STANDARDS FOR EFFICIENT CRYPTOGRAPHY
SEC 2: Recommended Elliptic Curve Domain Parameters
Certicom Research
Contact: Simon Blake-Wilson ( sblakewilson@certicom.com)
Minghua Qu (mqu@certicom.com)
Working Draft
October, 1999
Version 0.6
c
/AD 1999 Certicom Corp.
License to copy this document is granted provided
it is identiﬁed as “Standards for Efﬁcient Cryptography (SEC)”,
in all material mentioning or referencing it.



Contents Page i
Contents
1 Introduction 1
1 . 1 O v e r v i e w .......................................... 1
1 . 2 I n t e l l e c t u a l P r o p e r t y ..................................... 1
1 . 3 O r g a n i z a t i o n ......................................... 1
2 Recommended Elliptic Curve Domain Parameters over
/BY
p 2
2.1 Properties of Elliptic Curve Domain Parameters over /BY
p ................. 2
2.2 Recommended 112-bit Elliptic Curve Domain Parameters over /BY
p ............ 5
2.2.1 Recommended Parameters secp112r1 . . ..................... 5
2.2.2 Recommended Parameters secp112r2 . . ..................... 6
2.3 Recommended 128-bit Elliptic Curve Domain Parameters over /BY
p ............ 7
2.3.1 Recommended Parameters secp128r1 . . ..................... 7
2.3.2 Recommended Parameters secp128r2 . . ..................... 8
2.4 Recommended 160-bit Elliptic Curve Domain Parameters over /BY
p ............ 8
2.4.1 Recommended Parameters secp160k1 . . ..................... 8
2.4.2 Recommended Parameters secp160r1 . . ..................... 9
2.4.3 Recommended Parameters secp160r2 . . ..................... 1 0
2.5 Recommended 192-bit Elliptic Curve Domain Parameters over /BY
p ............ 1 0
2.5.1 Recommended Parameters secp192k1 . . ..................... 1 1
2.5.2 Recommended Parameters secp192r1 . . ..................... 1 1
2.6 Recommended 224-bit Elliptic Curve Domain Parameters over /BY
p ............ 1 2
2.6.1 Recommended Parameters secp224k1 . . ..................... 1 2
2.6.2 Recommended Parameters secp224r1 . . ..................... 1 3
2.7 Recommended 256-bit Elliptic Curve Domain Parameters over /BY
p ............ 1 3
2.7.1 Recommended Parameters secp256k1 . . ..................... 1 4
2.7.2 Recommended Parameters secp256r1 . . ..................... 1 4
2.8 Recommended 384-bit Elliptic Curve Domain Parameters over /BY
p ............ 1 5
2.8.1 Recommended Parameters secp384r1 . . ..................... 1 5
2.9 Recommended 521-bit Elliptic Curve Domain Parameters over /BY
p ............ 1 6
2.9.1 Recommended Parameters secp521r1 . . ..................... 1 7

Page ii SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 0.6
3 Recommended Elliptic Curve Domain Parameters over /BY
2m 19
3.1 Properties of Elliptic Curve Domain Parameters over /BY
2m ................. 1 9
3.2 Recommended 113-bit Elliptic Curve Domain Parameters over /BY
2m ............ 2 1
3.2.1 Recommended Parameters sect113r1 . . ..................... 2 1
3.2.2 Recommended Parameters sect113r2 . . ..................... 2 2
3.3 Recommended 131-bit Elliptic Curve Domain Parameters over /BY
2m ............ 2 3
3.3.1 Recommended Parameters sect131r1 . . ..................... 2 3
3.3.2 Recommended Parameters sect131r2 . . ..................... 2 3
3.4 Recommended 163-bit Elliptic Curve Domain Parameters over /BY
2m ............ 2 4
3.4.1 Recommended Parameters sect163k1 . . ..................... 2 4
3.4.2 Recommended Parameters sect163r1 . . ..................... 2 5
3.4.3 Recommended Parameters sect163r2 . . ..................... 2 6
3.5 Recommended 193-bit Elliptic Curve Domain Parameters over /BY
2m ............ 2 6
3.5.1 Recommended Parameters sect193r1 . . ..................... 2 6
3.5.2 Recommended Parameters sect193r2 . . ..................... 2 7
3.6 Recommended 233-bit Elliptic Curve Domain Parameters over /BY
2m ............ 2 8
3.6.1 Recommended Parameters sect233k1 . . ..................... 2 8
3.6.2 Recommended Parameters sect233r1 . . ..................... 2 9
3.7 Recommended 239-bit Elliptic Curve Domain Parameters over /BY
2m ............ 2 9
3.7.1 Recommended Parameters sect239k1 . . ..................... 3 0
3.8 Recommended 283-bit Elliptic Curve Domain Parameters over /BY
2m ............ 3 0
3.8.1 Recommended Parameters sect283k1 . . ..................... 3 0
3.8.2 Recommended Parameters sect283r1 . . ..................... 3 1
3.9 Recommended 409-bit Elliptic Curve Domain Parameters over /BY
2m ............ 3 2
3.9.1 Recommended Parameters sect409k1 . . ..................... 3 2
3.9.2 Recommended Parameters sect409r1 . . ..................... 3 3
3.10 Recommended 571-bit Elliptic Curve Domain Parameters over /BY
2m ............ 3 4
3.10.1 Recommended Parameters sect571k1 . . ..................... 3 4
3.10.2 Recommended Parameters sect571r1 . . ..................... 3 5
A ASN.1 Syntax 37

Contents Page iii
A.1 Elliptic Curve Domain Parameters . . . . ......................... 3 7
A.2 Object Identiﬁers for Recommended Parameters . ..................... 3 8
A.2.1 OIDs for Recommended Parameters over /BY
p ................... 3 8
A.2.2 OIDs for Recommended Parameters over /BY
2m ................... 3 9
A . 2 . 3 T h e I n f o r m a t i o n O b j e c t S e t S E C G C u r v e N a m e s.................. 4 0
B References 42

Page iv SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 0.6
List of Tables
1 Properties of Recommended Elliptic Curve Domain Parameters over /BY
p ......... 4
2 Status of Recommended Elliptic Curve Domain Parameters over /BY
p ........... 5
3 Representations of /BY
2m ................................... 2 0
4 Properties of Recommended Elliptic Curve Domain Parameters over /BY
2m ......... 4 3
5 Status of Recommended Elliptic Curve Domain Parameters over /BY
2m ........... 4 4

1 Introduction Page 1
1 Introduction
1.1 Overview
This document lists example elliptic curve domain parameters at commonly required security levels for
use by implementers of SEC 1 [10] and other ECC standards like ANSI X9.62 [1], ANSI X9.63 [2], and
IEEE P1363 [5].
It is strongly recommended that implementers select parameters from among the example parameters
listed in this document when they deploy ECC-based products in order to encourage the deployment of
interoperable ECC-based solutions.
1.2 Intellectual Property
The reader’s attention is called to the possibility that compliance with this document may require use of
an invention covered by patent rights. By publication of this document, no position is taken with respect
to the validity of this claim or of any patent rights in connection therewith. The patent holder(s) may
have ﬁled with the SECG a statement of willingness to grant a license under these rights on reasonable
and nondiscriminatory terms and conditions to applicants desiring to obtain such a license. Additional
details may be obtained from the patent holder and from the SECG website, www.secg.org.
1.3 Organization
This document is organized as follows.
The main body of the document focuses on the speciﬁcation of recommended elliptic curve domain
parameters. Section 2 describes recommended elliptic curve domain parameters over /BY
p, and Section 3
describes recommended elliptic curve domain parameters over /BY
2m .
The appendices to the document provide additional relevant material. Appendix A provides reference
ASN.1 syntax for implementations to use to identify the parameters. Appendix B lists the references
cited in the document.

Page 2 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 0.6
2 Recommended Elliptic Curve Domain Parameters over /BY
p
This section speciﬁes the elliptic curve domain parameters over /BY
p recommended in this document.
The section is organized as follows. First Section 2.1 describes relevant properties of the recommended
parameters over /BY
p. Then Section 2.2 speciﬁes recommended 112-bit elliptic curve domain parameters
over /BY
p, Section 2.3 speciﬁes recommended 128-bit elliptic curve domain parameters over /BY
p, Sec-
tion 2.4 speciﬁes recommended 160-bit elliptic curve domain parameters over /BY
p, Section 2.5 speciﬁes
recommended 192-bit elliptic curve domain parameters over/BY
p, Section 2.6 speciﬁes recommended 224-
bit elliptic curve domain parameters over /BY
p, Section 2.7 speciﬁes recommended 256-bit elliptic curve
domain parameters over /BY
p, Section 2.8 speciﬁes recommended 384-bit elliptic curve domain parameters
over /BY
p, Section 2.9 speciﬁes recommended 521-bit elliptic curve domain parameters over /BY
p,
2.1 Properties of Elliptic Curve Domain Parameters over /BY
p
Following SEC 1 [10], elliptic curve domain parameters over /BY
p are a sextuple:
T /BP/B4 p/BN a/BN b/BN G/BN n/BN h/B5
consisting of an integer p specifying the ﬁnite ﬁeld/BY
p, two elements a/BN b /BE /BY
p specifying an elliptic curve
E/B4 /BY
p
/B5 deﬁned by the equation:
E : y2
/AH x3
/B7 a/BM x /B7 b /B4 mod p/B5 /BN
a base point G /BP/B4 xG
/BN yG
/B5 on E/B4 /BY
p
/B5 ,ap r i m en which is the order of G, and an integer h which is the
cofactor h /BP #E/B4 /BY
p
/B5 /BP n.
When elliptic curve domain parameters are speciﬁed in this document, each component of this sextuple
is represented as an octet string converted using the conventions speciﬁed in SEC 1 [10].
Again following SEC 1 [10], elliptic curve domain parameters over /BY
p must have:
/CS log2 p/CT/BE /CU 112/BN 128/BN 160/BN 192/BN 224/BN 256/BN 384/BN 521/CV /BM
This restriction is designed to encourage interoperability while allowing implementers to supply com-
monly required security levels — recall that elliptic curve domain parameters over/BY
p with /CS log2 p/CT /BP 2t
supply approximately t bits of security — meaning that solving the logarithm problem on the associated
elliptic curve is believed to take approximately 2t operations.
Here recommended elliptic curve domain parameters are supplied at each of the sizes allowed in SEC 1.
All the recommended elliptic curve domain parameters over /BY
p use special form primes for their ﬁeld
order p. These special form primes facilitate especially efﬁcient implementations like those described in
[8]. Recommended elliptic curve domain parameters over /BY
p which use random primes for their ﬁeld
order p may be added later if commercial demand for such parameters increases.
The elliptic curve domain parameters over/BY
p supplied at each security level typically consist of examples
of two different types of parameters — one type being parameters associated with a Koblitz curve and the

2 Recommended Elliptic Curve Domain Parameters over /BY
p Page 3
other type being parameters chosen veriﬁably at random — although only veriﬁably random parameters
are supplied at export strength and at extremely high strength.
Parameters associated with a Koblitz curve admit especially efﬁcient implementation. The name Koblitz
curve is best-known when used to describe binary anomalous curves over/BY
2m which havea/BN b /BE/CU 0/BN 1/CV [6].
Here it is generalized to refer also to curves over /BY
p which possess an efﬁciently computable endo-
morphism. The recommended parameters associated with a Koblitz curve were chosen by repeatedly
selecting parameters admitting an efﬁciently computable endomorphism until a prime order curve was
found.
Veriﬁably random parameters offer some additional conservative features. These parameters are chosen
from a seed using SHA-1 as speciﬁed in ANSI X9.62 [1]. This process ensures that the parameters
cannot be predetermined. The parameters are therefore extremely unlikely to be susceptible to future
special-purpose attacks, and no trapdoors can have been placed in the parameters during their generation.
When elliptic curve domain parameters are chosen veriﬁably at random, the seed S used to generate the
parameters may optionally be stored along with the parameters so that users can verify the parameters
were chosen veriﬁably at random.
Here veriﬁably random parameters have been chosen either so that the associated elliptic curve has prime
order, or so that scalar multiplication of points on the associated elliptic curve can be accelerated using
Montgomery’s method [7]. The recommended veriﬁably random parameters were chosen by repeatedly
selecting a random seed and counting the number of points on the corresponding curve until appropriate
parameters were found. Typically the parameters were chosen so thata
/BP p /A0 3 because such parameters
admit efﬁcient implementation. For a given p, approximately half the isomorphism classes of elliptic
curves over /BY
p contain a curve with a /BP p /A0 3.
See SEC 1 [10] for further guidance on the selection of elliptic curve domain parameters over /BY
p.
The recommended elliptic curve domain parameters over /BY
p have been given nicknames to enable them
to be easily identiﬁed. The nicknames were chosen as follows. Each name begins with sec to denote
‘Standards for Efﬁcient Cryptography’, followed by a p to denote parameters over /BY
p, followed by a
number denoting the length in bits of the ﬁeld size p, followed by a k to denote parameters associated
with a Koblitz curve or anr to denote veriﬁably random parameters, followed by a sequence number.
Table 1 summarizes salient properties of the recommended elliptic curve domain parameters over /BY
p.
Information is represented in Table 1 as follows. The column labelled ‘parameters’ gives the nickname of
the elliptic curve domain parameters. The column labelled ‘section’ refers to the section of this document
where the parameters are speciﬁed. The column labelled ‘strength’ gives the approximate number of
bits of security the parameters offer. The column labelled ‘size’ gives the length in bits of the ﬁeld
order. The column labelled ‘RSA/DSA’ gives the approximate size of an RSA or DSA modulus at
comparable strength. (See SEC 1 [10] for precise technical guidance on the strength of elliptic curve
domain parameters.) Finally the column labelled ‘Koblitz or random’ indicates whether the parameters
are associated with a Koblitz curve — ‘k’ — or were chosen veriﬁably at random — ‘r’.
Table 2 summarizes the status of the recommended elliptic curve domain parameters over
/BY
p with respect
to their alignment with other standards.

Page 4 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 0.6
Parameters Section Strength Size RSA/DSA Koblitz or
random
secp112r1 2.2.1 56 112 512 r
secp112r2 2.2.2 56 112 512 r
secp128r1 2.3.1 64 128 704 r
secp128r2 2.3.2 64 128 704 r
secp160k1 2.4.1 80 160 1024 k
secp160r1 2.4.2 80 160 1024 r
secp160r2 2.4.3 80 160 1024 r
secp192k1 2.5.1 96 192 1536 k
secp192r1 2.5.2 96 192 1536 r
secp224k1 2.6.1 112 224 2048 k
secp224r1 2.6.2 112 224 2048 r
secp256k1 2.7.1 128 256 3072 k
secp256r1 2.7.2 128 256 3072 r
secp384r1 2.8.1 192 384 7680 r
secp521r1 2.9.1 256 521 15360 r
Table 1: Properties of Recommended Elliptic Curve Domain Parameters over /BY
p
Information is represented in Table 2 as follows. The column labelled ‘parameters’ gives the nickname
of the elliptic curve domain parameters. The column labelled ‘section’ refers to the section of this docu-
ment where the parameters are speciﬁed. The remaining columns give the status of the parameters with
respect to various other standards which specify mechanisms based on elliptic curve cryptography: ‘ANSI
X9.62’ refers to the ANSI X9.62 standard [1], ‘ANSI X9.63’ refers to the draft ANSI X9.63 standard [2],
‘echeck’ refers to the draft FSML standard [4], ‘IEEE P1363’ refers to the draft IEEE P1363 standard [5],
‘IPSec’ refers to the recent internet draft related to ECC [9] submitted to the IETF’s IPSec working group,
‘NIST’ refers to the list of recommended parameters recently released by the U.S. government [8], and
’W AP’ refers to the Wireless Application Forum’s WTLS standard [11]. In these columns, a ‘-’ denotes
parameters non-conformant with the standard, a ‘c’ denotes parameters conformant with the standard,
and an ‘r’ denotes parameters explicitly recommended in the standard.

