<p>n is the number of points on the curve (including the point at infinity). Private keys are numbers between 1 and n-1, inclusive. 0 is not a valid private key, because its corresponding point would be the point at infinity.</p>
<p>If you'd naively try to compute the public key corresponding to private key d and private key d+n, you'd obtain the same public keys. That means the public key for private key n would also be infinity (same as for private key 0).</p>
<p>For this reason, private keys are restricted to range 1 to n-1: that guarantees that for every non-infinity point on the curve there is exactly one private key.</p>

CC BY-SA 4.0
2022-02-19T19:13:13.223Z
2022-02-19T19:13:13.223Z
Pieter Wuille
<p>Yes, the order of an elliptic curve group gives the number of points in that group and <em>n</em> is the <em>order</em> of secp256k1. If an addition were to result in something larger than the group's order, you apply <em>n</em> as a modulo, and the result lands back within the order.
It follows that the private key <em>n+5</em> is effectively the same as the private key <em>5</em> on secp256k1.</p>
<p>For example, while operating in the natural numbers ℕ we know that 13 + 15 = 28. But if we do the same addition on the field ℤ<sub>17</sub> (which is limited via <em>mod 17</em>), the same addition would result in 13 + 15 = 11 (28 mod 17). Likewise, you'd get 16 + 16 + 16 = 14 (48 mod 17) in ℤ<sub>17</sub>.</p>
<p>As <a href="https://bitcoin.stackexchange.com/a/112510/5406">Pieter</a> points out, the private key <em>0</em> is not valid as it produces the neutral element on secp256k1, the point at infinity.</p>
<p>You may also be interested in this <a href="https://bitcoin.stackexchange.com/a/21911/5406">explanation</a> what secp256k1 looks like.</p>

CC BY-SA 4.0
2022-02-19T18:35:47.937Z
2022-02-19T19:14:42.773Z
2022-02-19T19:14:42.773Z
Murch
<p>If you pick a key &gt; N it will map to another key in the (0, N) range. For example N + 100 is the exact same private key as 100 for all effects and purposes. That's how <a href="https://en.wikipedia.org/wiki/Modular_arithmetic" rel="nofollow noreferrer">modular arithmetic</a> works</p>

CC BY-SA 4.0
2022-02-19T16:29:25.760Z
2022-02-19T16:29:25.760Z
Mike D
<p>I am reading about <a href="https://en.bitcoin.it/wiki/Secp256k1#:%7E:text=n%20%3D%20FFFFFFFF%20FFFFFFFF%20FFFFFFFF%20FFFFFFFE%20BAAEDCE6%20AF48A03B%20BFD25E8C%20D0364141" rel="nofollow noreferrer">ECDSA</a>, and I find that the private key must be in <code>(0,n)</code>, with <code>n = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141</code>.</p>
<p>Is <code>n</code> the total number of points on the secp256k1 curve? (plus the 0 point)</p>
<p>And how does <code>n</code> limit the range of private keys?</p>
<p>What if a private key is bigger than <code>n</code>?</p>

CC BY-SA 4.0
2022-02-20T03:15:42.813Z
If you choose privatekey values by a uniform random method as you are supposed to, and if there are one billion bitcoin users each doing one thousand keys every second (around the clock), you'll get d>=n once in about 4,000,000,000,000,000,000 years -- or in other words, not in this universe, and you'll have to live through millions or billions more entire universes to get a single occurrence.
dave_thompson_085
<private-key><ecdsa><secp256k1><math>
Why do private keys have a range limit?
KHJUAF403456ZS3K564WAEF
# Why do private keys have a range limit?

(Asked by: username_0 on 2022-02-19)

I am reading about [ECDSA](https://en.bitcoin.it/wiki/Secp256k1#:%7E:text=n%20%3D%20FFFFFFFF%20FFFFFFFF%20FFFFFFFF%20FFFFFFFE%20BAAEDCE6%20AF48A03B%20BFD25E8C%20D0364141), and I find that the private key must be in `(0,n)`, with `n = FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141`.

Is `n` the total number of points on the secp256k1 curve? (plus the 0 point)

And how does `n` limit the range of private keys?

What if a private key is bigger than `n`?

**Tags:** private-key, ecdsa, secp256k1, math

> **Comments:**
> **username_1**: If you choose privatekey values by a uniform random method as you are supposed to, and if there are one billion bitcoin users each doing one thousand keys every second (around the clock), you'll get d>=n once in about 4,000,000,000,000,000,000 years -- or in other words, not in this universe, and you'll have to live through millions or billions more entire universes to get a single occurrence.  

---

## 3 answers

### Answer by username_2 on 2022-02-19. Score: 1

n is the number of points on the curve (including the point at infinity). Private keys are numbers between 1 and n-1, inclusive. 0 is not a valid private key, because its corresponding point would be the point at infinity.

If you'd naively try to compute the public key corresponding to private key d and private key d+n, you'd obtain the same public keys. That means the public key for private key n would also be infinity (same as for private key 0).

For this reason, private keys are restricted to range 1 to n-1: that guarantees that for every non-infinity point on the curve there is exactly one private key.


---

### Answer by username_3 on 2022-02-19. Score: 0

Yes, the order of an elliptic curve group gives the number of points in that group and *n* is the *order* of secp256k1. If an addition were to result in something larger than the group's order, you apply *n* as a modulo, and the result lands back within the order.
It follows that the private key *n+5* is effectively the same as the private key *5* on secp256k1.

For example, while operating in the natural numbers ℕ we know that 13 + 15 = 28. But if we do the same addition on the field ℤ17 (which is limited via *mod 17*), the same addition would result in 13 + 15 = 11 (28 mod 17). Likewise, you'd get 16 + 16 + 16 = 14 (48 mod 17) in ℤ17.

As [Pieter](https://bitcoin.stackexchange.com/a/112510/5406) points out, the private key *0* is not valid as it produces the neutral element on secp256k1, the point at infinity.

You may also be interested in this [explanation](https://bitcoin.stackexchange.com/a/21911/5406) what secp256k1 looks like.


---

### Answer by username_4 on 2022-02-19. Score: 0

If you pick a key > N it will map to another key in the (0, N) range. For example N + 100 is the exact same private key as 100 for all effects and purposes. That's how [modular arithmetic](https://en.wikipedia.org/wiki/Modular_arithmetic) works


---

