Quote from: fevirfevir on August 10, 2015, 08:21:18 AM

1. Which ECDSA curve is used in Bitcoin to generate a private key? Where does it read in the code?

Bitcoin's ECDSA uses secp256k1.

What code? There are multiple Bitcoin implementations. For example, in bitcoinjs: https://github.com/bitcoinjs/bitcoinjs-lib/search?q=secp256k1

Quote

2. Why are both curves mentioned on Bitcoin's Github?

Not sure, I assume P-256 might have been discussed as an alternative. But it's definitely secp256k1.

Quote

3. If either is used, is that a smart thing to do, considering that both are not considered safe? Wouldn't it be better to use a 'safe' curve?

'Safe' is very relative here. It refers to certain mathematical properties, which are still purely theoretical and having absolutely no implications for real life safety. At least not yet, and this is extremely unlikely to change within the foreseeable future. Even if a vulnerability would come to light, it's typically discovered as a theoretical, possible issue in the distant future, with many years between moment of discovery and actual possibility to effectively put in in practice.

Remember, even with its 'unsafe' curves like secp256k1, Bitcoin is still lightyears ahead of regular financial system and payment protocols (like wire transfers, online banking, visa, paypal, etc) in terms of security.

If I'm not mistaken, Satoshi chose secp256k1 because:
1. it's provably not rigged, i.e. uses only deterministic constants, and no funny, arbitrary, supposedly 'pseudo random' or other suspicious values.
2. speed, secp256k1 signature and validation could be performed considerably faster than other, 'heavier' curves (although one could argue if that's still a legitimate criterium).

Quote

4. Would it be possible to use both curves amongst multiple users, depending on a user's preferences?

Yes, a signature could start with a version bit or byte or something, although obviously this would require a hard fork.

Quote

5. Extending that question, if someone found a major flaw in the ECDSA algorithm currently used, would it be possible to switch to another ECDSA algorithm? (no worries, I didn't find a major flaw :-) )

Yes. Although again this would require a hard fork of course. Same for the hashing algorithms involved (e.g. if sha256 is broken). Bitcoin is not 'set in stone', whenever the need arises and consensus is reached (and I think, when future security is at stake, consensus will be reached much easier than the ongoing blocksize debate) then Bitcoin could adapt.