2 Recommended Elliptic Curve Domain Parameters over /BY
p Page 5
Parameters Section ANSI X9.62 ANSI X9.63 echeck IEEE P1363 IPSec NIST WA P
secp112r1 2.2.1 - - - c c - r
secp112r2 2.2.2 - - - c c - c
secp128r1 2.3.1 - - - c c - c
secp128r2 2.3.2 - - - c c - c
secp160k1 2.4.1 c r c c c - c
secp160r1 2.4.2 c c c c c - r
secp160r2 2.4.3 c r c c c - c
secp192k1 2.5.1 c r c c c - c
secp192r1 2.5.2 r r c c c r c
secp224k1 2.6.1 c r c c c - c
secp224r1 2.6.2 c r c c c r c
secp256k1 2.7.1 c r c c c - c
secp256r1 2.7.2 r r c c c r c
secp384r1 2.8.1 c r c c c r c
secp521r1 2.9.1 c r c c c r c
Table 2: Status of Recommended Elliptic Curve Domain Parameters over /BY
p
2.2 Recommended 112-bit Elliptic Curve Domain Parameters over /BY
p
This section speciﬁes the two recommended 112-bit elliptic curve domain parameters over /BY
p in this
document: veriﬁably random parameterssecp112r1, and veriﬁably random parameterssecp112r2.
Section 2.2.1 speciﬁes the elliptic curve domain parameterssecp112r1, and Section 2.2.2 speciﬁes the
elliptic curve domain parameterssecp112r2.
2.2.1 Recommended Parameters secp112r1
The veriﬁably random elliptic curve domain parameters over /BY
p secp112r1 are speciﬁed by the sex-
tuple T /BP/B4 p/BN a/BN b/BN G/BN n/BN h/B5 where the ﬁnite ﬁeld /BY
p is deﬁned by:
p /BP /BW/BU/BJ/BV /BE/BT/BU/BY/BI/BE/BX/BF /BH/BX/BI/BI/BK/BC/BJ/BI /BU/BX/BT/BW/BE/BC/BK/BU
/BP /B4 2128
/A0 3/B5 /BP 76439

Page 6 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 0.6
The curve E: y2
/BP x3
/B7 ax /B7 b over /BY
p is deﬁned by:
a /BP /BW/BU/BJ/BV /BE/BT/BU/BY/BI/BE/BX/BF /BH/BX/BI/BI/BK/BC/BJ/BI /BU/BX/BT/BW/BE/BC/BK/BK
b /BP /BI/BH/BL/BX /BY/BK/BU/BT/BC/BG/BF/BL /BD/BI/BX/BX/BW/BX/BK/BL /BD/BD/BJ/BC/BE/BU/BE/BE
E was chosen veriﬁably at random as speciﬁed in ANSI X9.62 [1] from the seed:
S /BP /BC/BC/BY/BH/BC/BU/BC/BE /BK/BX/BG/BW/BI/BL/BI/BX /BI/BJ/BI/BK/BJ/BH/BI/BD /BH/BD/BJ/BH/BE/BL/BC/BG /BJ/BE/BJ/BK/BF/BY/BU/BD
The base point G in compressed form is:
G /BP /BC/BE/BC/BL/BG/BK /BJ/BE/BF/BL/BL/BL/BH/BT /BH/BX/BX/BJ/BI/BU/BH/BH /BY/BL/BV/BE/BY/BC/BL/BK
and in uncompressed form is:
G /BP /BC/BG /BC/BL/BG/BK/BJ/BE/BF/BL /BL/BL/BH/BT/BH/BX/BX/BJ /BI/BU/BH/BH/BY/BL/BV/BE /BY/BC/BL/BK/BT/BK/BL/BV /BX/BH/BT/BY/BK/BJ/BE/BG /BV/BC/BT/BE/BF/BX/BC/BX
/BC/BY/BY/BJ/BJ/BH/BC/BC
Finally the order n of G and the cofactor are:
n /BP /BW/BU/BJ/BV /BE/BT/BU/BY/BI/BE/BX/BF /BH/BX/BJ/BI/BE/BK/BW/BY /BT/BV/BI/BH/BI/BD/BV/BH
h /BP /BC/BD
2.2.2 Recommended Parameters secp112r2
The veriﬁably random elliptic curve domain parameters over /BY
p secp112r2 are speciﬁed by the sex-
tuple T /BP/B4 p/BN a/BN b/BN G/BN n/BN h/B5 where the ﬁnite ﬁeld /BY
p is deﬁned by:
p /BP /BW/BU/BJ/BV /BE/BT/BU/BY/BI/BE/BX/BF /BH/BX/BI/BI/BK/BC/BJ/BI /BU/BX/BT/BW/BE/BC/BK/BU
/BP /B4 2128
/A0 3/B5 /BP 76439
The curve E: y2
/BP x3
/B7 ax /B7 b over /BY
p is deﬁned by:
a /BP /BI/BD/BE/BJ /BV/BE/BG/BV/BC/BH/BY/BF /BK/BT/BC/BT/BT/BT/BY/BI /BH/BV/BC/BX/BY/BC/BE/BV
b /BP /BH/BD/BW/BX /BY/BD/BK/BD/BH/BW/BU/BH /BX/BW/BJ/BG/BY/BV/BV/BF /BG/BV/BK/BH/BW/BJ/BC/BL
E was chosen veriﬁably at random as speciﬁed in ANSI X9.62 [1] from the seed:
S /BP /BC/BC/BE/BJ/BH/BJ/BT/BD /BD/BD/BG/BW/BI/BL/BI/BX /BI/BJ/BI/BK/BJ/BH/BI/BD /BH/BD/BJ/BH/BH/BF/BD/BI /BV/BC/BH/BX/BC/BU/BW/BG
The base point G in compressed form is:
G /BP /BC/BF/BG/BU/BT/BF /BC/BT/BU/BH/BX/BK/BL/BE /BU/BG/BX/BD/BI/BG/BL/BW /BW/BC/BL/BE/BK/BI/BG/BF
and in uncompressed form is:
G /BP /BC/BG /BG/BU/BT/BF/BC/BT/BU/BH /BX/BK/BL/BE/BU/BG/BX/BD /BI/BG/BL/BW/BW/BC/BL/BE /BK/BI/BG/BF/BT/BW/BV/BW /BG/BI/BY/BH/BK/BK/BE/BX /BF/BJ/BG/BJ/BW/BX/BY/BF
/BI/BX/BL/BH/BI/BX/BL/BJ

2 Recommended Elliptic Curve Domain Parameters over /BY
p Page 7
Finally the order n of G and the cofactor are:
n /BP /BF/BI/BW/BY /BC/BT/BT/BY/BW/BK/BU/BK /BW/BJ/BH/BL/BJ/BV/BT/BD /BC/BH/BE/BC/BW/BC/BG/BU
h /BP /BC/BG
2.3 Recommended 128-bit Elliptic Curve Domain Parameters over /BY
p
This section speciﬁes the two recommended 128-bit elliptic curve domain parameters over /BY
p in this
document: veriﬁably random parameterssecp128r1, and veriﬁably random parameterssecp128r2.
Section 2.3.1 speciﬁes the elliptic curve domain parameterssecp128r1, and Section 2.3.2 speciﬁes the
elliptic curve domain parameterssecp128r2.
2.3.1 Recommended Parameters secp128r1
The veriﬁably random elliptic curve domain parameters over /BY
p secp128r1 are speciﬁed by the sex-
tuple T /BP/B4 p/BN a/BN b/BN G/BN n/BN h/B5 where the ﬁnite ﬁeld /BY
p is deﬁned by:
p /BP /BY/BY/BY/BY/BY/BY/BY/BW /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY
/BP 2128
/A0 297
/A0 1
The curve E: y2
/BP x3
/B7 ax /B7 b over /BY
p is deﬁned by:
a /BP /BY/BY/BY/BY/BY/BY/BY/BW /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BV
b /BP /BX/BK/BJ/BH/BJ/BL/BV/BD /BD/BC/BJ/BL/BY/BG/BF/BW /BW/BK/BE/BG/BL/BL/BF/BV /BE/BV/BX/BX/BH/BX/BW/BF
E was chosen veriﬁably at random as speciﬁed in ANSI X9.62 [1] from the seed:
S /BP /BC/BC/BC/BX/BC/BW/BG/BW /BI/BL/BI/BX/BI/BJ/BI/BK /BJ/BH/BI/BD/BH/BD/BJ/BH /BC/BV/BV/BC/BF/BT/BG/BG /BJ/BF/BW/BC/BF/BI/BJ/BL
The base point G in compressed form is:
G /BP /BC/BF /BD/BI/BD/BY/BY/BJ/BH/BE /BK/BU/BK/BL/BL/BU/BE/BW /BC/BV/BE/BK/BI/BC/BJ/BV /BT/BH/BE/BV/BH/BU/BK/BI
and in uncompressed form is:
G /BP /BC/BG /BD/BI/BD/BY/BY/BJ/BH/BE /BK/BU/BK/BL/BL/BU/BE/BW /BC/BV/BE/BK/BI/BC/BJ/BV /BT/BH/BE/BV/BH/BU/BK/BI /BV/BY/BH/BT/BV/BK/BF/BL /BH/BU/BT/BY/BX/BU/BD/BF
/BV/BC/BE/BW/BT/BE/BL/BE /BW/BW/BX/BW/BJ/BT/BK/BF
Finally the order n of G and the cofactor are:
n /BP /BY/BY/BY/BY/BY/BY/BY/BX /BC/BC/BC/BC/BC/BC/BC/BC /BJ/BH/BT/BF/BC/BW/BD/BU /BL/BC/BF/BK/BT/BD/BD/BH
h /BP /BC/BD

Page 8 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 0.6
2.3.2 Recommended Parameters secp128r2
The veriﬁably random elliptic curve domain parameters over /BY
p secp128r2 are speciﬁed by the sex-
tuple T /BP/B4 p/BN a/BN b/BN G/BN n/BN h/B5 where the ﬁnite ﬁeld /BY
p is deﬁned by:
p /BP /BY/BY/BY/BY/BY/BY/BY/BW /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY
/BP 2128
/A0 297
/A0 1
The curve E: y2
/BP x3
/B7 ax /B7 b over /BY
p is deﬁned by:
a /BP /BW/BI/BC/BF/BD/BL/BL/BK /BW/BD/BU/BF/BU/BU/BY/BX /BU/BY/BH/BL/BV/BV/BL/BU /BU/BY/BY/BL/BT/BX/BX/BD
b /BP /BH/BX/BX/BX/BY/BV/BT/BF /BK/BC/BW/BC/BE/BL/BD/BL /BW/BV/BE/BV/BI/BH/BH/BK /BU/BU/BI/BW/BK/BT/BH/BW
E was chosen veriﬁably at random as speciﬁed in ANSI X9.62 [1] from the seed:
S /BP /BC/BC/BG/BW/BI/BL/BI/BX /BI/BJ/BI/BK/BJ/BH/BI/BD /BH/BD/BJ/BH/BD/BE/BW/BK /BY/BC/BF/BG/BF/BD/BY/BV /BX/BI/BF/BU/BK/BK/BY/BG
The base point G in compressed form is:
G /BP /BC/BE /BJ/BU/BI/BT/BT/BH/BW/BK /BH/BX/BH/BJ/BE/BL/BK/BF /BX/BI/BY/BU/BF/BE/BT/BJ /BV/BW/BX/BU/BV/BD/BG/BC
and in uncompressed form is:
G /BP /BC/BG /BJ/BU/BI/BT/BT/BH/BW/BK /BH/BX/BH/BJ/BE/BL/BK/BF /BX/BI/BY/BU/BF/BE/BT/BJ /BV/BW/BX/BU/BV/BD/BG/BC /BE/BJ/BU/BI/BL/BD/BI/BT /BK/BL/BG/BW/BF/BT/BX/BX
/BJ/BD/BC/BI/BY/BX/BK/BC /BH/BY/BV/BF/BG/BU/BG/BG
Finally the order n of G and the cofactor are:
n /BP /BF/BY/BY/BY/BY/BY/BY/BY /BJ/BY/BY/BY/BY/BY/BY/BY /BU/BX/BC/BC/BE/BG/BJ/BE /BC/BI/BD/BF/BU/BH/BT/BF
h /BP /BC/BG
2.4 Recommended 160-bit Elliptic Curve Domain Parameters over /BY
p
This section speciﬁes the three recommended 160-bit elliptic curve domain parameters over /BY
p in this
document: parameters secp160k1 associated with a Koblitz curve, veriﬁably random parameters
secp160r1, and veriﬁably random parameterssecp160r2.
Section 2.4.1 speciﬁes the elliptic curve domain parameters secp160k1, Section 2.4.2 speciﬁes the
elliptic curve domain parameters secp160r1, and Section 2.4.3 speciﬁes the elliptic curve domain
parameterssecp160r2.
2.4.1 Recommended Parameters secp160k1
The elliptic curve domain parameters over /BY
p associated with a Koblitz curvesecp160k1 are speciﬁed
by the sextuple T /BP/B4 p/BN a/BN b/BN G/BN n/BN h/B5 where the ﬁnite ﬁeld /BY
p is deﬁned by:

2 Recommended Elliptic Curve Domain Parameters over /BY
p Page 9
p /BP /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BX /BY/BY/BY/BY/BT/BV/BJ/BF
/BP 2160
/A0 232
/A0 214
/A0 212
/A0 29
/A0 28
/A0 27
/A0 23
/A0 22
/A0 1
The curve E: y2
/BP x3
/B7 ax /B7 b over /BY
p is deﬁned by:
a /BP /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC
b /BP /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BJ
The base point G in compressed form is:
G /BP /BC/BE /BF/BU/BG/BV/BF/BK/BE/BV /BX/BF/BJ/BT/BT/BD/BL/BE /BT/BG/BC/BD/BL/BX/BJ/BI /BF/BC/BF/BI/BY/BG/BY/BH /BW/BW/BG/BW/BJ/BX/BU/BU
and in uncompressed form is:
G /BP /BC/BG /BF/BU/BG/BV/BF/BK/BE/BV /BX/BF/BJ/BT/BT/BD/BL/BE /BT/BG/BC/BD/BL/BX/BJ/BI /BF/BC/BF/BI/BY/BG/BY/BH /BW/BW/BG/BW/BJ/BX/BU/BU /BL/BF/BK/BV/BY/BL/BF/BH
/BF/BD/BK/BY/BW/BV/BX/BW /BI/BU/BV/BE/BK/BE/BK/BI /BH/BF/BD/BJ/BF/BF/BV/BF /BY/BC/BF/BV/BG/BY/BX/BX
Finally the order n of G and the cofactor are:
n /BP /BC/BD /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BD/BU/BK/BY/BT /BD/BI/BW/BY/BT/BU/BL/BT /BV/BT/BD/BI/BU/BI/BU/BF
h /BP /BC/BD
2.4.2 Recommended Parameters secp160r1
The veriﬁably random elliptic curve domain parameters over /BY
p secp160r1 are speciﬁed by the sex-
tuple T /BP/B4 p/BN a/BN b/BN G/BN n/BN h/B5 where the ﬁnite ﬁeld /BY
p is deﬁned by:
p /BP /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BJ/BY/BY/BY/BY/BY/BY/BY
/BP 2160
/A0 231
/A0 1
The curve E: y2
/BP x3
/B7 ax /B7 b over /BY
p is deﬁned by:
a /BP /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BJ/BY/BY/BY/BY/BY/BY/BV
b /BP /BD/BV/BL/BJ/BU/BX/BY/BV /BH/BG/BU/BW/BJ/BT/BK/BU /BI/BH/BT/BV/BY/BK/BL/BY /BK/BD/BW/BG/BW/BG/BT/BW /BV/BH/BI/BH/BY/BT/BG/BH
E was chosen veriﬁably at random as speciﬁed in ANSI X9.62 [1] from the seed:
S /BP /BD/BC/BH/BF/BV/BW/BX/BG /BE/BV/BD/BG/BW/BI/BL/BI /BX/BI/BJ/BI/BK/BJ/BH/BI /BD/BH/BD/BJ/BH/BF/BF/BU /BY/BF/BY/BK/BF/BF/BG/BH
The base point G in compressed form is:
G /BP /BC/BE /BG/BT/BL/BI/BU/BH/BI/BK /BK/BX/BY/BH/BJ/BF/BE/BK /BG/BI/BI/BG/BI/BL/BK/BL /BI/BK/BV/BF/BK/BU/BU/BL /BD/BF/BV/BU/BY/BV/BK/BE
and in uncompressed form is:
G /BP /BC/BG /BG/BT/BL/BI/BU/BH/BI/BK /BK/BX/BY/BH/BJ/BF/BE/BK /BG/BI/BI/BG/BI/BL/BK/BL /BI/BK/BV/BF/BK/BU/BU/BL /BD/BF/BV/BU/BY/BV/BK/BE /BE/BF/BT/BI/BE/BK/BH/BH
/BF/BD/BI/BK/BL/BG/BJ/BW /BH/BL/BW/BV/BV/BL/BD/BE /BC/BG/BE/BF/BH/BD/BF/BJ /BJ/BT/BV/BH/BY/BU/BF/BE

Page 10 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 0.6
Finally the order n of G and the cofactor are:
n /BP /BC/BD /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BD/BY/BG/BV/BK /BY/BL/BE/BJ/BT/BX/BW/BF /BV/BT/BJ/BH/BE/BE/BH/BJ
h /BP /BC/BD
2.4.3 Recommended Parameters secp160r2
The veriﬁably random elliptic curve domain parameters over /BY
p secp160r2 are speciﬁed by the sex-
tuple T /BP/B4 p/BN a/BN b/BN G/BN n/BN h/B5 where the ﬁnite ﬁeld /BY
p is deﬁned by:
p /BP /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BX /BY/BY/BY/BY/BT/BV/BJ/BF
/BP 2160
/A0 232
/A0 214
/A0 212
/A0 29
/A0 28
/A0 27
/A0 23
/A0 22
/A0 1
The curve E: y2
/BP x3
/B7 ax /B7 b over /BY
p is deﬁned by:
a /BP /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BX /BY/BY/BY/BY/BT/BV/BJ/BC
b /BP /BU/BG/BX/BD/BF/BG/BW/BF /BY/BU/BH/BL/BX/BU/BK/BU /BT/BU/BH/BJ/BE/BJ/BG/BL /BC/BG/BI/BI/BG/BW/BH/BT /BY/BH/BC/BF/BK/BK/BU/BT
E was chosen veriﬁably at random as speciﬁed in ANSI X9.62 [1] from the seed:
S /BP /BU/BL/BL/BU/BL/BL/BU/BC /BL/BL/BU/BF/BE/BF/BX/BC /BE/BJ/BC/BL/BT/BG/BW/BI /BL/BI/BX/BI/BJ/BI/BK/BJ /BH/BI/BD/BH/BD/BJ/BH/BD
The base point G in compressed form is:
G /BP /BC/BE /BH/BE/BW/BV/BU/BC/BF/BG /BE/BL/BF/BT/BD/BD/BJ/BX /BD/BY/BG/BY/BY/BD/BD/BU /BF/BC/BY/BJ/BD/BL/BL/BW /BF/BD/BG/BG/BV/BX/BI/BW
and in uncompressed form is:
G /BP /BC/BG /BH/BE/BW/BV/BU/BC/BF/BG /BE/BL/BF/BT/BD/BD/BJ/BX /BD/BY/BG/BY/BY/BD/BD/BU /BF/BC/BY/BJ/BD/BL/BL/BW /BF/BD/BG/BG/BV/BX/BI/BW /BY/BX/BT/BY/BY/BX/BY/BE
/BX/BF/BF/BD/BY/BE/BL/BI /BX/BC/BJ/BD/BY/BT/BC/BW /BY/BL/BL/BK/BE/BV/BY/BX /BT/BJ/BW/BG/BF/BY/BE/BX
Finally the order n of G and the cofactor are:
n /BP /BC/BD /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BF/BH/BD/BX /BX/BJ/BK/BI/BT/BK/BD/BK /BY/BF/BT/BD/BT/BD/BI/BU
h /BP /BC/BD
2.5 Recommended 192-bit Elliptic Curve Domain Parameters over /BY
p
This section speciﬁes the two recommended 192-bit elliptic curve domain parameters over /BY
p in this
document: parameters secp192k1 associated with a Koblitz curve, and veriﬁably random parameters
secp192r1.
Section 2.5.1 speciﬁes the elliptic curve domain parameterssecp192k1, and Section 2.5.2 speciﬁes the
elliptic curve domain parameterssecp192r1.

