Bitcoin's anonymity and asset security rest entirely on rigorous cryptography. Since its inception, the elliptic curve digital signature algorithm (ECDSA) it uses has been regarded as unbreakable. Recently, however, several cryptographers have begun to re-examine Satoshi Nakamoto's original design choices, especially the particular elliptic curve known as secp256k1.
Elliptic Curves: The Backbone of Bitcoin Security
To grasp the controversy, it is essential to understand the role of elliptic curves in Bitcoin. Every Bitcoin address is associated with a pair of keys: a public key and a private key. The public key acts like a bank account number that can be shared openly, while the private key resembles a PIN that must be kept confidential. The relationship between the two is generated through elliptic curve cryptography — specifically, the private key is used together with the secp256k1 curve in a one-way cryptographic function to quickly produce the corresponding public key. Because of the algorithm's irreversibility, even if the public key is fully exposed, deducing the private key is computationally infeasible unless the curve itself is flawed.
In other words, transaction verification, digital signatures, and ownership confirmation in Bitcoin all rely on the security assumptions of ECDSA. If the elliptic curve were ever compromised, the entire trust foundation of the Bitcoin network would collapse instantly.
Why Does secp256k1 Raise Backdoor Suspicions?
The curve secp256k1 is a Koblitz curve published by the U.S. National Institute of Standards and Technology (NIST) in 2000. Compared with other commonly used curves of the same era, it had not undergone thorough security review or extensive academic discussion at the time. This raises the question: why did Satoshi choose this particular curve?
Renowned cryptographer Tatsuaki Okamoto, director of the NTT Research Cryptography and Information Security Lab, stated bluntly: "Satoshi chose it either because it offered higher computational efficiency, or because it leaves a secret backdoor." He emphasized that this is merely a logical hypothesis, as Satoshi's true motives remain unknown. Okamoto also admitted that combining multiple cryptographic components — public-key cryptography, hash functions, and others — into the world's first decentralized currency was an impressive feat in itself.
Bitcoin Core developer Wladimir van der Laan added that he too is unaware of Satoshi's rationale, but this does not affect the current operation of the system. Nonetheless, with the advancement of technologies such as quantum computing, whether this "insufficiently studied" curve could become a latent risk deserves continuous attention.