. You start at G, then add G you get 2G. If you add G a total of `n` times, you will get a point at infinity. This order `n` will tell you how many times you can add G before you reach infinity or how many distinct points are there on the curve.

> **Comments:**
> **username_1**: While correct, this is not how the number of points on the curve is computed (counting to 2^256 is rather infeasible).  
> **username_2**: True. I tried to provide more of a qualitative commentary around that.  

---