2 Recommended Elliptic Curve Domain Parameters over /BY
p Page 11
2.5.1 Recommended Parameters secp192k1
The elliptic curve domain parameters over /BY
p associated with a Koblitz curvesecp192k1 are speciﬁed
by the sextuple T /BP/B4 p/BN a/BN b/BN G/BN n/BN h/B5 where the ﬁnite ﬁeld /BY
p is deﬁned by:
p /BP /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BX /BY/BY/BY/BY/BX/BX/BF/BJ
/BP 2192
/A0 232
/A0 212
/A0 28
/A0 27
/A0 26
/A0 23
/A0 1
The curve E: y2
/BP x3
/B7 ax /B7 b over /BY
p is deﬁned by:
a /BP /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC
b /BP /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BF
The base point G in compressed form is:
G /BP /BC/BF /BW/BU/BG/BY/BY/BD/BC/BX /BV/BC/BH/BJ/BX/BL/BT/BX /BE/BI/BU/BC/BJ/BW/BC/BE /BK/BC/BU/BJ/BY/BG/BF/BG /BD/BW/BT/BH/BW/BD/BU/BD /BX/BT/BX/BC/BI/BV/BJ/BW
and in uncompressed form is:
G /BP /BC/BG /BW/BU/BG/BY/BY/BD/BC/BX /BV/BC/BH/BJ/BX/BL/BT/BX /BE/BI/BU/BC/BJ/BW/BC/BE /BK/BC/BU/BJ/BY/BG/BF/BG /BD/BW/BT/BH/BW/BD/BU/BD /BX/BT/BX/BC/BI/BV/BJ/BW
/BL/BU/BE/BY/BE/BY/BI/BW /BL/BV/BH/BI/BE/BK/BT/BJ /BK/BG/BG/BD/BI/BF/BW/BC /BD/BH/BU/BX/BK/BI/BF/BG /BG/BC/BK/BE/BT/BT/BK/BK /BW/BL/BH/BX/BE/BY/BL/BW
Finally the order n of G and the cofactor are:
n /BP /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BX /BE/BI/BY/BE/BY/BV/BD/BJ /BC/BY/BI/BL/BG/BI/BI/BT /BJ/BG/BW/BX/BY/BW/BK/BW
h /BP /BC/BD
2.5.2 Recommended Parameters secp192r1
The veriﬁably random elliptic curve domain parameters over /BY
p secp192r1 are speciﬁed by the sex-
tuple T /BP/B4 p/BN a/BN b/BN G/BN n/BN h/B5 where the ﬁnite ﬁeld /BY
p is deﬁned by:
p /BP /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BX /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY
/BP 2192
/A0 264
/A0 1
The curve E: y2
/BP x3
/B7 ax /B7 b over /BY
p is deﬁned by:
a /BP /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BX /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BV
b /BP /BI/BG/BE/BD/BC/BH/BD/BL /BX/BH/BL/BV/BK/BC/BX/BJ /BC/BY/BT/BJ/BX/BL/BT/BU /BJ/BE/BE/BG/BF/BC/BG/BL /BY/BX/BU/BK/BW/BX/BX/BV /BV/BD/BG/BI/BU/BL/BU/BD
E was chosen veriﬁably at random as speciﬁed in ANSI X9.62 [1] from the seed:
S /BP /BF/BC/BG/BH/BT/BX/BI/BY /BV/BK/BG/BE/BE/BY/BI/BG /BX/BW/BH/BJ/BL/BH/BE/BK /BW/BF/BK/BD/BE/BC/BX/BT /BX/BD/BE/BD/BL/BI/BW/BH
The base point G in compressed form is:
G /BP /BC/BF /BD/BK/BK/BW/BT/BK/BC/BX /BU/BC/BF/BC/BL/BC/BY/BI /BJ/BV/BU/BY/BE/BC/BX/BU /BG/BF/BT/BD/BK/BK/BC/BC /BY/BG/BY/BY/BC/BT/BY/BW /BK/BE/BY/BY/BD/BC/BD/BE

Page 12 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 0.6
and in uncompressed form is:
G /BP /BC/BG /BD/BK/BK/BW/BT/BK/BC/BX /BU/BC/BF/BC/BL/BC/BY/BI /BJ/BV/BU/BY/BE/BC/BX/BU /BG/BF/BT/BD/BK/BK/BC/BC /BY/BG/BY/BY/BC/BT/BY/BW /BK/BE/BY/BY/BD/BC/BD/BE
/BC/BJ/BD/BL/BE/BU/BL/BH /BY/BY/BV/BK/BW/BT/BJ/BK /BI/BF/BD/BC/BD/BD/BX/BW /BI/BU/BE/BG/BV/BW/BW/BH /BJ/BF/BY/BL/BJ/BJ/BT/BD /BD/BX/BJ/BL/BG/BK/BD/BD
Finally the order n of G and the cofactor are:
n /BP /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BL/BL/BW/BX/BY/BK/BF/BI /BD/BG/BI/BU/BV/BL/BU/BD /BU/BG/BW/BE/BE/BK/BF/BD
h /BP /BC/BD
2.6 Recommended 224-bit Elliptic Curve Domain Parameters over /BY
p
This section speciﬁes the two recommended 224-bit elliptic curve domain parameters over /BY
p in this
document: parameters secp224k1 associated with a Koblitz curve, and veriﬁably random parameters
secp224r1.
Section 2.6.1 speciﬁes the elliptic curve domain parameterssecp224k1, and Section 2.6.2 speciﬁes the
elliptic curve domain parameterssecp224r1.
2.6.1 Recommended Parameters secp224k1
The elliptic curve domain parameters over /BY
p associated with a Koblitz curvesecp224k1 are speciﬁed
by the sextuple T /BP/B4 p/BN a/BN b/BN G/BN n/BN h/B5 where the ﬁnite ﬁeld /BY
p is deﬁned by:
p /BP /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BX /BY/BY/BY/BY/BX/BH/BI/BW
/BP 2224
/A0 232
/A0 212
/A0 211
/A0 29
/A0 27
/A0 24
/A0 2 /A0 1
The curve E: y2
/BP x3
/B7 ax /B7 b over /BY
p is deﬁned by:
a /BP /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC
b /BP /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BH
The base point G in compressed form is:
G /BP /BC/BF /BT/BD/BG/BH/BH/BU/BF/BF /BG/BW/BY/BC/BL/BL/BW/BY /BF/BC/BY/BV/BE/BK/BT/BD /BI/BL/BT/BG/BI/BJ/BX/BL /BX/BG/BJ/BC/BJ/BH/BT/BL /BC/BY/BJ/BX/BI/BH/BC/BX
/BU/BI/BU/BJ/BT/BG/BH/BV
and in uncompressed form is:
G /BP /BC/BG /BT/BD/BG/BH/BH/BU/BF/BF /BG/BW/BY/BC/BL/BL/BW/BY /BF/BC/BY/BV/BE/BK/BT/BD /BI/BL/BT/BG/BI/BJ/BX/BL /BX/BG/BJ/BC/BJ/BH/BT/BL /BC/BY/BJ/BX/BI/BH/BC/BX
/BU/BI/BU/BJ/BT/BG/BH/BV /BJ/BX/BC/BK/BL/BY/BX/BW /BJ/BY/BU/BT/BF/BG/BG/BE /BK/BE/BV/BT/BY/BU/BW/BI /BY/BJ/BX/BF/BD/BL/BY/BJ /BV/BC/BU/BC/BU/BW/BH/BL /BX/BE/BV/BT/BG/BU/BW/BU
/BH/BH/BI/BW/BI/BD/BT/BH
Finally the order n of G and the cofactor are:

2 Recommended Elliptic Curve Domain Parameters over /BY
p Page 13
n /BP /BC/BD /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BD/BW/BV/BX/BK /BW/BE/BX/BV/BI/BD/BK/BG /BV/BT/BY/BC/BT/BL/BJ/BD
/BJ/BI/BL/BY/BU/BD/BY/BJ
h /BP /BC/BD
2.6.2 Recommended Parameters secp224r1
The veriﬁably random elliptic curve domain parameters over /BY
p secp224r1 are speciﬁed by the sex-
tuple T /BP/B4 p/BN a/BN b/BN G/BN n/BN h/B5 where the ﬁnite ﬁeld /BY
p is deﬁned by:
p /BP /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BD
/BP 2224
/A0 296
/B7 1
The curve E: y2
/BP x3
/B7 ax /B7 b over /BY
p is deﬁned by:
a /BP /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BX /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BX
b /BP /BU/BG/BC/BH/BC/BT/BK/BH /BC/BV/BC/BG/BU/BF/BT/BU /BY/BH/BG/BD/BF/BE/BH/BI /BH/BC/BG/BG/BU/BC/BU/BJ /BW/BJ/BU/BY/BW/BK/BU/BT /BE/BJ/BC/BU/BF/BL/BG/BF /BE/BF/BH/BH/BY/BY/BU/BG
E was chosen veriﬁably at random as speciﬁed in ANSI X9.62 [1] from the seed:
S /BP /BU/BW/BJ/BD/BF/BG/BG/BJ /BL/BL/BW/BH/BV/BJ/BY/BV /BW/BV/BG/BH/BU/BH/BL/BY /BT/BF/BU/BL/BT/BU/BK/BY /BI/BT/BL/BG/BK/BU/BV/BH
The base point G in compressed form is:
G /BP /BC/BE /BU/BJ/BC/BX/BC/BV/BU/BW /BI/BU/BU/BG/BU/BY/BJ/BY /BF/BE/BD/BF/BL/BC/BU/BL /BG/BT/BC/BF/BV/BD/BW/BF /BH/BI/BV/BE/BD/BD/BE/BE /BF/BG/BF/BE/BK/BC/BW/BI
/BD/BD/BH/BV/BD/BW/BE/BD
and in uncompressed form is:
G /BP /BC/BG /BU/BJ/BC/BX/BC/BV/BU/BW /BI/BU/BU/BG/BU/BY/BJ/BY /BF/BE/BD/BF/BL/BC/BU/BL /BG/BT/BC/BF/BV/BD/BW/BF /BH/BI/BV/BE/BD/BD/BE/BE /BF/BG/BF/BE/BK/BC/BW/BI
/BD/BD/BH/BV/BD/BW/BE/BD /BU/BW/BF/BJ/BI/BF/BK/BK /BU/BH/BY/BJ/BE/BF/BY/BU /BG/BV/BE/BE/BW/BY/BX/BI /BV/BW/BG/BF/BJ/BH/BT/BC /BH/BT/BC/BJ/BG/BJ/BI/BG /BG/BG/BW/BH/BK/BD/BL/BL
/BK/BH/BC/BC/BJ/BX/BF/BG
Finally the order n of G and the cofactor are:
n /BP /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BD/BI/BT/BE /BX/BC/BU/BK/BY/BC/BF/BX /BD/BF/BW/BW/BE/BL/BG/BH /BH/BV/BH/BV/BE/BT/BF/BW
h /BP /BC/BD
2.7 Recommended 256-bit Elliptic Curve Domain Parameters over /BY
p
This section speciﬁes the two recommended 256-bit elliptic curve domain parameters over /BY
p in this
document: parameters secp256k1 associated with a Koblitz curve, and veriﬁably random parameters
secp256r1.
Section 2.7.1 speciﬁes the elliptic curve domain parameterssecp256k1, and Section 2.7.2 speciﬁes the

Page 14 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 0.6
elliptic curve domain parameterssecp256r1.
2.7.1 Recommended Parameters secp256k1
The elliptic curve domain parameters over /BY
p associated with a Koblitz curvesecp256k1 are speciﬁed
by the sextuple T /BP/B4 p/BN a/BN b/BN G/BN n/BN h/B5 where the ﬁnite ﬁeld /BY
p is deﬁned by:
p /BP /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BX
/BY/BY/BY/BY/BY/BV/BE/BY
/BP 2256
/A0 232
/A0 29
/A0 28
/A0 27
/A0 26
/A0 24
/A0 1
The curve E: y2
/BP x3
/B7 ax /B7 b over /BY
p is deﬁned by:
a /BP /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC
/BC/BC/BC/BC/BC/BC/BC/BC
b /BP /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC
/BC/BC/BC/BC/BC/BC/BC/BJ
The base point G in compressed form is:
G /BP /BC/BE /BJ/BL/BU/BX/BI/BI/BJ/BX /BY/BL/BW/BV/BU/BU/BT/BV /BH/BH/BT/BC/BI/BE/BL/BH /BV/BX/BK/BJ/BC/BU/BC/BJ /BC/BE/BL/BU/BY/BV/BW/BU /BE/BW/BV/BX/BE/BK/BW/BL
/BH/BL/BY/BE/BK/BD/BH/BU /BD/BI/BY/BK/BD/BJ/BL/BK
and in uncompressed form is:
G /BP /BC/BG /BJ/BL/BU/BX/BI/BI/BJ/BX /BY/BL/BW/BV/BU/BU/BT/BV /BH/BH/BT/BC/BI/BE/BL/BH /BV/BX/BK/BJ/BC/BU/BC/BJ /BC/BE/BL/BU/BY/BV/BW/BU /BE/BW/BV/BX/BE/BK/BW/BL
/BH/BL/BY/BE/BK/BD/BH/BU /BD/BI/BY/BK/BD/BJ/BL/BK /BG/BK/BF/BT/BW/BT/BJ/BJ /BE/BI/BT/BF/BV/BG/BI/BH /BH/BW/BT/BG/BY/BU/BY/BV /BC/BX/BD/BD/BC/BK/BT/BK /BY/BW/BD/BJ/BU/BG/BG/BK
/BT/BI/BK/BH/BH/BG/BD/BL /BL/BV/BG/BJ/BW/BC/BK/BY /BY/BU/BD/BC/BW/BG/BU/BK
Finally the order n of G and the cofactor are:
n /BP /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BX /BU/BT/BT/BX/BW/BV/BX/BI /BT/BY/BG/BK/BT/BC/BF/BU /BU/BY/BW/BE/BH/BX/BK/BV
/BW/BC/BF/BI/BG/BD/BG/BD
h /BP /BC/BD
2.7.2 Recommended Parameters secp256r1
The veriﬁably random elliptic curve domain parameters over /BY
p secp256r1 are speciﬁed by the sex-
tuple T /BP/B4 p/BN a/BN b/BN G/BN n/BN h/B5 where the ﬁnite ﬁeld /BY
p is deﬁned by:

2 Recommended Elliptic Curve Domain Parameters over /BY
p Page 15
p /BP /BY/BY/BY/BY/BY/BY/BY/BY /BC/BC/BC/BC/BC/BC/BC/BD /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY
/BY/BY/BY/BY/BY/BY/BY/BY
/BP 2224
/B4 232
/A0 1/B5/B7 2192
/B7 296
/A0 1
The curve E: y2
/BP x3
/B7 ax /B7 b over /BY
p is deﬁned by:
a /BP /BY/BY/BY/BY/BY/BY/BY/BY /BC/BC/BC/BC/BC/BC/BC/BD /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY
/BY/BY/BY/BY/BY/BY/BY/BV
b /BP /BH/BT/BV/BI/BF/BH/BW/BK /BT/BT/BF/BT/BL/BF/BX/BJ /BU/BF/BX/BU/BU/BW/BH/BH /BJ/BI/BL/BK/BK/BI/BU/BV /BI/BH/BD/BW/BC/BI/BU/BC /BV/BV/BH/BF/BU/BC/BY/BI /BF/BU/BV/BX/BF/BV/BF/BX
/BE/BJ/BW/BE/BI/BC/BG/BU
E was chosen veriﬁably at random as speciﬁed in ANSI X9.62 [1] from the seed:
S /BP /BV/BG/BL/BW/BF/BI/BC/BK /BK/BI/BX/BJ/BC/BG/BL/BF /BI/BT/BI/BI/BJ/BK/BX/BD /BD/BF/BL/BW/BE/BI/BU/BJ /BK/BD/BL/BY/BJ/BX/BL/BC
The base point G in compressed form is:
G /BP /BC/BF /BI/BU/BD/BJ/BW/BD/BY/BE /BX/BD/BE/BV/BG/BE/BG/BJ /BY/BK/BU/BV/BX/BI/BX/BH /BI/BF/BT/BG/BG/BC/BY/BE /BJ/BJ/BC/BF/BJ/BW/BK/BD /BE/BW/BX/BU/BF/BF/BT/BC
/BY/BG/BT/BD/BF/BL/BG/BH /BW/BK/BL/BK/BV/BE/BL/BI
and in uncompressed form is:
G /BP /BC/BG /BI/BU/BD/BJ/BW/BD/BY/BE /BX/BD/BE/BV/BG/BE/BG/BJ /BY/BK/BU/BV/BX/BI/BX/BH /BI/BF/BT/BG/BG/BC/BY/BE /BJ/BJ/BC/BF/BJ/BW/BK/BD /BE/BW/BX/BU/BF/BF/BT/BC
/BY/BG/BT/BD/BF/BL/BG/BH /BW/BK/BL/BK/BV/BE/BL/BI /BG/BY/BX/BF/BG/BE/BX/BE /BY/BX/BD/BT/BJ/BY/BL/BU /BK/BX/BX/BJ/BX/BU/BG/BT /BJ/BV/BC/BY/BL/BX/BD/BI /BE/BU/BV/BX/BF/BF/BH/BJ
/BI/BU/BF/BD/BH/BX/BV/BX /BV/BU/BU/BI/BG/BC/BI/BK /BF/BJ/BU/BY/BH/BD/BY/BH
Finally the order n of G and the cofactor are:
n /BP /BY/BY/BY/BY/BY/BY/BY/BY /BC/BC/BC/BC/BC/BC/BC/BC /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BU/BV/BX/BI/BY/BT/BT/BW /BT/BJ/BD/BJ/BL/BX/BK/BG /BY/BF/BU/BL/BV/BT/BV/BE
/BY/BV/BI/BF/BE/BH/BH/BD
h /BP /BC/BD
2.8 Recommended 384-bit Elliptic Curve Domain Parameters over /BY
p
This section speciﬁes the recommended 384-bit elliptic curve domain parameters over /BY
p in this docu-
ment: veriﬁably random parameters secp384r1.
Section 2.8.1 speciﬁes the elliptic curve domain parameterssecp384r1.
2.8.1 Recommended Parameters secp384r1
The veriﬁably random elliptic curve domain parameters over /BY
p secp384r1 are speciﬁed by the sex-
tuple T /BP/B4 p/BN a/BN b/BN G/BN n/BN h/B5 where the ﬁnite ﬁeld /BY
p is deﬁned by:

