<story><title>Why Did Satoshi Decide to Use Secp256k1 Instead of Secp256r1?</title><url>https://dappworks.com/why-did-satoshi-decide-to-use-secp256k1-instead-of-secp256r1/</url></story><parent_chain></parent_chain><comment><author>janmo</author><text>The article basically says that Satoshi went for secp256k1 because for secp256r1 the constants were defined by the NIST under the possible influence of the NSA.&lt;p&gt;I don&amp;#x27;t think it is a good argument, I invite every one to take a look at the DES S-Box constants.
Many people believed that those were backdoor constants that the NSA planted into the algorithm as there was no explanation on how and why they were chosen.
Many years later it turned out that they were picked carefully to protect against differential-linear attacks. An attack only the NSA knew back then.
So they gave out safe S-Box constants, and all those who distrusted them and picked random&amp;#x2F;other S-Boxes were actually screwed, this is really ironic.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;S-box&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;S-box&lt;/a&gt;</text></comment>
<story><title>Why Did Satoshi Decide to Use Secp256k1 Instead of Secp256r1?</title><url>https://dappworks.com/why-did-satoshi-decide-to-use-secp256k1-instead-of-secp256r1/</url></story><parent_chain></parent_chain><comment><author>nullc</author><text>Garbage spam page.  This shouldn&amp;#x27;t be on HN.  There is a common trend for people to take highly technical subjects do a tiny amount of research and then spam up some page (often full of plagiarism) in order to add bulk to their sites.  This is especially common in the &amp;quot;defi &amp;#x2F; ico&amp;quot; fraud ecosystem.&lt;p&gt;In this case the article is so poorly researched that even though it says fairly little it manages to make outright false claims about basic facts, e.g. &amp;quot;secp256k1 is a Koblitz curve which is defined in a characteristic 2 finite field, while secp256r1 is a prime field curve&amp;quot;-- which is false, secp256k1 uses a prime field.</text></comment>