Quote from: funkenstein on September 20, 2019, 12:42:38 AM

A more interesting question is why he went for secp-256k1.

As far as we know through the communication mails from satoshi, there is no real reason as to why secp256k1 is used in bitcoin security.

Also we need to note that, secpk1 was never widely used before bitcoin. Apart from pooya87's post on the usage of secp256k1 instead of secp256r1, there seems to be another interesting fact linked to the NIST curves and SECG curves. secp256k1 is a Koblitz and more importantly a pure SECG curve whereas secp256r1 is a NIST curve. NIST and NSA seems to have a good relationship right from 2000's, so satoshi could have figured out the backdoor vulnerability implemented by the NSA in NIST sort of curves. This backdoor was known to be true when Snowden leaked the private documents of NIST! Either way, when Mike Hearn communicated satoshi they said it was purely random and there was no specific reason to use secp256k1.

Another theory could be like, satoshi was coding and creating bitcoin from 2007 but on the other hand satoshi could be well aware of this news published by Wired in 2007. So, satoshi could have thought secp256k1 might be a secure way for random number generation rather than trusting secp256r1 created by NIST.

See this :

Quote from: Mike Hearn on January 11, 2011, 10:31:40 PM

I discussed this with Satoshi. There is no particular reason why secp256k1 is used. It just happened to be around at the time.