Page 16 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 0.6
p /BP /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY
/BY/BY/BY/BY/BY/BY/BY/BX /BY/BY/BY/BY/BY/BY/BY/BY /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BY/BY/BY/BY/BY/BY/BY/BY
/BP 2384
/A0 2128
/A0 296
/B7 232
/A0 1
The curve E: y2
/BP x3
/B7 ax /B7 b over /BY
p is deﬁned by:
a /BP /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY
/BY/BY/BY/BY/BY/BY/BY/BX /BY/BY/BY/BY/BY/BY/BY/BY /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BY/BY/BY/BY/BY/BY/BY/BV
b /BP /BU/BF/BF/BD/BE/BY/BT/BJ /BX/BE/BF/BX/BX/BJ/BX/BG /BL/BK/BK/BX/BC/BH/BI/BU /BX/BF/BY/BK/BE/BW/BD/BL /BD/BK/BD/BW/BL/BV/BI/BX /BY/BX/BK/BD/BG/BD/BD/BE /BC/BF/BD/BG/BC/BK/BK/BY
/BH/BC/BD/BF/BK/BJ/BH/BT /BV/BI/BH/BI/BF/BL/BK/BW /BK/BT/BE/BX/BW/BD/BL/BW /BE/BT/BK/BH/BV/BK/BX/BW /BW/BF/BX/BV/BE/BT/BX/BY
E was chosen veriﬁably at random as speciﬁed in ANSI X9.62 [1] from the seed:
S /BP /BT/BF/BF/BH/BL/BE/BI/BT /BT/BF/BD/BL/BT/BE/BJ/BT /BD/BW/BC/BC/BK/BL/BI/BT /BI/BJ/BJ/BF/BT/BG/BK/BE /BJ/BT/BV/BW/BT/BV/BJ/BF
The base point G in compressed form is:
G /BP /BC/BF /BT/BT/BK/BJ/BV/BT/BE/BE /BU/BX/BK/BU/BC/BH/BF/BJ /BK/BX/BU/BD/BV/BJ/BD/BX /BY/BF/BE/BC/BT/BW/BJ/BG /BI/BX/BD/BW/BF/BU/BI/BE /BK/BU/BT/BJ/BL/BU/BL/BK
/BH/BL/BY/BJ/BG/BD/BX/BC /BK/BE/BH/BG/BE/BT/BF/BK /BH/BH/BC/BE/BY/BE/BH/BW /BU/BY/BH/BH/BE/BL/BI/BV /BF/BT/BH/BG/BH/BX/BF/BK /BJ/BE/BJ/BI/BC/BT/BU/BJ
and in uncompressed form is:
G /BP /BC/BG /BT/BT/BK/BJ/BV/BT/BE/BE /BU/BX/BK/BU/BC/BH/BF/BJ /BK/BX/BU/BD/BV/BJ/BD/BX /BY/BF/BE/BC/BT/BW/BJ/BG /BI/BX/BD/BW/BF/BU/BI/BE /BK/BU/BT/BJ/BL/BU/BL/BK
/BH/BL/BY/BJ/BG/BD/BX/BC /BK/BE/BH/BG/BE/BT/BF/BK /BH/BH/BC/BE/BY/BE/BH/BW /BU/BY/BH/BH/BE/BL/BI/BV /BF/BT/BH/BG/BH/BX/BF/BK /BJ/BE/BJ/BI/BC/BT/BU/BJ /BF/BI/BD/BJ/BW/BX/BG/BT
/BL/BI/BE/BI/BE/BV/BI/BY /BH/BW/BL/BX/BL/BK/BU/BY /BL/BE/BL/BE/BW/BV/BE/BL /BY/BK/BY/BG/BD/BW/BU/BW /BE/BK/BL/BT/BD/BG/BJ/BV /BX/BL/BW/BT/BF/BD/BD/BF /BU/BH/BY/BC/BU/BK/BV/BC
/BC/BT/BI/BC/BU/BD/BV/BX /BD/BW/BJ/BX/BK/BD/BL/BW /BJ/BT/BG/BF/BD/BW/BJ/BV /BL/BC/BX/BT/BC/BX/BH/BY
Finally the order n of G and the cofactor are:
n /BP /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BV/BJ/BI/BF/BG/BW/BK/BD
/BY/BG/BF/BJ/BE/BW/BW/BY /BH/BK/BD/BT/BC/BW/BU/BE /BG/BK/BU/BC/BT/BJ/BJ/BT /BX/BV/BX/BV/BD/BL/BI/BT /BV/BV/BV/BH/BE/BL/BJ/BF
h /BP /BC/BD
2.9 Recommended 521-bit Elliptic Curve Domain Parameters over /BY
p
This section speciﬁes the recommended 521-bit elliptic curve domain parameters over /BY
p in this docu-
ment: veriﬁably random parameters secp521r1.
Section 2.9.1 speciﬁes the elliptic curve domain parameterssecp521r1.

2 Recommended Elliptic Curve Domain Parameters over /BY
p Page 17
2.9.1 Recommended Parameters secp521r1
The veriﬁably random elliptic curve domain parameters over /BY
p secp521r1 are speciﬁed by the sex-
tuple T /BP/B4 p/BN a/BN b/BN G/BN n/BN h/B5 where the ﬁnite ﬁeld /BY
p is deﬁned by:
p /BP /BC/BD/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY
/BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY
/BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY
/BP 2521
/A0 1
The curve E: y2
/BP x3
/B7 ax /B7 b over /BY
p is deﬁned by:
a /BP /BC/BD/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY
/BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY
/BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BV
b /BP /BC/BC/BH/BD /BL/BH/BF/BX/BU/BL/BI/BD /BK/BX/BD/BV/BL/BT/BD/BY /BL/BE/BL/BT/BE/BD/BT/BC /BU/BI/BK/BH/BG/BC/BX/BX /BT/BE/BW/BT/BJ/BE/BH/BU /BL/BL/BU/BF/BD/BH/BY/BF
/BU/BK/BU/BG/BK/BL/BL/BD /BK/BX/BY/BD/BC/BL/BX/BD /BH/BI/BD/BL/BF/BL/BH/BD /BX/BV/BJ/BX/BL/BF/BJ/BU /BD/BI/BH/BE/BV/BC/BU/BW /BF/BU/BU/BD/BU/BY/BC/BJ /BF/BH/BJ/BF/BW/BY/BK/BK
/BF/BW/BE/BV/BF/BG/BY/BD /BX/BY/BG/BH/BD/BY/BW/BG /BI/BU/BH/BC/BF/BY/BC/BC
E was chosen veriﬁably at random as speciﬁed in ANSI X9.62 [1] from the seed:
S /BP /BW/BC/BL/BX/BK/BK/BC/BC /BE/BL/BD/BV/BU/BK/BH/BF /BL/BI/BV/BV/BI/BJ/BD/BJ /BF/BL/BF/BE/BK/BG/BT/BT /BT/BC/BW/BT/BI/BG/BU/BT
The base point G in compressed form is:
G /BP /BC/BE/BC/BC/BV/BI /BK/BH/BK/BX/BC/BI/BU/BJ /BC/BG/BC/BG/BX/BL/BV/BW /BL/BX/BF/BX/BV/BU/BI/BI /BE/BF/BL/BH/BU/BG/BG/BE /BL/BV/BI/BG/BK/BD/BF/BL /BC/BH/BF/BY/BU/BH/BE/BD
/BY/BK/BE/BK/BT/BY/BI/BC /BI/BU/BG/BW/BF/BW/BU/BT /BT/BD/BG/BU/BH/BX/BJ/BJ /BX/BY/BX/BJ/BH/BL/BE/BK /BY/BX/BD/BW/BV/BD/BE/BJ /BT/BE/BY/BY/BT/BK/BW/BX /BF/BF/BG/BK/BU/BF/BV/BD
/BK/BH/BI/BT/BG/BE/BL/BU /BY/BL/BJ/BX/BJ/BX/BF/BD /BV/BE/BX/BH/BU/BW/BI/BI
and in uncompressed form is:
G /BP /BC/BG /BC/BC/BV/BI/BK/BH/BK/BX /BC/BI/BU/BJ/BC/BG/BC/BG /BX/BL/BV/BW/BL/BX/BF/BX /BV/BU/BI/BI/BE/BF/BL/BH /BU/BG/BG/BE/BL/BV/BI/BG /BK/BD/BF/BL/BC/BH/BF/BY
/BU/BH/BE/BD/BY/BK/BE/BK /BT/BY/BI/BC/BI/BU/BG/BW /BF/BW/BU/BT/BT/BD/BG/BU /BH/BX/BJ/BJ/BX/BY/BX/BJ /BH/BL/BE/BK/BY/BX/BD/BW /BV/BD/BE/BJ/BT/BE/BY/BY /BT/BK/BW/BX/BF/BF/BG/BK
/BU/BF/BV/BD/BK/BH/BI/BT /BG/BE/BL/BU/BY/BL/BJ/BX /BJ/BX/BF/BD/BV/BE/BX/BH /BU/BW/BI/BI/BC/BD/BD/BK /BF/BL/BE/BL/BI/BT/BJ/BK /BL/BT/BF/BU/BV/BC/BC/BG /BH/BV/BK/BT/BH/BY/BU/BG
/BE/BV/BJ/BW/BD/BU/BW/BL /BL/BK/BY/BH/BG/BG/BG/BL /BH/BJ/BL/BU/BG/BG/BI/BK /BD/BJ/BT/BY/BU/BW/BD/BJ /BE/BJ/BF/BX/BI/BI/BE/BV /BL/BJ/BX/BX/BJ/BE/BL/BL /BH/BX/BY/BG/BE/BI/BG/BC
/BV/BH/BH/BC/BU/BL/BC/BD /BF/BY/BT/BW/BC/BJ/BI/BD /BF/BH/BF/BV/BJ/BC/BK/BI /BT/BE/BJ/BE/BV/BE/BG/BC /BK/BK/BU/BX/BL/BG/BJ/BI /BL/BY/BW/BD/BI/BI/BH/BC
Finally the order n of G and the cofactor are:

Page 18 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 0.6
n /BP /BC/BD/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY
/BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BT /BH/BD/BK/BI/BK/BJ/BK/BF /BU/BY/BE/BY/BL/BI/BI/BU /BJ/BY/BV/BV/BC/BD/BG/BK /BY/BJ/BC/BL/BT/BH/BW/BC /BF/BU/BU/BH/BV/BL/BU/BK
/BK/BL/BL/BV/BG/BJ/BT/BX /BU/BU/BI/BY/BU/BJ/BD/BX /BL/BD/BF/BK/BI/BG/BC/BL
h /BP /BC/BD

3 Recommended Elliptic Curve Domain Parameters over /BY
2m Page 19
3 Recommended Elliptic Curve Domain Parameters over /BY
2m
This section speciﬁes the elliptic curve domain parameters over /BY
2m recommended in this document.
The section is organized as follows. First Section 3.1 describes relevant properties of the recommended
parameters over /BY
2m . Then Section 3.2 speciﬁes recommended 113-bit elliptic curve domain parameters
over /BY
2m , Section 3.3 speciﬁes recommended 131-bit elliptic curve domain parameters over /BY
2m , Sec-
tion 3.4 speciﬁes recommended 163-bit elliptic curve domain parameters over /BY
2m , Section 3.5 speciﬁes
recommended 193-bit elliptic curve domain parameters over /BY
2m , Section 3.6 speciﬁes recommended
233-bit elliptic curve domain parameters over /BY
2m , Section 3.7 speciﬁes recommended 239-bit elliptic
curve domain parameters over /BY
2m , Section 3.8 speciﬁes recommended 283-bit elliptic curve domain
parameters over /BY
2m , Section 3.9 speciﬁes recommended 409-bit elliptic curve domain parameters over
/BY
2m , and Section 3.10 speciﬁes recommended 571-bit elliptic curve domain parameters over /BY
2m .
3.1 Properties of Elliptic Curve Domain Parameters over /BY
2m
Following SEC 1 [10], elliptic curve domain parameters over /BY
2m are a septuple:
T /BP/B4 m/BN f /B4 x/B5 /BN a/BN b/BN G/BN n/BN h/B5
consisting of an integer m specifying the ﬁnite ﬁeld /BY
2m , an irreducible binary polynomial f /B4 x/B5 of degree
m specifying the polynomial basis representation of /BY
2m , two elements a/BN b /BE /BY
2m specifying an elliptic
curve E/B4 /BY
2m
/B5 deﬁned by the equation:
E : y2
/B7 x/BM y /BP x3
/B7 a/BM x2
/B7 b in /BY
2m
/BN
a base point G /BP/B4 xG
/BN yG
/B5 on E/B4 /BY
2m
/B5 ,ap r i m en which is the order of G, and an integer h which is the
cofactor h /BP #E/B4 /BY
2m
/B5 /BP n.
When elliptic curve domain parameters over/BY
2m are speciﬁed in this document, m is represented directly
as an integer, f /B4 x/B5 is represented directly as a polynomial, and the remaining components are represented
as octet strings converted using the conventions speciﬁed in SEC 1 [10].
Again following SEC 1 [10], elliptic curve domain parameters over /BY
2m must have:
m /BE/CU 113/BN 131/BN 163/BN 193/BN 233/BN 239/BN 283/BN 409/BN 571/CV /BM
Furthermore elliptic curve domain parameters over /BY
2m must use the reduction polynomials listed in
Table 3 below.
This restriction is designed to encourage interoperability while allowing implementers to supply efﬁcient
implementations at commonly required security levels.
Here recommended elliptic curve domain parameters are supplied at each of the sizes allowed by SEC 1.
The elliptic curve domain parameters over /BY
2m supplied at each security level typically consist of exam-
ples of two different types of parameters — one type being parameters associated with a Koblitz curve

Page 20 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 0.6
Field Reduction Polynomial(s)
/BY
2113 f /B4 x/B5/BP x113
/B7 x9
/B7 1
/BY
2131 f /B4 x/B5/BP x131
/B7 x8
/B7 x3
/B7 x2
/B7 1
/BY
2163 f /B4 x/B5/BP x163
/B7 x7
/B7 x6
/B7 x3
/B7 1
/BY
2193 f /B4 x/B5/BP x193
/B7 x15
/B7 1
/BY
2233 f /B4 x/B5/BP x233
/B7 x74
/B7 1
/BY
2239 f /B4 x/B5/BP x239
/B7 x36
/B7 1o r x239
/B7 x158
/B7 1
/BY
2283 f /B4 x/B5/BP x283
/B7 x12
/B7 x7
/B7 x5
/B7 1
/BY
2409 f /B4 x/B5/BP x409
/B7 x87
/B7 1
/BY
2571 f /B4 x/B5/BP x571
/B7 x10
/B7 x5
/B7 x2
/B7 1
Table 3: Representations of /BY
2m
and the other type being parameters chosen veriﬁably at random — although only veriﬁably random
parameters are supplied at export strength.
Parameters associated with a Koblitz curve admit especially efﬁcient implementation. Koblitz curves
over /BY
2m are binary anomalous curves which have a/BN b /BE/CU 0/BN 1/CV [6].
Veriﬁably random parameters offer some additional conservative features. These parameters are chosen
from a seed using SHA-1 as speciﬁed in ANSI X9.62 [1]. This process ensures that the parameters
cannot be predetermined. The parameters are therefore extremely unlikely to be susceptible to future
special-purpose attacks, and no trapdoors can have been placed in the parameters during their generation.
When elliptic curve domain parameters are chosen veriﬁably at random, the seed S used to generate the
parameters may optionally be stored along with the parameters so that users can verify the parameters
were chosen veriﬁably at random.
The recommended veriﬁably random parameters were chosen by repeatedly selecting a random seed and
counting the points on the corresponding curve using Schoof’s algorithm until appropriate parameters
were found. The parameters were chosen so that eithera is random ora
/BP 1. For a givenm, approximately
half the isomorphism classes of elliptic curves over /BY
2m contain a curve with a /BP 1.
See SEC 1 [10] for further guidance on the selection of elliptic curve domain parameters over /BY
2m .
The example elliptic curve domain parameters over /BY
2m have been given nicknames to enable them to
be easily identiﬁed. The nicknames were chosen as follows. Each name begins with sec to denote
‘Standards for Efﬁcient Cryptography’, followed by a t to denote parameters over /BY
2m ,f o l l o w e db ya
number denoting the ﬁeld size m,f o l l o w e db yak to denote parameters associated with a Koblitz curve
or anr to denote veriﬁably random parameters, followed by a sequence number.
Table 4 summarizes salient properties of the recommended elliptic curve domain parameters over /BY
2m .

3 Recommended Elliptic Curve Domain Parameters over /BY
2m Page 21
Information is represented in Table 4 as follows. The column labelled ‘parameters’ gives the nickname of
the elliptic curve domain parameters. The column labelled ‘section’ refers to the section of this document
where the parameters are speciﬁed. The column labelled ‘strength’ gives the approximate number of bits
of security the parameters offer. The column labelled ‘size’ gives the ﬁeld size m. The column labelled
‘RSA/DSA’ gives the approximate size of an RSA or DSA modulus at comparable strength. (See SEC
1 [10] for precise technical guidance on the strength of elliptic curve domain parameters.) Finally the
column labelled ‘Koblitz or random’ indicates whether the parameters are associated with a Koblitz curve
— ‘k’ — or were chosen veriﬁably at random — ‘r’.
Table 5 summarizes the status of the recommended elliptic curve domain parameters over
/BY
2m with re-
spect to their alignment with other standards.
Information is represented in Table 5 as follows. The column labelled ‘parameters’ gives the nickname
of the elliptic curve domain parameters. The column labelled ‘section’ refers to the section of this docu-
ment where the parameters are speciﬁed. The remaining columns give the status of the parameters with
respect to various other standards which specify mechanisms based on elliptic curve cryptography: ‘ANSI
X9.62’ refers to the ANSI X9.62 standard [1], ‘ANSI X9.63’ refers to the draft ANSI X9.63 standard [2],
‘echeck’ refers to the draft FSML standard [4], ‘IEEE P1363’ refers to the draft IEEE P1363 standard [5],
‘IPSec’ refers to the recent internet draft related to ECC [9] submitted to the IETF’s IPSec working group,
‘NIST’ refers to the list of recommended parameters recently released by the U.S. government [8], and
’W AP’ refers to the Wireless Application Forum’s WTLS standard [11]. In these columns, a ‘-’ denotes
parameters non-conformant with the standard, a ‘c’ denotes parameters conformant with the standard,
and an ‘r’ denotes parameters explicitly recommended in the standard.
3.2 Recommended 113-bit Elliptic Curve Domain Parameters over /BY
2m
This section speciﬁes the two recommended 113-bit elliptic curve domain parameters over /BY
2m in this
document: veriﬁably random parameterssect113r1, and veriﬁably random parameterssect113r2.
Section 3.2.1 speciﬁes the elliptic curve domain parameterssect113r1, and Section 3.2.2 speciﬁes the
elliptic curve domain parameterssect113r2.
3.2.1 Recommended Parameters sect113r1
The veriﬁably random elliptic curve domain parameters over /BY
2m sect113r1 are speciﬁed by the sep-
tuple T /BP/B4 m/BN f /B4 x/B5 /BN a/BN b/BN G/BN n/BN h/B5 where m /BP 113 and the representation of /BY
2113 is deﬁned by:
f /B4 x/B5 /BP x113
/B7 x9
/B7 1
The curve E: y2
/B7 xy /BP x3
/B7 ax2
/B7 b over /BY
2m is deﬁned by:
a /BP /BC/BC/BF/BC/BK/BK /BE/BH/BC/BV/BT/BI/BX/BJ /BV/BJ/BY/BX/BI/BG/BL/BV /BX/BK/BH/BK/BE/BC/BY/BJ
b /BP /BC/BC/BX/BK/BU/BX /BX/BG/BW/BF/BX/BE/BE/BI /BC/BJ/BG/BG/BD/BK/BK/BU /BX/BC/BX/BL/BV/BJ/BE/BF
E was chosen veriﬁably at random as speciﬁed in ANSI X9.62 [1] from the seed:

Page 22 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 0.6
S /BP /BD/BC/BX/BJ/BE/BF/BT/BU /BD/BG/BW/BI/BL/BI/BX/BI /BJ/BI/BK/BJ/BH/BI/BD/BH /BD/BJ/BH/BI/BY/BX/BU/BY /BK/BY/BV/BU/BG/BL/BT/BL
The base point G in compressed form is:
G /BP /BC/BF/BC/BC/BL/BW/BJ/BF /BI/BD/BI/BY/BF/BH/BY/BG /BT/BU/BD/BG/BC/BJ/BW/BJ /BF/BH/BI/BE/BV/BD/BC/BY
and in uncompressed form is:
G /BP /BC/BG/BC/BC/BL/BW /BJ/BF/BI/BD/BI/BY/BF/BH /BY/BG/BT/BU/BD/BG/BC/BJ /BW/BJ/BF/BH/BI/BE/BV/BD /BC/BY/BC/BC/BT/BH/BE/BK /BF/BC/BE/BJ/BJ/BL/BH/BK /BX/BX/BK/BG/BW/BD/BF/BD
/BH/BX/BW/BF/BD/BK/BK/BI
Finally the order n of G and the cofactor are:
n /BP /BC/BD/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BW/BL/BV/BV/BX/BV /BK/BT/BF/BL/BX/BH/BI/BY
h /BP /BC/BE
3.2.2 Recommended Parameters sect113r2
The veriﬁably random elliptic curve domain parameters over /BY
2m sect113r2 are speciﬁed by the sep-
tuple T /BP/B4 m/BN f /B4 x/B5 /BN a/BN b/BN G/BN n/BN h/B5 where m /BP 113 and the representation of /BY
2113 is deﬁned by:
f /B4 x/B5 /BP x113
/B7 x9
/B7 1
The curve E: y2
/B7 xy /BP x3
/B7 ax2
/B7 b over /BY
2m is deﬁned by:
a /BP /BC/BC/BI/BK/BL/BL /BD/BK/BW/BU/BX/BV/BJ/BX /BH/BT/BC/BW/BW/BI/BW/BY /BV/BC/BT/BT/BH/BH/BV/BJ
b /BP /BC/BC/BL/BH/BX/BL /BT/BL/BX/BV/BL/BU/BE/BL /BJ/BU/BW/BG/BU/BY/BF/BI /BX/BC/BH/BL/BD/BK/BG/BY
E was chosen veriﬁably at random as speciﬁed in ANSI X9.62 [1] from the seed:
S /BP /BD/BC/BV/BC/BY/BU/BD/BH /BJ/BI/BC/BK/BI/BC/BW/BX /BY/BD/BX/BX/BY/BG/BW/BI /BL/BI/BX/BI/BJ/BI/BK/BJ /BH/BI/BD/BH/BD/BJ/BH/BW
The base point G in compressed form is:
G /BP /BC/BF/BC/BD/BT/BH/BJ/BT /BI/BT/BJ/BU/BE/BI/BV/BT /BH/BX/BY/BH/BE/BY/BV/BW /BU/BK/BD/BI/BG/BJ/BL/BJ
and in uncompressed form is:
G /BP /BC/BG/BC/BD/BT/BH /BJ/BT/BI/BT/BJ/BU/BE/BI /BV/BT/BH/BX/BY/BH/BE/BY /BV/BW/BU/BK/BD/BI/BG/BJ /BL/BJ/BC/BC/BU/BF/BT/BW /BV/BL/BG/BX/BW/BD/BY/BX /BI/BJ/BG/BV/BC/BI/BX/BI
/BL/BH/BU/BT/BU/BT/BD/BW
Finally the order n of G and the cofactor are:
n /BP /BC/BD/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BD/BC/BK/BJ/BK/BL/BU /BE/BG/BL/BI/BT/BY/BL/BF
h /BP /BC/BE

3 Recommended Elliptic Curve Domain Parameters over /BY
2m Page 23
3.3 Recommended 131-bit Elliptic Curve Domain Parameters over /BY
2m
This section speciﬁes the two recommended 131-bit elliptic curve domain parameters over /BY
2m in this
document: veriﬁably random parameterssect131r1, and veriﬁably random parameterssect131r2.
Section 3.3.1 speciﬁes the elliptic curve domain parameterssect131r1, and Section 3.3.2 speciﬁes the
elliptic curve domain parameterssect131r2.
3.3.1 Recommended Parameters sect131r1
The veriﬁably random elliptic curve domain parameters over /BY
2m sect131r1 are speciﬁed by the sep-
tuple T /BP/B4 m/BN f /B4 x/B5 /BN a/BN b/BN G/BN n/BN h/B5 where m /BP 131 and the representation of /BY
2131 is deﬁned by:
f /B4 x/B5 /BP x131
/B7 x8
/B7 x3
/B7 x2
/B7 1
The curve E: y2
/B7 xy /BP x3
/B7 ax2
/B7 b over /BY
2m is deﬁned by:
a /BP /BC/BJ /BT/BD/BD/BU/BC/BL/BT/BJ /BI/BU/BH/BI/BE/BD/BG/BG /BG/BD/BK/BY/BY/BF/BY/BY /BK/BV/BE/BH/BJ/BC/BU/BK
b /BP /BC/BE /BD/BJ/BV/BC/BH/BI/BD/BC /BK/BK/BG/BU/BI/BF/BU/BL /BV/BI/BV/BJ/BE/BL/BD/BI /BJ/BK/BY/BL/BW/BF/BG/BD
E was chosen veriﬁably at random as speciﬁed in ANSI X9.62 [1] from the seed:
S /BP /BG/BW/BI/BL/BI/BX/BI/BJ /BI/BK/BJ/BH/BI/BD/BH/BD /BJ/BH/BL/BK/BH/BU/BW/BF /BT/BW/BU/BT/BW/BT/BE/BD /BU/BG/BF/BT/BL/BJ/BX/BE
The base point G in compressed form is:
G /BP /BC/BF/BC/BC /BK/BD/BU/BT/BY/BL/BD/BY /BW/BY/BL/BK/BF/BF/BV/BG /BC/BY/BL/BV/BD/BK/BD/BF /BG/BF/BI/BF/BK/BF/BL/BL
and in uncompressed form is:
G /BP /BC/BG/BC/BC/BK/BD /BU/BT/BY/BL/BD/BY/BW/BY /BL/BK/BF/BF/BV/BG/BC/BY /BL/BV/BD/BK/BD/BF/BG/BF /BI/BF/BK/BF/BL/BL/BC/BJ /BK/BV/BI/BX/BJ/BX/BT/BF /BK/BV/BC/BC/BD/BY/BJ/BF
/BV/BK/BD/BF/BG/BU/BD/BU /BG/BX/BY/BL/BX/BD/BH/BC
Finally the order n of G and the cofactor are:
n /BP /BC/BG /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BE /BF/BD/BE/BF/BL/BH/BF/BT /BL/BG/BI/BG/BU/BH/BG/BW
h /BP /BC/BE
3.3.2 Recommended Parameters sect131r2
The veriﬁably random elliptic curve domain parameters over /BY
2m sect131r2 are speciﬁed by the sep-
tuple T /BP/B4 m/BN f /B4 x/B5 /BN a/BN b/BN G/BN n/BN h/B5 where m /BP 131 and the representation of /BY
2131 is deﬁned by:
f /B4 x/B5 /BP x131
/B7 x8
/B7 x3
/B7 x2
/B7 1
The curve E: y2
/B7 xy /BP x3
/B7 ax2
/B7 b over /BY
2m is deﬁned by:

Page 24 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 0.6
a /BP /BC/BF /BX/BH/BT/BK/BK/BL/BD/BL /BW/BJ/BV/BT/BY/BV/BU/BY /BG/BD/BH/BY/BC/BJ/BV/BE /BD/BJ/BI/BH/BJ/BF/BU/BE
b /BP /BC/BG /BU/BK/BE/BI/BI/BT/BG/BI /BV/BH/BH/BI/BH/BJ/BT/BV /BJ/BF/BG/BV/BX/BF/BK/BY /BC/BD/BK/BY/BE/BD/BL/BE
E was chosen veriﬁably at random as speciﬁed in ANSI X9.62 [1] from the seed:
S /BP /BL/BK/BH/BU/BW/BF/BT/BW /BU/BT/BW/BG/BW/BI/BL/BI /BX/BI/BJ/BI/BK/BJ/BH/BI /BD/BH/BD/BJ/BH/BT/BE/BD /BU/BG/BF/BT/BL/BJ/BX/BF
The base point G in compressed form is:
G /BP /BC/BF/BC/BF /BH/BI/BW/BV/BW/BK/BY/BE /BY/BL/BH/BC/BF/BD/BT/BW /BI/BH/BE/BW/BE/BF/BL/BH /BD/BU/BU/BF/BI/BI/BT/BK
and in uncompressed form is:
G /BP /BC/BG/BC/BF/BH/BI /BW/BV/BW/BK/BY/BE/BY/BL /BH/BC/BF/BD/BT/BW/BI/BH /BE/BW/BE/BF/BL/BH/BD/BU /BU/BF/BI/BI/BT/BK/BC/BI /BG/BK/BY/BC/BI/BW/BK/BI /BJ/BL/BG/BC/BT/BH/BF/BI
/BI/BW/BL/BX/BE/BI/BH/BW /BX/BL/BX/BU/BE/BG/BC/BY
Finally the order n of G and the cofactor are:
n /BP /BC/BG /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BD /BI/BL/BH/BG/BT/BE/BF/BF /BC/BG/BL/BU/BT/BL/BK/BY
h /BP /BC/BE
3.4 Recommended 163-bit Elliptic Curve Domain Parameters over /BY
2m
This section speciﬁes the three recommended 163-bit elliptic curve domain parameters over /BY
2m in
this document: parameters sect163k1 associated with a Koblitz curve, veriﬁably random parameters
sect163r1, and veriﬁably random parameterssect163r2.
Section 3.4.1 speciﬁes the elliptic curve domain parameters sect163k1, Section 3.4.2 speciﬁes the
elliptic curve domain parameters sect163r1, and Section 3.4.3 speciﬁes the elliptic curve domain
parameterssect163r2.
3.4.1 Recommended Parameters sect163k1
The elliptic curve domain parameters over/BY
2m associated with a Koblitz curvesect163k1 are speciﬁed
by the septuple T /BP/B4 m/BN f /B4 x/B5 /BN a/BN b/BN G/BN n/BN h/B5 where m /BP 163 and the representation of /BY
2163 is deﬁned by:
f /B4 x/B5 /BP x163
/B7 x7
/B7 x6
/B7 x3
/B7 1
The curve E: y2
/B7 xy /BP x3
/B7 ax2
/B7 b over /BY
2m is deﬁned by:
a /BP /BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BD
b /BP /BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BD
The base point G in compressed form is:
G /BP /BC/BF/BC/BE /BY/BX/BD/BF/BV/BC/BH/BF /BJ/BU/BU/BV/BD/BD/BT/BV /BT/BT/BC/BJ/BW/BJ/BL/BF /BW/BX/BG/BX/BI/BW/BH/BX /BH/BV/BL/BG/BX/BX/BX/BK

3 Recommended Elliptic Curve Domain Parameters over /BY
2m Page 25
and in uncompressed form is:
G /BP /BC/BG/BC/BE/BY/BX /BD/BF/BV/BC/BH/BF/BJ/BU /BU/BV/BD/BD/BT/BV/BT/BT /BC/BJ/BW/BJ/BL/BF/BW/BX /BG/BX/BI/BW/BH/BX/BH/BV /BL/BG/BX/BX/BX/BK/BC/BE /BK/BL/BC/BJ/BC/BY/BU/BC
/BH/BW/BF/BK/BY/BY/BH/BK /BF/BE/BD/BY/BE/BX/BK/BC /BC/BH/BF/BI/BW/BH/BF/BK /BV/BV/BW/BT/BT/BF/BW/BL
Finally the order n of G and the cofactor are:
n /BP /BC/BG /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BE/BC/BD/BC/BK /BT/BE/BX/BC/BV/BV/BC/BW /BL/BL/BY/BK/BT/BH/BX/BY
h /BP /BC/BE
3.4.2 Recommended Parameters sect163r1
The veriﬁably random elliptic curve domain parameters over /BY
2m sect163r1 are speciﬁed by the sep-
tuple T /BP/B4 m/BN f /B4 x/B5 /BN a/BN b/BN G/BN n/BN h/B5 where m /BP 163 and the representation of /BY
2163 is deﬁned by:
f /B4 x/B5 /BP x163
/B7 x7
/B7 x6
/B7 x3
/B7 1
The curve E: y2
/B7 xy /BP x3
/B7 ax2
/B7 b over /BY
2m is deﬁned by:
a /BP /BC/BJ /BU/BI/BK/BK/BE/BV/BT/BT /BX/BY/BT/BK/BG/BY/BL/BH /BH/BG/BY/BY/BK/BG/BE/BK /BU/BW/BK/BK/BX/BE/BG/BI /BW/BE/BJ/BK/BE/BT/BX/BE
b /BP /BC/BJ /BD/BF/BI/BD/BE/BW/BV/BW /BW/BV/BU/BG/BC/BT/BT/BU /BL/BG/BI/BU/BW/BT/BE/BL /BV/BT/BL/BD/BY/BJ/BF/BT /BY/BL/BH/BK/BT/BY/BW/BL
E was chosen veriﬁably at random from the seed:
S /BP /BE/BG/BU/BJ/BU/BD/BF/BJ /BV/BK/BT/BD/BG/BW/BI/BL /BI/BX/BI/BJ/BI/BK/BJ/BH /BI/BD/BH/BD/BJ/BH/BI/BY /BW/BC/BW/BT/BE/BX/BH/BV
However for historical reasons the method used to generateE from S differs slightly from the method de-
scribed in ANSI X9.62 [1]. Speciﬁcally the coefﬁcient b produced from S is the reverse of the coefﬁcient
that would have been produced by the method described in ANSI X9.62.
The base point G in compressed form is:
G /BP /BC/BF/BC/BF /BI/BL/BL/BJ/BL/BI/BL/BJ /BT/BU/BG/BF/BK/BL/BJ/BJ /BK/BL/BH/BI/BI/BJ/BK/BL /BH/BI/BJ/BY/BJ/BK/BJ/BT /BJ/BK/BJ/BI/BT/BI/BH/BG
and in uncompressed form is:
G /BP /BC/BG/BC/BF/BI/BL /BL/BJ/BL/BI/BL/BJ/BT/BU /BG/BF/BK/BL/BJ/BJ/BK/BL /BH/BI/BI/BJ/BK/BL/BH/BI /BJ/BY/BJ/BK/BJ/BT/BJ/BK /BJ/BI/BT/BI/BH/BG/BC/BC /BG/BF/BH/BX/BW/BU/BG/BE
/BX/BY/BT/BY/BU/BE/BL/BK /BL/BW/BH/BD/BY/BX/BY/BV /BX/BF/BV/BK/BC/BL/BK/BK /BY/BG/BD/BY/BY/BK/BK/BF
Finally the order n of G and the cofactor are:
n /BP /BC/BF /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BG/BK/BT/BT /BU/BI/BK/BL/BV/BE/BL/BV /BT/BJ/BD/BC/BE/BJ/BL/BU
h /BP /BC/BE

Page 26 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 0.6
3.4.3 Recommended Parameters sect163r2
The veriﬁably random elliptic curve domain parameters over /BY
2m sect163r2 are speciﬁed by the sep-
tuple T /BP/B4 m/BN f /B4 x/B5 /BN a/BN b/BN G/BN n/BN h/B5 where m /BP 163 and the representation of /BY
2163 is deﬁned by:
f /B4 x/B5 /BP x163
/B7 x7
/B7 x6
/B7 x3
/B7 1
The curve E: y2
/B7 xy /BP x3
/B7 ax2
/B7 b over /BY
2m is deﬁned by:
a /BP /BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BD
b /BP /BC/BE /BC/BT/BI/BC/BD/BL/BC/BJ /BU/BK/BV/BL/BH/BF/BV/BT /BD/BG/BK/BD/BX/BU/BD/BC /BH/BD/BE/BY/BJ/BK/BJ/BG /BG/BT/BF/BE/BC/BH/BY/BW
E was chosen veriﬁably at random from the seed:
S /BP /BK/BH/BX/BE/BH/BU/BY/BX /BH/BV/BK/BI/BE/BE/BI/BV /BW/BU/BD/BE/BC/BD/BI/BY /BJ/BH/BH/BF/BY/BL/BW/BC /BX/BI/BL/BF/BT/BE/BI/BK
E was selected from S as speciﬁed in ANSI X9.62 [1] in normal basis representation and converted into
polynomial basis representation.
The base point G in compressed form is:
G /BP /BC/BF/BC/BF /BY/BC/BX/BU/BT/BD/BI/BE /BK/BI/BT/BE/BW/BH/BJ/BX /BT/BC/BL/BL/BD/BD/BI/BK /BW/BG/BL/BL/BG/BI/BF/BJ /BX/BK/BF/BG/BF/BX/BF/BI
and in uncompressed form is:
G /BP /BC/BG/BC/BF/BY/BC /BX/BU/BT/BD/BI/BE/BK/BI /BT/BE/BW/BH/BJ/BX/BT/BC /BL/BL/BD/BD/BI/BK/BW/BG /BL/BL/BG/BI/BF/BJ/BX/BK /BF/BG/BF/BX/BF/BI/BC/BC /BW/BH/BD/BY/BU/BV/BI/BV
/BJ/BD/BT/BC/BC/BL/BG/BY /BT/BE/BV/BW/BW/BH/BG/BH /BU/BD/BD/BV/BH/BV/BC/BV /BJ/BL/BJ/BF/BE/BG/BY/BD
Finally the order n of G and the cofactor are:
n /BP /BC/BG /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BE/BL/BE/BY/BX /BJ/BJ/BX/BJ/BC/BV/BD/BE /BT/BG/BE/BF/BG/BV/BF/BF
h /BP /BC/BE
3.5 Recommended 193-bit Elliptic Curve Domain Parameters over /BY
2m
This section speciﬁes the two recommended 193-bit elliptic curve domain parameters over /BY
2m in this
document: veriﬁably random parameterssect193r1, and veriﬁably random parameterssect193r1.
Section 3.5.1 speciﬁes the elliptic curve domain parameterssect193r1, and Section 3.5.2 speciﬁes the
elliptic curve domain parameterssect193r2.
3.5.1 Recommended Parameters sect193r1
The veriﬁably random elliptic curve domain parameters over /BY
2m sect193r1 are speciﬁed by the sep-
tuple T /BP/B4 m/BN f /B4 x/B5 /BN a/BN b/BN G/BN n/BN h/B5 where m /BP 193 and the representation of /BY
2193 is deﬁned by:
f /B4 x/B5 /BP x193
/B7 x15
/B7 1

3 Recommended Elliptic Curve Domain Parameters over /BY
2m Page 27
The curve E: y2
/B7 xy /BP x3
/B7 ax2
/B7 b over /BY
2m is deﬁned by:
a /BP /BC/BC /BD/BJ/BK/BH/BK/BY/BX/BU /BJ/BT/BL/BK/BL/BJ/BH/BD /BI/BL/BX/BD/BJ/BD/BY/BJ /BJ/BU/BG/BC/BK/BJ/BW/BX /BC/BL/BK/BT/BV/BK/BT/BL /BD/BD/BW/BY/BJ/BU/BC/BD
b /BP /BC/BC /BY/BW/BY/BU/BG/BL/BU/BY /BX/BI/BV/BF/BT/BK/BL/BY /BT/BV/BT/BW/BT/BT/BJ/BT /BD/BX/BH/BU/BU/BV/BJ/BV /BV/BD/BV/BE/BX/BH/BW/BK /BF/BD/BG/BJ/BK/BK/BD/BG
E was chosen veriﬁably at random as speciﬁed in ANSI X9.62 [1] from the seed:
S /BP /BD/BC/BF/BY/BT/BX/BV/BJ /BG/BW/BI/BL/BI/BX/BI/BJ /BI/BK/BJ/BH/BI/BD/BH/BD /BJ/BH/BJ/BJ/BJ/BY/BV/BH /BU/BD/BL/BD/BX/BY/BF/BC
The base point G in compressed form is:
G /BP /BC/BF/BC/BD /BY/BG/BK/BD/BU/BV/BH/BY /BC/BY/BY/BK/BG/BT/BJ/BG /BT/BW/BI/BV/BW/BY/BI/BY /BW/BX/BY/BG/BU/BY/BI/BD /BJ/BL/BI/BE/BH/BF/BJ/BE /BW/BK/BV/BC/BV/BH/BX/BD
and in uncompressed form is:
G /BP /BC/BG/BC/BD/BY/BG /BK/BD/BU/BV/BH/BY/BC/BY /BY/BK/BG/BT/BJ/BG/BT/BW /BI/BV/BW/BY/BI/BY/BW/BX /BY/BG/BU/BY/BI/BD/BJ/BL /BI/BE/BH/BF/BJ/BE/BW/BK /BV/BC/BV/BH/BX/BD/BC/BC
/BE/BH/BX/BF/BL/BL/BY/BE /BL/BC/BF/BJ/BD/BE/BV/BV /BY/BF/BX/BT/BL/BX/BF/BT /BD/BT/BW/BD/BJ/BY/BU/BC /BU/BF/BE/BC/BD/BU/BI/BT /BY/BJ/BV/BX/BD/BU/BC/BH
Finally the order n of G and the cofactor are:
n /BP /BC/BD /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BV/BJ/BY/BF/BG/BT/BJ/BJ /BK/BY/BG/BG/BF/BT/BV/BV /BL/BE/BC/BX/BU/BT/BG/BL
h /BP /BC/BE
3.5.2 Recommended Parameters sect193r2
The veriﬁably random elliptic curve domain parameters over /BY
2m sect193r2 are speciﬁed by the sep-
tuple T /BP/B4 m/BN f /B4 x/B5 /BN a/BN b/BN G/BN n/BN h/B5 where m /BP 193 and the representation of /BY
2193 is deﬁned by:
f /B4 x/B5 /BP x193
/B7 x15
/B7 1
The curve E: y2
/B7 xy /BP x3
/B7 ax2
/B7 b over /BY
2m is deﬁned by:
a /BP /BC/BD /BI/BF/BY/BF/BH/BT/BH/BD /BF/BJ/BV/BE/BV/BX/BF/BX /BT/BI/BX/BW/BK/BI/BI/BJ /BD/BL/BC/BU/BC/BU/BV/BG /BF/BX/BV/BW/BI/BL/BL/BJ /BJ/BJ/BC/BE/BJ/BC/BL/BU
b /BP /BC/BC /BV/BL/BU/BU/BL/BX/BK/BL /BE/BJ/BW/BG/BW/BI/BG/BV /BF/BJ/BJ/BX/BE/BT/BU/BE /BK/BH/BI/BT/BH/BU/BD/BI /BX/BF/BX/BY/BU/BJ/BY/BI /BD/BW/BG/BF/BD/BI/BT/BX
E was chosen veriﬁably at random as speciﬁed in ANSI X9.62 [1] from the seed:
S /BP /BD/BC/BU/BJ/BU/BG/BW/BI /BL/BI/BX/BI/BJ/BI/BK/BJ /BH/BI/BD/BH/BD/BJ/BH/BD /BF/BJ/BV/BK/BT/BD/BI/BY /BW/BC/BW/BT/BE/BE/BD/BD
The base point G in compressed form is:
G /BP /BC/BF/BC/BC /BW/BL/BU/BI/BJ/BW/BD/BL /BE/BX/BC/BF/BI/BJ/BV/BK /BC/BF/BY/BF/BL/BX/BD/BT /BJ/BX/BK/BE/BV/BT/BD/BG /BT/BI/BH/BD/BF/BH/BC/BT /BT/BX/BI/BD/BJ/BX/BK/BY
and in uncompressed form is:
G /BP /BC/BG/BC/BC/BW/BL /BU/BI/BJ/BW/BD/BL/BE/BX /BC/BF/BI/BJ/BV/BK/BC/BF /BY/BF/BL/BX/BD/BT/BJ/BX /BK/BE/BV/BT/BD/BG/BT/BI /BH/BD/BF/BH/BC/BT/BT/BX /BI/BD/BJ/BX/BK/BY/BC/BD
/BV/BX/BL/BG/BF/BF/BH/BI /BC/BJ/BV/BF/BC/BG/BT/BV /BE/BL/BX/BJ/BW/BX/BY/BU /BW/BL/BV/BT/BC/BD/BY/BH /BL/BI/BY/BL/BE/BJ/BE/BE /BG/BV/BW/BX/BV/BY/BI/BV
Finally the order n of G and the cofactor are:

Page 28 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 0.6
n /BP /BC/BD /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BD /BH/BT/BT/BU/BH/BI/BD/BU /BC/BC/BH/BG/BD/BF/BV/BV /BW/BG/BX/BX/BL/BL/BW/BH
h /BP /BC/BE
3.6 Recommended 233-bit Elliptic Curve Domain Parameters over /BY
2m
This section speciﬁes the two recommended 233-bit elliptic curve domain parameters over /BY
2m in this
document: parameters sect233k1 associated with a Koblitz curve, and veriﬁably random parameters
sect233r1.
Section 3.6.1 speciﬁes the elliptic curve domain parameterssect233k1, and Section 3.6.2 speciﬁes the
elliptic curve domain parameterssect233r1.
3.6.1 Recommended Parameters sect233k1
The elliptic curve domain parameters over/BY
2m associated with a Koblitz curvesect233k1 are speciﬁed
by the septuple T /BP/B4 m/BN f /B4 x/B5 /BN a/BN b/BN G/BN n/BN h/B5 where m /BP 233 and the representation of /BY
2233 is deﬁned by:
f /B4 x/B5 /BP x233
/B7 x74
/B7 1
The curve E: y2
/B7 xy /BP x3
/B7 ax2
/B7 b over /BY
2m is deﬁned by:
a /BP /BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC
/BC/BC/BC/BC/BC/BC/BC/BC
b /BP /BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC
/BC/BC/BC/BC/BC/BC/BC/BD
The base point G in compressed form is:
G /BP /BC/BE/BC/BD/BJ/BE /BF/BE/BU/BT/BK/BH/BF/BT /BJ/BX/BJ/BF/BD/BT/BY/BD /BE/BL/BY/BE/BE/BY/BY/BG /BD/BG/BL/BH/BI/BF/BT/BG /BD/BL/BV/BE/BI/BU/BY/BH /BC/BT/BG/BV/BL/BW/BI/BX
/BX/BY/BT/BW/BI/BD/BE/BI
and in uncompressed form is:
G /BP /BC/BG /BC/BD/BJ/BE/BF/BE/BU/BT /BK/BH/BF/BT/BJ/BX/BJ/BF /BD/BT/BY/BD/BE/BL/BY/BE /BE/BY/BY/BG/BD/BG/BL/BH /BI/BF/BT/BG/BD/BL/BV/BE /BI/BU/BY/BH/BC/BT/BG/BV
/BL/BW/BI/BX/BX/BY/BT/BW /BI/BD/BE/BI/BC/BD/BW/BU /BH/BF/BJ/BW/BX/BV/BX/BK /BD/BL/BU/BJ/BY/BJ/BC/BY /BH/BH/BH/BT/BI/BJ/BV/BG /BE/BJ/BT/BK/BV/BW/BL/BU /BY/BD/BK/BT/BX/BU/BL/BU
/BH/BI/BX/BC/BV/BD/BD/BC/BH/BI/BY/BT/BX/BI/BT/BF
Finally the order n of G and the cofactor are:
n /BP /BK/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BI/BL/BW/BH/BU /BU/BL/BD/BH/BU/BV/BW/BG /BI/BX/BY/BU/BD/BT/BW/BH
/BY/BD/BJ/BF/BT/BU/BW/BY
h /BP /BC/BG

3 Recommended Elliptic Curve Domain Parameters over /BY
2m Page 29
3.6.2 Recommended Parameters sect233r1
The veriﬁably random elliptic curve domain parameters over /BY
2m sect233r1 are speciﬁed by the sep-
tuple T /BP/B4 m/BN f /B4 x/B5 /BN a/BN b/BN G/BN n/BN h/B5 where m /BP 233 and the representation of /BY
2233 is deﬁned by:
f /B4 x/B5 /BP x233
/B7 x74
/B7 1
The curve E: y2
/B7 xy /BP x3
/B7 ax2
/B7 b over /BY
2m is deﬁned by:
a /BP /BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC
/BC/BC/BC/BC/BC/BC/BC/BD
b /BP /BC/BC/BI/BI /BI/BG/BJ/BX/BW/BX/BI/BV /BF/BF/BE/BV/BJ/BY/BK/BV /BC/BL/BE/BF/BU/BU/BH/BK /BE/BD/BF/BU/BF/BF/BF/BU /BE/BC/BX/BL/BV/BX/BG/BE /BK/BD/BY/BX/BD/BD/BH/BY
/BJ/BW/BK/BY/BL/BC/BT/BW
E was chosen veriﬁably at random from the seed:
S /BP /BJ/BG/BW/BH/BL/BY/BY/BC /BJ/BY/BI/BU/BG/BD/BF/BW /BC/BX/BT/BD/BG/BU/BF/BG /BG/BU/BE/BC/BT/BE/BW/BU /BC/BG/BL/BU/BH/BC/BV/BF
E was selected from S as speciﬁed in ANSI X9.62 [1] in normal basis representation and converted into
polynomial basis representation.
The base point G in compressed form is:
G /BP /BC/BF/BC/BC/BY/BT /BV/BL/BW/BY/BV/BU/BT/BV /BK/BF/BD/BF/BU/BU/BE/BD /BF/BL/BY/BD/BU/BU/BJ/BH /BH/BY/BX/BY/BI/BH/BU/BV /BF/BL/BD/BY/BK/BU/BF/BI /BY/BK/BY/BK/BX/BU/BJ/BF
/BJ/BD/BY/BW/BH/BH/BK/BU
and in uncompressed form is:
G /BP /BC/BG /BC/BC/BY/BT/BV/BL/BW/BY /BV/BU/BT/BV/BK/BF/BD/BF /BU/BU/BE/BD/BF/BL/BY/BD /BU/BU/BJ/BH/BH/BY/BX/BY /BI/BH/BU/BV/BF/BL/BD/BY /BK/BU/BF/BI/BY/BK/BY/BK
/BX/BU/BJ/BF/BJ/BD/BY/BW /BH/BH/BK/BU/BC/BD/BC/BC /BI/BT/BC/BK/BT/BG/BD/BL /BC/BF/BF/BH/BC/BI/BJ/BK /BX/BH/BK/BH/BE/BK/BU/BX /BU/BY/BK/BT/BC/BU/BX/BY /BY/BK/BI/BJ/BT/BJ/BV/BT
/BF/BI/BJ/BD/BI/BY/BJ/BX /BC/BD/BY/BK/BD/BC/BH/BE
Finally the order n of G and the cofactor are:
n /BP /BC/BD/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BD/BF/BX/BL/BJ/BG /BX/BJ/BE/BY/BK/BT/BI/BL /BE/BE/BC/BF/BD/BW/BE/BI
/BC/BF/BV/BY/BX/BC/BW/BJ
h /BP /BC/BE
3.7 Recommended 239-bit Elliptic Curve Domain Parameters over /BY
2m
This section speciﬁes the recommended 239-bit elliptic curve domain parameters over /BY
2m in this docu-
ment: parameters sect239k1 associated with a Koblitz curve.
Section 3.7.1 speciﬁes the elliptic curve domain parameterssect239k1.

Page 30 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 0.6
3.7.1 Recommended Parameters sect239k1
The elliptic curve domain parameters over/BY
2m associated with a Koblitz curvesect239k1 are speciﬁed
by the septuple T /BP/B4 m/BN f /B4 x/B5 /BN a/BN b/BN G/BN n/BN h/B5 where m /BP 239 and the representation of /BY
2239 is deﬁned by:
f /B4 x/B5 /BP x239
/B7 x158
/B7 1
The curve E: y2
/B7 xy /BP x3
/B7 ax2
/B7 b over /BY
2m is deﬁned by:
a /BP /BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC
/BC/BC/BC/BC/BC/BC/BC/BC
b /BP /BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC
/BC/BC/BC/BC/BC/BC/BC/BD
The base point G in compressed form is:
G /BP /BC/BF/BE/BL/BT/BC /BU/BI/BT/BK/BK/BJ/BT/BL /BK/BF/BX/BL/BJ/BF/BC/BL /BK/BK/BT/BI/BK/BJ/BE/BJ /BT/BK/BU/BE/BW/BD/BE/BI /BV/BG/BG/BV/BV/BE/BV/BV /BJ/BU/BE/BT/BI/BH/BH/BH
/BD/BL/BF/BC/BF/BH/BW/BV
and in uncompressed form is:
G /BP /BC/BG /BE/BL/BT/BC/BU/BI/BT/BK /BK/BJ/BT/BL/BK/BF/BX/BL /BJ/BF/BC/BL/BK/BK/BT/BI /BK/BJ/BE/BJ/BT/BK/BU/BE /BW/BD/BE/BI/BV/BG/BG/BV /BV/BE/BV/BV/BJ/BU/BE/BT
/BI/BH/BH/BH/BD/BL/BF/BC /BF/BH/BW/BV/BJ/BI/BF/BD /BC/BK/BC/BG/BY/BD/BE/BX /BH/BG/BL/BU/BW/BU/BC/BD /BD/BV/BD/BC/BF/BC/BK/BL /BX/BJ/BF/BH/BD/BC/BT/BV /BU/BE/BJ/BH/BY/BV/BF/BD
/BE/BT/BH/BW/BV/BI/BU/BJ /BI/BH/BH/BF/BY/BC/BV/BT
Finally the order n of G and the cofactor are:
n /BP /BE/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BH/BT/BJ/BL/BY/BX /BV/BI/BJ/BV/BU/BI/BX/BL /BD/BY/BD/BV/BD/BW/BT/BK
/BC/BC/BX/BG/BJ/BK/BT/BH
h /BP /BC/BG
3.8 Recommended 283-bit Elliptic Curve Domain Parameters over /BY
2m
This section speciﬁes the two recommended 283-bit elliptic curve domain parameters over /BY
2m in this
document: parameters sect283k1 associated with a Koblitz curve, and veriﬁably random parameters
sect283r1.
Section 3.8.1 speciﬁes the elliptic curve domain parameterssect283k1, and Section 3.8.2 speciﬁes the
elliptic curve domain parameterssect283r1.
3.8.1 Recommended Parameters sect283k1
The elliptic curve domain parameters over/BY
2m associated with a Koblitz curvesect283k1 are speciﬁed
by the septuple T /BP/B4 m/BN f /B4 x/B5 /BN a/BN b/BN G/BN n/BN h/B5 where m /BP 283 and the representation of /BY
2283 is deﬁned by:

3 Recommended Elliptic Curve Domain Parameters over /BY
2m Page 31
f /B4 x/B5 /BP x283
/B7 x12
/B7 x7
/B7 x5
/B7 1
The curve E: y2
/B7 xy /BP x3
/B7 ax2
/B7 b over /BY
2m is deﬁned by:
a /BP /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC
/BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC
b /BP /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC
/BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BD
The base point G in compressed form is:
G /BP /BC/BE /BC/BH/BC/BF/BE/BD/BF/BY /BJ/BK/BV/BT/BG/BG/BK/BK /BF/BY/BD/BT/BF/BU/BK/BD /BI/BE/BY/BD/BK/BK/BX/BH /BH/BF/BV/BW/BE/BI/BH/BY /BE/BF/BV/BD/BH/BI/BJ/BT
/BD/BI/BK/BJ/BI/BL/BD/BF /BU/BC/BV/BE/BT/BV/BE/BG /BH/BK/BG/BL/BE/BK/BF/BI
and in uncompressed form is:
G /BP /BC/BG /BC/BH/BC/BF/BE/BD/BF/BY /BJ/BK/BV/BT/BG/BG/BK/BK /BF/BY/BD/BT/BF/BU/BK/BD /BI/BE/BY/BD/BK/BK/BX/BH /BH/BF/BV/BW/BE/BI/BH/BY /BE/BF/BV/BD/BH/BI/BJ/BT
/BD/BI/BK/BJ/BI/BL/BD/BF /BU/BC/BV/BE/BT/BV/BE/BG /BH/BK/BG/BL/BE/BK/BF/BI /BC/BD/BV/BV/BW/BT/BF/BK /BC/BY/BD/BV/BL/BX/BF/BD /BK/BW/BL/BC/BY/BL/BH/BW /BC/BJ/BX/BH/BG/BE/BI/BY
/BX/BK/BJ/BX/BG/BH/BV/BC /BX/BK/BD/BK/BG/BI/BL/BK /BX/BG/BH/BL/BI/BE/BF/BI /BG/BX/BF/BG/BD/BD/BI/BD /BJ/BJ/BW/BW/BE/BE/BH/BL
Finally the order n of G and the cofactor are:
n /BP /BC/BD/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BX/BL/BT/BX /BE/BX/BW/BC/BJ/BH/BJ/BJ /BE/BI/BH/BW/BY/BY/BJ/BY
/BL/BG/BG/BH/BD/BX/BC/BI /BD/BX/BD/BI/BF/BV/BI/BD
h /BP /BC/BG
3.8.2 Recommended Parameters sect283r1
The veriﬁably random elliptic curve domain parameters over /BY
2m sect283r1 are speciﬁed by the sep-
tuple T /BP/B4 m/BN f /B4 x/B5 /BN a/BN b/BN G/BN n/BN h/B5 where m /BP 283 and the representation of /BY
2283 is deﬁned by:
f /B4 x/B5 /BP x283
/B7 x12
/B7 x7
/B7 x5
/B7 1
The curve E: y2
/B7 xy /BP x3
/B7 ax2
/B7 b over /BY
2m is deﬁned by:
a /BP /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC
/BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BD
b /BP /BC/BE/BJ/BU/BI/BK/BC/BT /BV/BK/BU/BK/BH/BL/BI/BW /BT/BH/BT/BG/BT/BY/BK/BT /BD/BL/BT/BC/BF/BC/BF/BY /BV/BT/BL/BJ/BY/BW/BJ/BI /BG/BH/BF/BC/BL/BY/BT/BE /BT/BH/BK/BD/BG/BK/BH/BT
/BY/BI/BE/BI/BF/BX/BF/BD /BF/BU/BJ/BL/BT/BE/BY/BH
E was chosen veriﬁably at random from the seed:
S /BP /BJ/BJ/BX/BE/BU/BC/BJ/BF /BJ/BC/BX/BU/BC/BY/BK/BF /BE/BT/BI/BW/BW/BH/BU/BI /BE/BW/BY/BV/BK/BK/BV/BW /BC/BI/BU/BU/BK/BG/BU/BX
E was selected from S as speciﬁed in ANSI X9.62 [1] in normal basis representation and converted into

Page 32 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 0.6
polynomial basis representation.
The base point G in compressed form is:
G /BP /BC/BF /BC/BH/BY/BL/BF/BL/BE/BH /BK/BW/BU/BJ/BW/BW/BL/BC /BX/BD/BL/BF/BG/BY/BK/BV /BJ/BC/BU/BC/BW/BY/BX/BV /BE/BX/BX/BW/BE/BH/BU/BK /BH/BH/BJ/BX/BT/BV/BL/BV
/BK/BC/BX/BE/BX/BD/BL/BK /BY/BK/BV/BW/BU/BX/BV/BW /BK/BI/BU/BD/BE/BC/BH/BF
and in uncompressed form is:
G /BP /BC/BG /BC/BH/BY/BL/BF/BL/BE/BH /BK/BW/BU/BJ/BW/BW/BL/BC /BX/BD/BL/BF/BG/BY/BK/BV /BJ/BC/BU/BC/BW/BY/BX/BV /BE/BX/BX/BW/BE/BH/BU/BK /BH/BH/BJ/BX/BT/BV/BL/BV
/BK/BC/BX/BE/BX/BD/BL/BK /BY/BK/BV/BW/BU/BX/BV/BW /BK/BI/BU/BD/BE/BC/BH/BF /BC/BF/BI/BJ/BI/BK/BH/BG /BY/BX/BE/BG/BD/BG/BD/BV /BU/BL/BK/BY/BX/BI/BW/BG /BU/BE/BC/BW/BC/BE/BU/BG
/BH/BD/BI/BY/BY/BJ/BC/BE /BF/BH/BC/BX/BW/BW/BU/BC /BK/BE/BI/BJ/BJ/BL/BV/BK /BD/BF/BY/BC/BW/BY/BG/BH /BU/BX/BK/BD/BD/BE/BY/BG
Finally the order n of G and the cofactor are:
n /BP /BC/BF/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BX/BY/BL/BC /BF/BL/BL/BI/BI/BC/BY/BV /BL/BF/BK/BT/BL/BC/BD/BI
/BH/BU/BC/BG/BE/BT/BJ/BV /BX/BY/BT/BW/BU/BF/BC/BJ
h /BP /BC/BE
3.9 Recommended 409-bit Elliptic Curve Domain Parameters over /BY
2m
This section speciﬁes the two recommended 409-bit elliptic curve domain parameters over /BY
2m in this
document: parameters sect409k1 associated with a Koblitz curve, and veriﬁably random parameters
sect409r1.
Section 3.9.1 speciﬁes the elliptic curve domain parameterssect409k1, and Section 3.9.2 speciﬁes the
elliptic curve domain parameterssect409r1.
3.9.1 Recommended Parameters sect409k1
The elliptic curve domain parameters over/BY
2m associated with a Koblitz curvesect409k1 are speciﬁed
by the septuple T /BP/B4 m/BN f /B4 x/B5 /BN a/BN b/BN G/BN n/BN h/B5 where m /BP 409 and the representation of /BY
2409 is deﬁned by:
f /B4 x/B5 /BP x409
/B7 x87
/B7 1
The curve E: y2
/B7 xy /BP x3
/B7 ax2
/B7 b over /BY
2m is deﬁned by:
a /BP /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC
/BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC
b /BP /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC
/BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BD
The base point G in compressed form is:

3 Recommended Elliptic Curve Domain Parameters over /BY
2m Page 33
G /BP /BC/BF /BC/BC/BI/BC/BY/BC/BH/BY /BI/BH/BK/BY/BG/BL/BV/BD /BT/BW/BF/BT/BU/BD/BK/BL /BC/BY/BJ/BD/BK/BG/BE/BD /BC/BX/BY/BW/BC/BL/BK/BJ /BX/BF/BC/BJ/BV/BK/BG/BV
/BE/BJ/BT/BV/BV/BY/BU/BK /BY/BL/BY/BI/BJ/BV/BV/BE /BV/BG/BI/BC/BD/BK/BL/BX /BU/BH/BT/BT/BT/BT/BI/BE /BX/BX/BE/BE/BE/BX/BU/BD /BU/BF/BH/BH/BG/BC/BV/BY /BX/BL/BC/BE/BF/BJ/BG/BI
and in uncompressed form is:
G /BP /BC/BG /BC/BC/BI/BC/BY/BC/BH/BY /BI/BH/BK/BY/BG/BL/BV/BD /BT/BW/BF/BT/BU/BD/BK/BL /BC/BY/BJ/BD/BK/BG/BE/BD /BC/BX/BY/BW/BC/BL/BK/BJ /BX/BF/BC/BJ/BV/BK/BG/BV
/BE/BJ/BT/BV/BV/BY/BU/BK /BY/BL/BY/BI/BJ/BV/BV/BE /BV/BG/BI/BC/BD/BK/BL/BX /BU/BH/BT/BT/BT/BT/BI/BE /BX/BX/BE/BE/BE/BX/BU/BD /BU/BF/BH/BH/BG/BC/BV/BY /BX/BL/BC/BE/BF/BJ/BG/BI
/BC/BD/BX/BF/BI/BL/BC/BH /BC/BU/BJ/BV/BG/BX/BG/BE /BT/BV/BU/BT/BD/BW/BT/BV /BU/BY/BC/BG/BE/BL/BL/BV /BF/BG/BI/BC/BJ/BK/BE/BY /BL/BD/BK/BX/BT/BG/BE/BJ /BX/BI/BF/BE/BH/BD/BI/BH
/BX/BL/BX/BT/BD/BC/BX/BF /BW/BT/BH/BY/BI/BV/BG/BE /BX/BL/BV/BH/BH/BE/BD/BH /BT/BT/BL/BV/BT/BE/BJ/BT /BH/BK/BI/BF/BX/BV/BG/BK /BW/BK/BX/BC/BE/BK/BI/BU
Finally the order n of G and the cofactor are:
n /BP /BJ/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BX/BH/BY
/BK/BF/BU/BE/BW/BG/BX/BT /BE/BC/BG/BC/BC/BX/BV/BG /BH/BH/BJ/BW/BH/BX/BW/BF /BX/BF/BX/BJ/BV/BT/BH/BU /BG/BU/BH/BV/BK/BF/BU/BK /BX/BC/BD/BX/BH/BY/BV/BY
h /BP /BC/BG
3.9.2 Recommended Parameters sect409r1
The veriﬁably random elliptic curve domain parameters over /BY
2m sect409r1 are speciﬁed by the sep-
tuple T /BP/B4 m/BN f /B4 x/B5 /BN a/BN b/BN G/BN n/BN h/B5 where m /BP 409 and the representation of /BY
2409 is deﬁned by:
f /B4 x/B5 /BP x409
/B7 x87
/B7 1
The curve E: y2
/B7 xy /BP x3
/B7 ax2
/B7 b over /BY
2m is deﬁned by:
a /BP /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC
/BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BD
b /BP /BC/BC/BE/BD/BT/BH/BV/BE /BV/BK/BX/BX/BL/BY/BX/BU /BH/BV/BG/BU/BL/BT/BJ/BH /BF/BU/BJ/BU/BG/BJ/BI/BU /BJ/BY/BW/BI/BG/BE/BE/BX /BY/BD/BY/BF/BW/BW/BI/BJ /BG/BJ/BI/BD/BY/BT/BL/BL
/BW/BI/BT/BV/BE/BJ/BV/BK /BT/BL/BT/BD/BL/BJ/BU/BE /BJ/BE/BK/BE/BE/BY/BI/BV /BW/BH/BJ/BT/BH/BH/BT/BT /BG/BY/BH/BC/BT/BX/BF/BD /BJ/BU/BD/BF/BH/BG/BH/BY
E was chosen veriﬁably at random from the seed:
S /BP /BG/BC/BL/BL/BU/BH/BT/BG /BH/BJ/BY/BL/BW/BI/BL/BY /BJ/BL/BE/BD/BF/BW/BC/BL /BG/BV/BG/BU/BV/BW/BG/BW /BG/BE/BI/BE/BE/BD/BC/BU
E was selected from S as speciﬁed in ANSI X9.62 [1] in normal basis representation and converted into
polynomial basis representation.
The base point G in compressed form is:
G /BP /BC/BF /BC/BD/BH/BW/BG/BK/BI/BC /BW/BC/BK/BK/BW/BW/BU/BF /BG/BL/BI/BU/BC/BV/BI/BC /BI/BG/BJ/BH/BI/BE/BI/BC /BG/BG/BD/BV/BW/BX/BG/BT /BY/BD/BJ/BJ/BD/BW/BG/BW
/BU/BC/BD/BY/BY/BX/BH/BU /BF/BG/BX/BH/BL/BJ/BC/BF /BW/BV/BE/BH/BH/BT/BK/BI /BK/BT/BD/BD/BK/BC/BH/BD /BH/BI/BC/BF/BT/BX/BT/BU /BI/BC/BJ/BL/BG/BX/BH/BG /BU/BU/BJ/BL/BL/BI/BT/BJ
and in uncompressed form is:

Page 34 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 0.6
G /BP /BC/BG /BC/BD/BH/BW/BG/BK/BI/BC /BW/BC/BK/BK/BW/BW/BU/BF /BG/BL/BI/BU/BC/BV/BI/BC /BI/BG/BJ/BH/BI/BE/BI/BC /BG/BG/BD/BV/BW/BX/BG/BT /BY/BD/BJ/BJ/BD/BW/BG/BW
/BU/BC/BD/BY/BY/BX/BH/BU /BF/BG/BX/BH/BL/BJ/BC/BF /BW/BV/BE/BH/BH/BT/BK/BI /BK/BT/BD/BD/BK/BC/BH/BD /BH/BI/BC/BF/BT/BX/BT/BU /BI/BC/BJ/BL/BG/BX/BH/BG /BU/BU/BJ/BL/BL/BI/BT/BJ
/BC/BC/BI/BD/BU/BD/BV/BY /BT/BU/BI/BU/BX/BH/BY/BF /BE/BU/BU/BY/BT/BJ/BK/BF /BE/BG/BX/BW/BD/BC/BI/BT /BJ/BI/BF/BI/BU/BL/BV/BH /BT/BJ/BU/BW/BD/BL/BK/BW /BC/BD/BH/BK/BT/BT/BG/BY
/BH/BG/BK/BK/BW/BC/BK/BY /BF/BK/BH/BD/BG/BY/BD/BY /BW/BY/BG/BU/BG/BY/BG/BC /BW/BE/BD/BK/BD/BU/BF/BI /BK/BD/BV/BF/BI/BG/BU/BT /BC/BE/BJ/BF/BV/BJ/BC/BI
Finally the order n of G and the cofactor are:
n /BP /BC/BD/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BD/BX/BE
/BT/BT/BW/BI/BT/BI/BD/BE /BY/BF/BF/BF/BC/BJ/BU/BX /BH/BY/BT/BG/BJ/BV/BF/BV /BL/BX/BC/BH/BE/BY/BK/BF /BK/BD/BI/BG/BV/BW/BF/BJ /BW/BL/BT/BE/BD/BD/BJ/BF
h /BP /BC/BE
3.10 Recommended 571-bit Elliptic Curve Domain Parameters over /BY
2m
This section speciﬁes the two recommended 571-bit elliptic curve domain parameters over /BY
2m in this
document: parameters sect571k1 associated with a Koblitz curve, and veriﬁably random parameters
sect571r1.
Section 3.10.1 speciﬁes the elliptic curve domain parameters sect571k1, and Section 3.10.2 speciﬁes
the elliptic curve domain parameterssect571r1.
3.10.1 Recommended Parameters sect571k1
The elliptic curve domain parameters over/BY
2m associated with a Koblitz curvesect571k1 are speciﬁed
by the septuple T /BP/B4 m/BN f /B4 x/B5 /BN a/BN b/BN G/BN n/BN h/B5 where m /BP 571 and the representation of /BY
2571 is deﬁned by:
f /B4 x/B5 /BP x571
/B7 x10
/B7 x5
/B7 x2
/B7 1
The curve E: y2
/B7 xy /BP x3
/B7 ax2
/B7 b over /BY
2m is deﬁned by:
a /BP /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC
/BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC
/BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC
b /BP /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC
/BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC
/BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BD
The base point G in compressed form is:
G /BP /BC/BE /BC/BE/BI/BX/BU/BJ/BT/BK /BH/BL/BL/BE/BF/BY/BU/BV /BK/BE/BD/BK/BL/BI/BF/BD /BY/BK/BD/BC/BF/BY/BX/BG /BT/BV/BL/BV/BT/BE/BL/BJ /BC/BC/BD/BE/BW/BH/BW/BG
/BI/BC/BE/BG/BK/BC/BG/BK /BC/BD/BK/BG/BD/BV/BT/BG /BG/BF/BJ/BC/BL/BH/BK/BG /BL/BF/BU/BE/BC/BH/BX/BI /BG/BJ/BW/BT/BF/BC/BG/BW /BU/BG/BV/BX/BU/BC/BK/BV /BU/BU/BW/BD/BU/BT/BF/BL
/BG/BL/BG/BJ/BJ/BI/BY/BU /BL/BK/BK/BU/BG/BJ/BD/BJ /BG/BW/BV/BT/BK/BK/BV/BJ /BX/BE/BL/BG/BH/BE/BK/BF /BT/BC/BD/BV/BK/BL/BJ/BE

3 Recommended Elliptic Curve Domain Parameters over /BY
2m Page 35
and in uncompressed form is:
G /BP /BC/BG /BC/BE/BI/BX/BU/BJ/BT/BK /BH/BL/BL/BE/BF/BY/BU/BV /BK/BE/BD/BK/BL/BI/BF/BD /BY/BK/BD/BC/BF/BY/BX/BG /BT/BV/BL/BV/BT/BE/BL/BJ /BC/BC/BD/BE/BW/BH/BW/BG
/BI/BC/BE/BG/BK/BC/BG/BK /BC/BD/BK/BG/BD/BV/BT/BG /BG/BF/BJ/BC/BL/BH/BK/BG /BL/BF/BU/BE/BC/BH/BX/BI /BG/BJ/BW/BT/BF/BC/BG/BW /BU/BG/BV/BX/BU/BC/BK/BV /BU/BU/BW/BD/BU/BT/BF/BL
/BG/BL/BG/BJ/BJ/BI/BY/BU /BL/BK/BK/BU/BG/BJ/BD/BJ /BG/BW/BV/BT/BK/BK/BV/BJ /BX/BE/BL/BG/BH/BE/BK/BF /BT/BC/BD/BV/BK/BL/BJ/BE /BC/BF/BG/BL/BW/BV/BK/BC /BJ/BY/BG/BY/BU/BY/BF/BJ
/BG/BY/BG/BT/BX/BT/BW/BX /BF/BU/BV/BT/BL/BH/BF/BD /BG/BW/BW/BH/BK/BV/BX/BV /BL/BY/BF/BC/BJ/BT/BH/BG /BY/BY/BV/BI/BD/BX/BY/BV /BC/BC/BI/BW/BK/BT/BE/BV /BL/BW/BG/BL/BJ/BL/BV/BC
/BT/BV/BG/BG/BT/BX/BT/BJ /BG/BY/BU/BX/BU/BU/BU/BL /BY/BJ/BJ/BE/BT/BX/BW/BV /BU/BI/BE/BC/BU/BC/BD/BT /BJ/BU/BT/BJ/BT/BY/BD/BU /BF/BE/BC/BG/BF/BC/BV/BK /BH/BL/BD/BL/BK/BG/BY/BI
/BC/BD/BV/BW/BG/BV/BD/BG /BF/BX/BY/BD/BV/BJ/BT/BF
Finally the order n of G and the cofactor are:
n /BP /BC/BE/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC
/BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BD/BF/BD/BK/BH/BC/BX/BD /BY/BD/BL/BT/BI/BF/BX/BG /BU/BF/BL/BD/BT/BK/BW/BU /BL/BD/BJ/BY/BG/BD/BF/BK /BU/BI/BF/BC/BW/BK/BG/BU
/BX/BH/BW/BI/BF/BL/BF/BK /BD/BX/BL/BD/BW/BX/BU/BG /BH/BV/BY/BX/BJ/BJ/BK/BY /BI/BF/BJ/BV/BD/BC/BC/BD
h /BP /BC/BG
3.10.2 Recommended Parameters sect571r1
The veriﬁably random elliptic curve domain parameters over /BY
2m sect571r1 are speciﬁed by the sep-
tuple T /BP/B4 m/BN f /B4 x/B5 /BN a/BN b/BN G/BN n/BN h/B5 where m /BP 571 and the representation of /BY
2571 is deﬁned by:
f /B4 x/B5 /BP x571
/B7 x10
/B7 x5
/B7 x2
/B7 1
The curve E: y2
/B7 xy /BP x3
/B7 ax2
/B7 b over /BY
2m is deﬁned by:
a /BP /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC
/BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC
/BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BC /BC/BC/BC/BC/BC/BC/BC/BD
b /BP /BC/BE/BY/BG/BC/BX/BJ/BX /BE/BE/BE/BD/BY/BE/BL/BH /BW/BX/BE/BL/BJ/BD/BD/BJ /BU/BJ/BY/BF/BW/BI/BE/BY /BH/BV/BI/BT/BL/BJ/BY/BY /BV/BU/BK/BV/BX/BY/BY/BD /BV/BW/BI/BU/BT/BK/BV/BX
/BG/BT/BL/BT/BD/BK/BT/BW /BK/BG/BY/BY/BT/BU/BU/BW /BK/BX/BY/BT/BH/BL/BF/BF /BE/BU/BX/BJ/BT/BW/BI/BJ /BH/BI/BT/BI/BI/BX/BE/BL /BG/BT/BY/BW/BD/BK/BH/BT /BJ/BK/BY/BY/BD/BE/BT/BT
/BH/BE/BC/BX/BG/BW/BX/BJ /BF/BL/BU/BT/BV/BT/BC/BV /BJ/BY/BY/BX/BY/BY/BJ/BY /BE/BL/BH/BH/BJ/BE/BJ/BT
E was chosen veriﬁably at random from the seed:
S /BP /BE/BT/BT/BC/BH/BK/BY/BJ /BF/BT/BC/BX/BF/BF/BT/BU /BG/BK/BI/BU/BC/BY/BI/BD /BC/BG/BD/BC/BV/BH/BF/BT /BJ/BY/BD/BF/BE/BF/BD/BC
E was selected from S as speciﬁed in ANSI X9.62 [1] in normal basis representation and converted into
polynomial basis representation.
The base point G in compressed form is:

Page 36 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 0.6
G /BP /BC/BF /BC/BF/BC/BF/BC/BC/BD/BW /BF/BG/BU/BK/BH/BI/BE/BL /BI/BV/BD/BI/BV/BC/BW/BG /BC/BW/BF/BV/BW/BJ/BJ/BH /BC/BT/BL/BF/BW/BD/BW/BE /BL/BH/BH/BY/BT/BK/BC/BT
/BT/BH/BY/BG/BC/BY/BV/BK /BW/BU/BJ/BU/BE/BT/BU/BW /BU/BW/BX/BH/BF/BL/BH/BC /BY/BG/BV/BC/BW/BE/BL/BF /BV/BW/BW/BJ/BD/BD/BT/BF /BH/BU/BI/BJ/BY/BU/BD/BG /BL/BL/BT/BX/BI/BC/BC/BF
/BK/BI/BD/BG/BY/BD/BF/BL /BG/BT/BU/BY/BT/BF/BU/BG /BV/BK/BH/BC/BW/BL/BE/BJ /BX/BD/BX/BJ/BJ/BI/BL/BV /BK/BX/BX/BV/BE/BW/BD/BL
and in uncompressed form is:
G /BP /BC/BG /BC/BF/BC/BF/BC/BC/BD/BW /BF/BG/BU/BK/BH/BI/BE/BL /BI/BV/BD/BI/BV/BC/BW/BG /BC/BW/BF/BV/BW/BJ/BJ/BH /BC/BT/BL/BF/BW/BD/BW/BE /BL/BH/BH/BY/BT/BK/BC/BT
/BT/BH/BY/BG/BC/BY/BV/BK /BW/BU/BJ/BU/BE/BT/BU/BW /BU/BW/BX/BH/BF/BL/BH/BC /BY/BG/BV/BC/BW/BE/BL/BF /BV/BW/BW/BJ/BD/BD/BT/BF /BH/BU/BI/BJ/BY/BU/BD/BG /BL/BL/BT/BX/BI/BC/BC/BF
/BK/BI/BD/BG/BY/BD/BF/BL /BG/BT/BU/BY/BT/BF/BU/BG /BV/BK/BH/BC/BW/BL/BE/BJ /BX/BD/BX/BJ/BJ/BI/BL/BV /BK/BX/BX/BV/BE/BW/BD/BL /BC/BF/BJ/BU/BY/BE/BJ/BF /BG/BE/BW/BT/BI/BF/BL/BU
/BI/BW/BV/BV/BY/BY/BY/BX /BU/BJ/BF/BW/BI/BL/BW/BJ /BK/BV/BI/BV/BE/BJ/BT/BI /BC/BC/BL/BV/BU/BU/BV/BT /BD/BL/BK/BC/BY/BK/BH/BF /BF/BL/BE/BD/BX/BK/BT/BI /BK/BG/BG/BE/BF/BX/BG/BF
/BU/BT/BU/BC/BK/BT/BH/BJ /BI/BE/BL/BD/BT/BY/BK/BY /BG/BI/BD/BU/BU/BE/BT/BK /BU/BF/BH/BF/BD/BW/BE/BY /BC/BG/BK/BH/BV/BD/BL/BU /BD/BI/BX/BE/BY/BD/BH/BD /BI/BX/BE/BF/BW/BW/BF/BV
/BD/BT/BG/BK/BE/BJ/BT/BY /BD/BU/BK/BT/BV/BD/BH/BU
Finally the order n of G and the cofactor are:
n /BP /BC/BF/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY
/BY/BY/BY/BY/BY/BY/BY/BY /BY/BY/BY/BY/BY/BY/BY/BY /BX/BI/BI/BD/BV/BX/BD/BK /BY/BY/BH/BH/BL/BK/BJ/BF /BC/BK/BC/BH/BL/BU/BD/BK /BI/BK/BE/BF/BK/BH/BD/BX /BV/BJ/BW/BW/BL/BV/BT/BD
/BD/BI/BD/BW/BX/BL/BF/BW /BH/BD/BJ/BG/BW/BI/BI/BX /BK/BF/BK/BE/BX/BL/BU/BU /BE/BY/BX/BK/BG/BX/BG/BJ
h /BP /BC/BE

A ASN.1 Syntax Page 37
A ASN.1 Syntax
This section discusses the representation of elliptic curve domain parameters using ASN.1 syntax and
speciﬁes ASN.1 object identiﬁers for the elliptic curve domain parameters recommended in this docu-
ment.
A.1 Elliptic Curve Domain Parameters
There are a number of ways of representing elliptic curve domain parameters using ASN.1 syntax. The
following syntax is recommended in SEC 1 [10] for use in X.509 certiﬁcates and elsewhere (follow-
ing [3]).
Parameters ::= CHOICE {
ecParameters ECParameters,
namedCurve CURVES.&id({CurveNames}),
implicitCA NULL
}
where
/AF ecParameters of typeECParameters indicates that the full elliptic curve domain parameters
are given,
/AF namedCurve of type CURVES indicates that a named curve from the set delimited by Curve-
Names is to be used, and
/AF implicitCA of typeNULL indicates that the curve is known implicitly, that is, the actual curve
is known to both parties by other means.
The following syntax is then used to describe explicit representations of elliptic curve domain parameters,
if need be.
ECParameters ::= SEQUENCE {
version INTEGER { ecpVer1(1) } (ecpVer1),
fieldID FieldID {{FieldTypes}},
curve Curve,
base ECPoint,
order INTEGER,
cofactor INTEGER OPTIONAL,
...
}
See SEC 1 [10] for more details on the explicit representation of elliptic curve domain parameters.

Page 38 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 0.6
A.2 Object Identiﬁers for Recommended Parameters
This section speciﬁes object identiﬁers for the elliptic curve domain parameters recommended in this
document. These object identiﬁers may be used, for example, to represent parameters using thenamed-
Curve syntax described in the previous section.
Parameters that have not previously been assigned object identiﬁers appear in the tree whose root is
designated by the object identiﬁercerticom-arc. It has the following value.
certicom-arc OBJECT IDENTIFIER ::= {
iso(1) identified-organization(3) certicom(132)
}
Parameters that are given as examples in ANSI X9.62 [1] appear in the tree whose root is designated by
the object identiﬁeransi-X9-62. It has the following value.
ansi-X9-62 OBJECT IDENTIFIER ::= {
iso(1) member-body(2) us(840) 10045
}
The values of the object identiﬁers of parameters given in ANSI X9.62 are duplicated here for conve-
nience.
To reduce the encoded lengths, the parameters undercerticom-arc appear just below the main node.
The object identiﬁerellipticCurve represents the root of the tree containing all such parameters in
this document and has the following value.
ellipticCurve OBJECT IDENTIFIER ::= { certicom-arc curve(0) }
The actual parameters appear immediately below this; their object identiﬁers may be found in the fol-
lowing sections. Section A.2.1 speciﬁes object identiﬁers for the parameters over
/BY
p, and Section A.2.2
speciﬁes object identiﬁers for the parameters over /BY
2m .
A.2.1 OIDs for Recommended Parameters over /BY
p
The object identiﬁers for the recommended parameters over /BY
p have the following values. The names
of the identiﬁers agree with the nicknames given to the parameters in this document. In ANSI X9.62
[1], the curve secp192r1 is designated prime192v1, and the curve secp256r1 is designated
prime256v1.
--
-- Curves over prime-order fields:
--

A ASN.1 Syntax Page 39
secp112r1 OBJECT IDENTIFIER ::= { ellipticCurve 6 }
secp112r2 OBJECT IDENTIFIER ::= { ellipticCurve 7 }
secp128r1 OBJECT IDENTIFIER ::= { ellipticCurve 28 }
secp128r2 OBJECT IDENTIFIER ::= { ellipticCurve 29 }
secp160k1 OBJECT IDENTIFIER ::= { ellipticCurve 9 }
secp160r1 OBJECT IDENTIFIER ::= { ellipticCurve 8 }
secp160r2 OBJECT IDENTIFIER ::= { ellipticCurve 30 }
secp192k1 OBJECT IDENTIFIER ::= { ellipticCurve 31 }
secp192r1 OBJECT IDENTIFIER ::= { ansi-X9-62 curves(3) prime(1) 1 }
secp224k1 OBJECT IDENTIFIER ::= { ellipticCurve 32 }
secp224r1 OBJECT IDENTIFIER ::= { ellipticCurve 33 }
secp256k1 OBJECT IDENTIFIER ::= { ellipticCurve 10 }
secp256r1 OBJECT IDENTIFIER ::= { ansi-X9-62 curves(3) prime(1) 7 }
secp384r1 OBJECT IDENTIFIER ::= { ellipticCurve 34 }
secp521r1 OBJECT IDENTIFIER ::= { ellipticCurve 35 }
A.2.2 OIDs for Recommended Parameters over
/BY
2m
The object identiﬁers for the recommended parameters over /BY
2m have the following values. The names
of the identiﬁers agree with the nicknames given to the parameters in this document.
--
-- Curves over characteristic 2 fields.
--
sect113r1 OBJECT IDENTIFIER ::= { ellipticCurve 4 }
sect113r2 OBJECT IDENTIFIER ::= { ellipticCurve 5 }
sect131r1 OBJECT IDENTIFIER ::= { ellipticCurve 22 }
sect131r2 OBJECT IDENTIFIER ::= { ellipticCurve 23 }
sect163k1 OBJECT IDENTIFIER ::= { ellipticCurve 1 }
sect163r1 OBJECT IDENTIFIER ::= { ellipticCurve 2 }
sect163r2 OBJECT IDENTIFIER ::= { ellipticCurve 15 }
sect193r1 OBJECT IDENTIFIER ::= { ellipticCurve 24 }

Page 40 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 0.6
sect193r2 OBJECT IDENTIFIER ::= { ellipticCurve 25 }
sect233k1 OBJECT IDENTIFIER ::= { ellipticCurve 26 }
sect233r1 OBJECT IDENTIFIER ::= { ellipticCurve 27 }
sect239k1 OBJECT IDENTIFIER ::= { ellipticCurve 3 }
sect283k1 OBJECT IDENTIFIER ::= { ellipticCurve 16 }
sect283r1 OBJECT IDENTIFIER ::= { ellipticCurve 17 }
sect409k1 OBJECT IDENTIFIER ::= { ellipticCurve 36 }
sect409r1 OBJECT IDENTIFIER ::= { ellipticCurve 37 }
sect571k1 OBJECT IDENTIFIER ::= { ellipticCurve 38 }
sect571r1 OBJECT IDENTIFIER ::= { ellipticCurve 39 }
A.2.3 The Information Object Set SECGCurveNames
The following information object setSECGCurveNames of classCURVES m a yb eu s e dt od e l i n e a t et h e
use of a curve recommended in this document. When it is used to govern the component namedCurve
ofParameters (deﬁned in section A.1), the value of namedCurve must be one of the values of the
set.
SECGCurveNames CURVES ::= {
-- Curves over prime-order fields:
{ ID secp112r1 } |
{ ID secp112r2 } |
{ ID secp128r1 } |
{ ID secp128r2 } |
{ ID secp160k1 } |
{ ID secp160r1 } |
{ ID secp160r2 } |
{ ID secp192k1 } |
{ ID secp192r1 } |
{ ID secp224k1 } |
{ ID secp224r1 } |
{ ID secp256k1 } |
{ ID secp256r1 } |
{ ID secp384r1 } |
{ ID secp521r1 } |
-- Curves over characteristic 2 fields:
{ ID sect113r1 } |

A ASN.1 Syntax Page 41
{ ID sect113r2 } |
{ ID sect131r1 } |
{ ID sect131r2 } |
{ ID sect163k1 } |
{ ID sect163r1 } |
{ ID sect163r2 } |
{ ID sect193r1 } |
{ ID sect193r2 } |
{ ID sect233k1 } |
{ ID sect233r1 } |
{ ID sect239k1 } |
{ ID sect283k1 } |
{ ID sect283r1 } |
{ ID sect409k1 } |
{ ID sect409r1 } |
{ ID sect571k1 } |
{ ID sect571r1 } ,
...
}
The typeCURVES used above is deﬁned below.
CURVES ::= CLASS {
&curve-id OBJECT IDENTIFIER UNIQUE
} WITH SYNTAX { ID &curve-id }

Page 42 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 0.6
B References
The following references are cited in this document:
[1] ANSI X9.62-1998: Public Key Cryptography for the Financial Services Industry: the Elliptic Curve
Digital Signature Algorithm (ECDSA). American Bankers Association, 1998.
[2] ANSI X9.63-199x: Public Key Cryptography for the Financial Services Industry: Key Agreement
and Key Transport Using Elliptic Curve Cryptography . American Bankers Association, October,
1999. Working Draft.
[3] L. Bassham, D. Johnson, and W. Polk. Representation of Elliptic Curve Digital Signature Algo-
rithm (ECDSA) keys and signatures in Internet X.509 public key infrastructure certiﬁcates. In-
ternet Engineering Task Force, PKIX working group. Internet Draft. June, 1999. Available from:
http://www.ietf.org/
[4] FSML. Financial services markup language . Financial Services Technology Consortium, August,
1999. Working Draft.
[5] IEEE P1363. Standard for Public-Key Cryptography . Institute of Electrical and Electronics Engi-
neers. July, 1999. Working Draft.
[6] N. Koblitz. CM-curves with good cryptographic properties. In Advances in Cryptology: Crypto ’91,
volume 576 of Lecture Notes in Computer Science, pages 279–287, Springer-Verlag, 1992.
[7] P. Montgomery. Speeding the Pollard and elliptic curve methods of factorization. Mathematics of
Computation, volume 48, pages 243–264, 1987.
[8] National Institute of Standards and Technology. Recommended elliptic curves for federal government
use. July, 1999. Available from:http://csrc.nist.gov/encryption/
[9] P. Panjwani and Y . Poeluev. Additional ECC groups for IKE. Internet Engineering Task Force, IPSec
working group. Internet Draft. August, 1999. Available from:http://www.ietf.org/
[10] SEC 1. Elliptic Curve Cryptography. Standards for Efﬁcient Cryptography Group, September, 1999.
Working Draft. Available from:http://www.secg.org/
[11] W AP WTLS.Wireless Application Protocol Wireless Transport Layer Security Speciﬁcation. Wire-
less Application Forum, February, 1999.

Page 43
Parameters Section Strength Size RSA/DSA Koblitz or
random
sect113r1 3.2.1 56 113 512 r
sect113r2 3.2.2 56 113 512 r
sect131r1 3.3.1 64 131 704 r
sect131r2 3.3.2 64 131 704 r
sect163k1 3.4.1 80 163 1024 k
sect163r1 3.4.2 80 163 1024 r
sect163r2 3.4.3 80 163 1024 r
sect193r1 3.5.1 96 193 1536 r
sect193r2 3.5.2 96 193 1536 r
sect233k1 3.6.1 112 233 2240 k
sect233r1 3.6.2 112 233 2240 r
sect239k1 3.7.1 115 239 2304 k
sect283k1 3.8.1 128 283 3456 k
sect283r1 3.8.2 128 283 3456 r
sect409k1 3.9.1 192 409 7680 k
sect409r1 3.9.2 192 409 7680 r
sect571k1 3.10.1 256 571 15360 k
sect571r1 3.10.2 256 571 15360 r
Table 4: Properties of Recommended Elliptic Curve Domain Parameters over /BY
2m

Page 44 SEC 2: Recommended Elliptic Curve Domain Parameters Ver. 0.6
Parameters Section ANSI X9.62 ANSI X9.63 echeck IEEE P1363 IPSec NIST WA P
sect113r1 3.2.1 - - - c c - r
sect113r2 3.2.2 - - - c c - c
sect131r1 3.3.1 - - - c c - c
sect131r2 3.3.2 - - - c c - c
sect163k1 3.4.1 c r r c r r r
sect163r1 3.4.2 c c r c r - c
sect163r2 3.4.3 c r r c c r c
sect193r1 3.5.1 c r c c c - c
sect193r2 3.5.2 c r c c c - c
sect233k1 3.6.1 c r c c c r c
sect233r1 3.6.2 c r c c c r c
sect239k1 3.7.1 c c c c c - c
sect283k1 3.8.1 c r r c r r c
sect283r1 3.8.2 c r r c r r c
sect409k1 3.9.1 c r c c c r c
sect409r1 3.9.2 c r c c c r c
sect571k1 3.10.1 c r c c c r c
sect571r1 3.10.2 c r c c c r c
Table 5: Status of Recommended Elliptic Curve Domain Parameters over /BY
2m